Privacy Policy

1. What data we collect

We collect only what we need to run your account and the services you use.

• Name — the display name you enter, or the name on your Google or Facebook profile when you sign in with them.
• Email address — the one you register with, or the one on your Google or Facebook account.
• Google profile information — when you choose "Continue with Google" we ask for the basic scopes openid, email and profile. We receive your Google account ID, name, email address, whether Google has verified it, and your profile picture URL. We do not request access to Gmail, contacts, Drive, calendar or any other Google data.
• Facebook profile information — when you choose "Continue with Facebook" we ask for the permissions public_profile and email. We receive your app-scoped Facebook user ID, name, email address and profile picture URL. We do not receive your friends list, posts, photos or messages, and we never post on your behalf.
• Sign-in tokens (OAuth) — Google and Facebook give us a short-lived access token during sign-in. We use it once, on our server, to read the profile information above and then discard it. We do not store these tokens and we do not request refresh or long-lived user tokens.
• WhatsApp sign-in — your phone number. We send a 6-digit code to it through the WhatsApp Business Platform; only a hash of the code is kept and it expires after 10 minutes. We cannot see your WhatsApp contacts or chats.
• Connected Facebook Pages and WhatsApp Business numbers (sellers) — when a shop connects a channel for social selling we store the Page ID or WhatsApp phone number ID, the name the seller gives it, and the access token the seller provides so that we can receive comments and messages for that Page or number and reply to them.
• Comments and messages to a connected shop (customers) — when you comment on a connected shop's Facebook post or live video, or message it on Messenger or WhatsApp, we receive from Meta the text of that comment or message, its ID and the post it belongs to, your name as shown on the platform, and your Page-scoped user ID (Facebook and Messenger) or phone number (WhatsApp). We receive this only for Pages and numbers a shop has connected — never from your personal timeline or private chats with other people.
• Phone number — also when you give one for delivery, loyalty points or contact.
• Shop and business details — if you open a shop: shop name, address, tax ID and, for registered businesses, the verification documents you upload.
• Orders — what you buy or sell, delivery address, courier and tracking number, and the payment reference you report.
• Technical data — a session cookie that keeps you signed in, cookies that remember your language and theme, and your IP address for security checks.

2. Why we collect it

• User authentication — to confirm it is you when you sign in, and to protect your account with two-step verification.
• Account creation — to create your zaokaiy account and link the sign-in methods you choose to it.
• Personalised services — to show your orders, shops, rewards and settings, and to address you by name in the language you chose.
• Orders by comment and chat — to recognise an order in a comment or message (for example "CF A01 x2"), reserve the item for you, reply with a checkout link, and send you order updates (paid, shipped, delivered) in the same chat.
• Fulfilling orders — to deliver what you buy.
• Security — to prevent abuse, fraud and automated sign-ups.
• Legal duties — to issue receipts and tax invoices and keep the records the law requires.

3. How we store it

• Database — your data is kept in a PostgreSQL database on servers we rent from our hosting provider. Only authorised staff can reach it.
• Encryption — all traffic uses HTTPS. Passwords are stored only as Argon2 hashes. ID numbers, bank account numbers, verification documents and two-step verification secrets are encrypted with AES-256-GCM. One-time codes and invite links are stored only as hashes.
• Page and WhatsApp Business tokens — kept on our server for as long as the channel is connected, never shown again in the app (not even to the seller), and deleted when the seller removes the channel or closes the shop.
• Retention period — we keep account data for as long as your account is open. When you ask us to delete your account we delete or anonymise your personal data within 30 days. Comments and messages that led to an order are kept with that order while the shop is open, and are deleted on request. Order, receipt and tax records are kept for the period the law requires and then deleted.
• Short-lived data — sign-in requests expire within 10 minutes, one-time codes within 10 minutes, and sign-ups that are never confirmed are deleted after 7 days.

4. Who we share it with

We do not sell your personal data. We share it only with the parties below, and only as much as each one needs.

• Google — when you sign in with Google, Google learns that you signed in to zaokaiy. Our pages also load fonts from Google Fonts.
• Meta (Facebook, Messenger, WhatsApp) — when you sign in with Facebook, Meta learns that you signed in to zaokaiy. When we send a sign-in code, an automatic reply or an order update, we send the message text and your Page-scoped ID or phone number to Meta so it can deliver it.
• The shop you contacted — the shop whose Page or number you commented on or messaged sees your name, your comment or message and your order. Other shops do not.
• Cloudflare — protects our site from attacks and runs the human check on sign-in forms; it processes your IP address.
• Cloud and hosting providers — the company that hosts our servers and file storage holds the data on our behalf and may not use it for its own purposes.
• Shops and couriers — when you place an order, the shop and the courier you choose receive your name, phone number and delivery address.
• AI provider — when a seller asks the AI assistant to write product content, the product text is sent to our AI provider. Data received from Google or Meta is never sent to it.
• Analytics tools — we do not use third-party analytics or advertising trackers.
• