Privacy Policy

1. Information we collect

Depending on how you use ZamaZama, we may collect:

• Account and identity information: your name, email address and Google account identifier when you choose Google Sign-In.
• Contact information: your cellphone number and whether that number has been verified.
• Profile information: buyer profile photos, supplier business or trading-location photos, business name, categories and service radius.
• Location information: current GPS coordinates or a map point deliberately selected by the buyer to match a request with nearby suppliers and, for suppliers, the business or operating location used for service-area matching.
• Travel or search preference: the distance a buyer says they are willing to travel, or the search radius around a separately selected map area.
• Buyer request information: the category, request title, description, photos, voice notes, approximate area/town and the time the request was submitted.
• Marketplace activity: lead matches, lead unlocks and whether a supplier tapped a call or WhatsApp contact button. A button tap does not prove that a call connected or a WhatsApp message was sent.
• Technical and security information: session information, IP address, browser/device information and security or abuse-prevention records.
• Notification information: preferences relating to WhatsApp or installed-app lead alerts, browser push-subscription details, device/browser information and delivery records needed to provide or troubleshoot those notifications.
• Payment information: where airtime payments are offered, the selected credit package, billing cellphone number, payment status, provider references and transaction records. ZamaZama does not receive a user's Vodacom account password.

2. How we use information

We use personal information only where reasonably necessary to operate, secure and improve the ZamaZama marketplace. This includes:

• creating and maintaining buyer and supplier accounts;
• authenticating users, including through Google Sign-In;
• matching buyer requests to suppliers by category and geographic distance;
• allowing matched suppliers to respond to buyer requests;
• delivering requested account, verification and lead notifications;
• showing users their own request, lead and account activity;
• detecting fraud, spam, misuse, duplicate accounts and attempts to bypass marketplace controls;
• maintaining platform security, reliability and support; and
• complying with applicable legal obligations.

3. Location privacy

A buyer may use the device's current GPS position or deliberately choose another map area, for example when looking for accommodation, a product or a service elsewhere. ZamaZama is designed so that suppliers are ordinarily shown an approximate area or town and distance, rather than precise coordinates. A selected-area request is labelled so suppliers know the buyer may not currently be there. A supplier may match when its service radius reaches the request point or when it is inside the buyer's selected travel/search radius.

4. When information is shared

ZamaZama does not sell personal information. Information may be shared only as needed to provide the service, including:

• Matched marketplace participants: once a supplier is entitled to the buyer's contact details, the supplier may receive the buyer contact information needed to respond to that request.
• Google: when a user chooses Google Sign-In, Google processes the authentication request under Google's own privacy terms. ZamaZama receives only the identity information made available through that sign-in flow.
• Twilio and messaging providers: where WhatsApp, SMS or verification services are used, the information required to route those messages may be processed by the relevant provider.
• Browser push providers: if a supplier enables installed-app alerts, a generic notification request may be routed through the browser or operating-system push service, such as services operated by Apple, Google, Mozilla or Microsoft. Buyer names, numbers and request details are not placed in that push message.
• Vodacom and payment providers: where a user chooses to buy credits using airtime, the information required to confirm, process, reconcile or refund that payment may be processed by Vodacom and an approved payment partner.
• Hosting and technical service providers: limited information may be processed where necessary to host, secure, back up or maintain the platform.
• Legal requirements: information may be disclosed where required by law, court order, lawful regulatory process or to protect the rights, safety or security of ZamaZama or its users.

5. Google Sign-In

Google Sign-In is offered as a convenient account identity method. ZamaZama does not receive your Google password. The platform may receive your Google account identifier, name, email address and profile information made available by Google for authentication. We use this information to create, identify and secure your ZamaZama account and not for unrelated advertising purposes.

6. Cellphone numbers, WhatsApp and SMS

A cellphone number is required because buyers and suppliers need a practical way to communicate. Users are responsible for keeping their contact number accurate. Where enabled, ZamaZama may send account, verification, security or matching-lead messages through WhatsApp or SMS. Notification preferences can be changed where the platform provides that option. Transactional or security messages may still be sent where reasonably necessary to protect or recover an account.

6A. Installed-app notifications

Suppliers may choose to enable Web Push on each supported device. ZamaZama stores the browser-generated subscription endpoint and cryptographic delivery keys needed to address that device. Closed-app notifications are deliberately generic and direct the supplier back to the authenticated dashboard for lead details. A supplier can turn alerts off on the device, in browser or phone settings, or by logging out of ZamaZama on that device.

7. Photos, voice notes and request content

Photos, voice notes and request descriptions are used only for the marketplace purpose for which they were submitted, platform moderation, security and support. Users should not upload unnecessary personal, confidential, unlawful or third-party information.

8. Airtime-payment information

Airtime purchases are once-off transactions and require the bill-payer's explicit approval. Payment records are retained for reconciliation, fraud prevention, customer support, refunds and legal or accounting requirements. ZamaZama issues credits only after a payment has been confirmed through the approved provider process.

9. Data retention

We keep information for as long as reasonably necessary to operate the account, preserve marketplace history, resolve disputes, prevent fraud, meet legal or accounting requirements and protect the platform. Information that is no longer reasonably required will be deleted, anonymised or securely retained only where a lawful basis requires continued storage.

10. Security

We use reasonable technical and organisational safeguards designed to protect personal information, including access controls, secure sessions, rate limits, authentication controls and restricted handling of credentials. No internet service can guarantee absolute security, and users should protect their own passwords, devices and Google accounts.

11. Your choices and rights

Subject to applicable law, including South Africa's Protection of Personal Information Act (POPIA), you may request access to personal information held about you, ask for inaccurate information to be corrected, object to certain processing, or request deletion where there is no lawful reason for continued retention.

Users can also update available profile information directly inside ZamaZama. Changing a previously verified cellphone number may cause the replacement number to be shown as unverified until it is verified again.

12. Children

ZamaZama is intended for people who can lawfully enter into marketplace transactions or who use the service with the involvement and consent of a parent or legal guardian where required by law. The platform is not designed to knowingly collect children's personal information without appropriate authority.

13. International processing

Some service providers used by ZamaZama, including Google, Twilio or hosting infrastructure, may process information outside South Africa. Where this occurs, ZamaZama seeks to use reputable providers and appropriate safeguards consistent with applicable data-protection requirements.

14. Changes to this policy

We may update this policy as the platform, its features or legal requirements change. The effective date at the top of this page will be updated when material changes are published.

15. Privacy requests

Privacy, access, correction or deletion requests can be submitted through the official ZamaZama support/contact channel published on the platform. We may need to verify the requester's identity before providing, changing or deleting account information.