We do not sell your personal information, and we never use your group's financial data for advertising. This page explains everything else.
Scope
This policy covers the GCOFEE platform at gcofee.com and the accounts, groups, ledgers and notifications within it. It forms part of our Terms & Conditions.
Who is responsible for your data
We operate the Platform and are responsible for the data held in it. Your group also makes decisions about your data — its officers decide who is admitted, what contributions are recorded and which claims are approved. In practice you have two points of contact: your group's officers for anything about your membership, and us for anything about the Platform itself.
Information we collect
Information you give us
- Your name, email address, phone number and country when you register.
- Your password, stored only as a salted cryptographic hash — we never see or store it in readable form.
- Multi-factor authentication details, where the secret is encrypted at rest.
- Anything you submit inside a group: loan applications, welfare claims, proposals, votes and supporting notes or documents.
Information generated by your use of the Platform
- Financial records: contributions, loan balances, repayments, welfare payouts, dividend allocations and the ledger entries behind them.
- Security and audit records: sign-ins, verification attempts, sensitive actions, the acting account, a timestamp and the originating IP address.
- Technical data your browser sends, such as device and browser type, and session cookies needed to keep you signed in.
Information from others
- From your group's officers, when they record a contribution or decision about you.
- From Google, if you choose to sign in with a Google account — we receive your name, email address and a stable account identifier, and nothing else.
- From payment providers, the status and reference of a transaction. We do not receive or store your full card details.
Why we use your information
- To create and secure your account, and to verify that it is really you.
- To run the features your group has enabled — contributions, loans, welfare, voting, dividends and reporting.
- To maintain an accurate, auditable financial record that members can trust.
- To send transactional notifications: verification codes, contribution reminders, loan and claim decisions, governance notices.
- To detect and investigate fraud, abuse and security incidents.
- To provide support when you contact us.
- To meet legal, accounting and regulatory obligations.
The basis on which we rely
We process your data because it is necessary to provide a service you asked for (your account and your group's operation), because we have a legitimate interest in keeping the Platform secure and working, because the law requires it (record-keeping, anti-money-laundering), and — for anything optional — because you consented, in which case you can withdraw that consent at any time.
Who can see your information
- Members of your group. Group financial activity is visible to the group. Transparency is a deliberate feature: members can see that the ledger adds up.
- Your group's officers. They see the membership and financial detail their elected role requires.
- Other groups. Never. Groups are isolated from one another.
- Service providers. Hosting, email delivery and payment processing partners, acting on our instructions and bound to protect the data.
- Authorities. Where we are legally required to disclose, or to protect rights and safety. We disclose the minimum necessary.
- A successor. If the Platform is transferred to another operator, under the same commitments given here.
Audit records
Security-relevant actions are written to an append-only audit trail. Those entries are not edited or deleted, because their value depends on being tamper-evident. This is why some information about you is retained even after you leave a group — it protects the remaining members and any later review of the group's finances.
Where your data is held
Your data may be stored and processed in a country other than your own, including where our hosting or email providers operate. Where that happens we rely on safeguards appropriate to the transfer, such as contractual protections with those providers.
How long we keep it
- Account details: while your account is open, then deleted or anonymised within a reasonable period after closure.
- Financial and ledger records: retained for as long as required for accounting and legal purposes, because they belong to the group's financial history as well as to you.
- Audit and security records: retained for a defined security period.
- Verification codes and step-up challenges: minutes only, then they expire.
How we protect it
- Passwords hashed; multi-factor authentication secrets encrypted at rest.
- Multi-factor authentication and step-up confirmation on high-risk actions.
- Role-based access control, so an account only reaches what its role permits.
- HTTPS in production, secure and HTTP-only session cookies, and protection against cross-site request forgery and clickjacking.
- A full audit trail on sensitive actions, so misuse can be traced.
No system is perfectly secure. If a breach affects you, we will notify you and the relevant authority as the law requires.
Your rights
Subject to the law that applies to you, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct data that is wrong or incomplete;
- delete data we no longer have a lawful reason to keep;
- restrict or object to a particular use;
- export your data in a portable format;
- withdraw a consent you previously gave.
Some requests are limited in practice: we cannot erase a ledger entry that records money belonging to other members, and we cannot remove audit records that exist to protect them. Where we cannot act on a request, we will explain why. Write to info@gcofee.com and we will respond within the period the law allows. You may also complain to your national data protection authority.
Children
The Platform is not for people under 18. If we learn that we hold a child's data, we will delete it.
Changes to this policy
We may update this policy. We will change the "Last updated" date at the top and, for material changes, notify you through the Platform or by email.
Contact
Privacy questions and data requests:
info@gcofee.com
General support:
support@gcofee.com
Still have a question?
Tell us what you need and we will come back to you.