Privacy Policy

Three kinds of people use Zova. Providers are the businesses who create a page and take bookings or orders, including the owners of businesses with several branches. Staff are the people a provider gives a login to. Customers are the people who book or buy from them. We collect different things from each, and this policy says which is which.

• Your name, your business name, your WhatsApp number, and an email if you give one
• Your business details: what you offer, your prices, your working hours, your address, and the same for each branch
• Photos and videos you upload
• The bank account each shop is paid into
• When you agreed to our terms, and which version
• Basic information about the devices you sign in from, so you can see and end your own sessions

We never see or store your card details, your bank password or your BVN. To get paid, you verify your identity with our payment partner, Bachs: your name, date of birth, NIN and a photo of your ID are sent through Zova straight to Bachs for review. We don't keep your NIN or the photo. Your bank account goes to Bachs the same way; we keep only its last four digits, the bank, and the account name your bank returns.

A staff member's name, WhatsApp number, which shop or branch they work at, and what they did on the account, so the owner can see who handled an order. The owner can see this. The same phone number can belong to a staff member at one business and the owner of another; we keep the two apart.

• Your name and WhatsApp number
• Your address, only when you ask for delivery or for someone to come to you
• What you booked or bought, and when
• Any review, photo or message you choose to leave
• The bank account you give us when you are owed a refund, and the account name your bank returns for it

You do not need an account to book or buy on Zova. We do not ask you to create one.

When anyone loads a Zova page we record the page or item viewed, the time, and basic technical information such as browser type and IP address. We use it to show providers how many people looked at their page and which items were opened, and to spot abuse.

The counts a provider sees are aggregated. A provider cannot see who visited their page, only how many did and what they looked at.

Zova uses one cookie that matters: the sign-in cookie that keeps a provider or staff member logged in. It is set only after you sign in, your browser will not hand it to JavaScript, and it is replaced every time it is used. Signing out deletes it.

We do not use advertising cookies and we do not run third-party trackers on storefronts.

When a provider uploads a menu or price list (a photo, a PDF or a Word file) or types a description of what they sell, we send it to Groq so an automated model can read it and turn it into draft items. Photos are shrunk on the provider's phone before they are sent.

We do not keep the file. It is read, the drafts come back to the provider, and nothing is saved until they choose to save it. Please do not upload anything containing other people's personal details.

A provider can choose to verify their business by uploading their CAC certificate. We use it to confirm the registered name and RC number against the public CAC register, and for nothing else.

Once a decision is made we delete the document. What we keep is the registered name and the RC number, both of which are already public record. We ask only for business registration documents and never for personal identification such as a NIN slip, a passport or a driver's licence.

Verification is optional. A provider who is not registered can still use every part of Zova.

Customer payments are processed by Bachs, our payment partner. Bank details go to them and never pass through Zova. We receive only a reference, an amount, and whether the payment succeeded.

The payment processor requires an email address on every transaction. Customers do not have accounts on Zova and we do not ask for one, so we generate a placeholder from the phone number you already gave. Nothing is ever sent to it.

Money from a sale is split at the moment of payment and settled to the provider's own bank account. Zova never holds your money, which means there is nothing sitting in an account of ours waiting to be released.

Pro and branch subscriptions are paid through Paystack, which stores the provider's card so the subscription can renew. We never see or store those card details. What we keep is the subscription reference Paystack gives us, so we can tell whether a plan is active and cancel it when asked.

When a provider owes a customer a refund, the customer gets a private link to give the bank account they want paid. We check that account with our payment partner and keep the account number, the bank and the name the bank returned. We show those to the provider, because they are the one sending the money, and keep them with the refund record.

The link is sent only to the customer's own WhatsApp and is never printed on a ticket, because whoever holds it decides where the money goes. Once given, the details can only be changed by us.

Zova sends booking confirmations, order updates, payment receipts, refund steps and review requests over WhatsApp. That is why we ask for a WhatsApp number rather than any phone number.

To do this we share your number and the message content with Meta, who operate WhatsApp. Their handling of it is covered by their own privacy policy. If you would rather not receive these, you can reply to any message asking us to stop, though you will then not receive your ticket or updates about your order.

