Skip to content
VoteSure
Menu

Privacy Policy

VoteSure Privacy Policy

At VoteSure, operated by Afrotech Laboratories Ltd, we collect and manage data according to this Privacy Policy, which is part of VoteSure's Terms of Service. By using votesure.org (the "Website") or the Services, you agree to this Privacy Policy and the Terms of Service. Please read the Terms of Service in full for definitions and contact details.

1. Two kinds of people this policy covers

VoteSure's data model has an important distinction that a generic privacy policy doesn't usually need to make, so we're stating it plainly:

  1. Account Holders — the staff at an institution who register with VoteSure, build elections, and manage the platform. Account Holders provide their own name and email, and must meet the age and legal-capacity requirements in our Terms of Service.
  2. Voters — the people an institution invites to vote in a specific election. Voters do not create a VoteSure account; the institution submits their information (name, a unique identifier such as a student or staff ID, and a phone number or email for delivery) to VoteSure, not the voter directly. Voters may be of any age, including minors — for example, students voting in a school or university class election.

For Voter data, VoteSure acts as a data processor, not the data controller. The institution that uploads a voter register is responsible for having the appropriate authority, consent, or legal basis to submit that information — including where voters are minors, which is a foreseeable and intended use case for VoteSure given our support for school and university elections. VoteSure's responsibility is to process that data securely, solely to run the election as configured, and never for any purpose beyond that.

2. Data we collect

From every visitor: standard anonymous technical data, web requests, IP address, browser type and language, and request timestamps used to monitor traffic and diagnose issues.

From Account Holders: name, email address, and password (stored as a salted hash, never in plain text) to create and secure your account; institution details (name, type, branding assets, subdomain) you provide when setting up your organization.

From Voter registers submitted by an institution: voter name, one or more unique identifiers (e.g., student ID, staff number), and a phone number and/or email address for delivery. Unique identifiers are stored using salted, one-way hashing for eligibility lookups — VoteSure's systems verify a voter's eligibility and whether they've already voted without needing to expose the underlying identifier in plain text outside of secure, access-controlled storage.

Ballot and vote data: the choices a voter submits are encrypted and stored in a tamper-evident record that is structurally separate from the voter's identity record — this separation is a core part of how VoteSure protects vote secrecy, and it means that even VoteSure cannot reconstruct which voter cast which ballot from the stored data alone.

Payment data: if an election requires payment, card and Mobile Money transactions are processed by Paystack, our payment processor. VoteSure does not receive or store full card numbers or Mobile Money account details — only transaction references, amounts, and status are retained on our side.

3. Your control over your data

Account Holders can view, update, and remove the personal data associated with their account at any time from account settings, or by contacting support@votesure.org to request account deletion. Institutions can request deletion of a voter register's raw personal data (names, contact details, identifiers) after an election concludes, subject to the retention note below — deleting this data does not remove the anonymized, hash-chained audit and vote records that must be retained for the integrity of that election's results.

Data retention: Voter contact details and identifiers are retained for the duration of an election plus a reasonable period afterward for dispute resolution (recommend: 12 months, to be confirmed with counsel against any applicable record-keeping requirements for institutional elections), after which an institution may request their deletion. Anonymized ballot records and the audit trail (which contain no directly identifying information once the identity/vote separation is applied) may be retained longer to preserve the historical integrity of an election's results.

4. How we use data

We use personal information solely to provide the Services or to communicate with you about them. If an institution chooses to publish an election's results or ballot publicly (via the optional public results page), we recommend redacting anything beyond what's necessary for a fair public record — VoteSure cannot protect data an institution chooses to make public, and is not responsible for privacy obligations that choice may create for the institution under applicable law.

We employ industry-standard security measures — encryption in transit and at rest, salted hashing of voter identifiers, and access controls — to protect against unauthorized access to the data we store.

We do not share personal information without consent, except where: it's necessary to fulfill your own request; we believe it's required to enforce our Terms of Service or comply with the law; it's needed to detect or address fraud, security, or technical issues; or it's necessary to protect VoteSure's property, legal rights, or the rights of others.

5. Where we operate and applicable law

VoteSure is operated by Afrotech Laboratories Ltd from Ghana, and we aim to comply with the Data Protection Act, 2012 (Act 843) of Ghana. If your institution is based outside Ghana, you are responsible for ensuring your own use of the Services complies with data protection laws applicable to you and your voters (for example, GDPR in the European Union, POPIA in South Africa, or other locally applicable rules) — VoteSure will work with institutions in good faith on data handling requirements specific to their jurisdiction, but the institution remains responsible for its own regulatory compliance as the party with the underlying relationship to its voters.

6. Communications

VoteSure may contact Account Holders by email regarding their account, an election in progress, billing, or service updates. We may also send occasional product updates or announcements; you can opt out of non-essential communications via the link in any such email or from your account preferences. Transactional communications necessary to operate an election you've created (e.g., payment confirmations, election status updates) are not part of this opt-out, since they're part of delivering the Service you've requested.

Voters receive communications (SMS or email) only as configured by the institution running their election — invitations, confirmations, and reminders directly related to that election. VoteSure does not use voter contact information collected for one election to send unrelated communications.

7. Sharing of data with service providers

We don't sell personal information, and we don't share it with third parties beyond what's needed to operate the Services. We currently use third-party providers for specific functions, listed here so you know exactly who touches your data and why:

  1. Paystack — payment processing (card and Mobile Money transactions)
  2. SMS delivery provider (e.g., Arkesel or Hubtel) — delivering voting links and reminders by SMS
  3. Email delivery provider — delivering voting links, confirmations, and account emails
  4. Hosting/infrastructure provider — where the Services and databases run

We may also use aggregated, anonymized data (for example, patterns across elections with no identifying information) to improve the Services. We do not publicly share anonymized ballot data without an institution's consent, unlike some platforms in this space — given VoteSure's emphasis on election integrity and confidentiality, we treat even anonymized election data as belonging to the institution that ran it.

Our providers ("Agents") may only use the data we share with them to perform the specific function we've engaged them for, not for their own independent purposes, and you consent to this sharing by using the Services.

8. Business transfers

If VoteSure or substantially all of its assets are acquired, merge with another company, or transfer ownership, user information may be transferred as part of that transaction. Any such successor would continue to be bound by this Privacy Policy with respect to previously collected information, or would provide notice of any material change to how that information is handled.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced on the Website or by email to Account Holders before or at the time they take effect. Continuing to use the Services after a change is posted means you accept the updated policy.

10. Contact

Questions or concerns about this policy, or requests regarding your data, can be sent to:

Email: support@votesure.org Mailing Address: 405 Manganesse St., Target, Ta, NT-0012-2334


Effective Date of this Privacy Policy: [09/09/2026]