Meta also tells us what happened to each message: whether it was delivered, whether it was read, and whether it failed. We keep that against the message so we can tell a provider their number has stopped working rather than letting bookings arrive somewhere nobody is reading. We do not use read receipts for anything else.

When you book or buy from a provider, they and their staff see your name, your WhatsApp number, what you ordered, and your address if delivery was involved. They need this to do the work and deliver it. If you are owed a refund, they also see the bank account you gave for it.

Providers do not see your card details, and they do not see anything about your dealings with other providers on Zova.

Reviews are public and appear on the provider's page. If you post one anonymously, your name is hidden from that page, but we still keep it on our records so we can look into a review that turns out to be abusive.

Photos you attach to a review are public. A provider can choose to show your photo in their gallery as an example of their work. They cannot delete it.

Anyone can report a shop without signing in. We keep the reason, any details you write, and the ticket it came from if you reported from one. A phone number is optional and only our staff ever see it. The shop is never told who reported it.

To stop one person filing many reports against a competitor, we keep a scrambled fingerprint of the reporting IP address, made with a secret key so it can't be turned back into the address. We use it only to count reports, never to identify anyone.

We use a small number of services to run Zova:

• Bachs, for customer payments, identity and bank checks for providers, payouts to providers and refunds
• Paystack, for Pro and branch subscriptions, and payments to providers who have not yet moved to Bachs
• Meta, for WhatsApp messages and their delivery status
• Cloudinary, for photos and videos
• Railway, for hosting and databases
• Vercel, for hosting the website and storefronts
• Groq, which reads the menus, price lists and descriptions providers give us to turn them into draft items. Providers only, and only that content
• Resend, for account emails such as password resets and account notices
• Sentry, which records errors so we can fix them. We strip out request contents, phone numbers and tokens before they reach it

We do not sell your information. We do not share it for advertising. We will hand it over if a Nigerian court or a law enforcement agency lawfully requires us to, and we will report to the police on our own where a report shows a child is at risk.

Some of the services above operate outside Nigeria, so information reaches servers in other countries. Meta, Groq, Sentry, Vercel, Railway and Cloudinary all do. We use them under their standard data protection terms, and we only send what each one needs: Groq receives the menu or text a provider gave us and nothing else, Sentry receives error traces with personal details stripped out.

• Bookings, orders, refunds and payment records: kept, because they are financial records and both sides may need them
• Messages we sent you: 30 days once delivered, 90 days if they failed and we are still investigating
• Sign-in sessions: cleared once expired
• Usage events we use to build your dashboard numbers: 180 days
• Reviews and photos: until removed
• Uploaded menus and price lists: not kept once read
• Reports about a shop: kept with the shop's record, because they may matter to a later decision
• Business verification documents: deleted as soon as a decision is made. The registered name and RC number are kept

When a provider closes their account, their page and branches go offline immediately. Their past bookings and payouts stay on record, because the customers involved have a right to theirs.

Under the Nigeria Data Protection Act 2023 you can ask us what we hold about you, ask us to correct it, ask us to delete it, ask for a copy of it, and object to how we use it. Write to hello@usezova.com and we will respond within 30 days. If you are not satisfied with our answer you can complain to the Nigeria Data Protection Commission.

Some things we cannot delete. A completed transaction or refund is a record both you and the other side may need, and financial records have to be kept. We will tell you plainly if that applies to your request.

Passwords are hashed and never stored in a form we can read. Sign-in tokens are held in cookies your browser will not hand to JavaScript, and they rotate every time they are used, so a stolen one stops working. Messages arriving from our payment and messaging providers are checked against a signature before we act on them. Staff logins only reach the shop they belong to.

No system is perfectly safe. If something happens that affects your information, we will tell you rather than hope you do not notice, and we will report it to the Commission where the law requires.

Zova is not for anyone under 18. We do not knowingly collect information from children, and we will delete it if we find we have.

If we change this in a way that matters, we will say so on this page and message providers about it. The date at the top always shows the current version.

For anything about your information, including a request under the Nigeria Data Protection Act, write to us and mark it for the attention of our data protection contact.

NEXXI TECHNOLOGIES LIMITED (RC 9766120)
Orita Obele Estate, Akure, Ondo State, Nigeria
hello@usezova.com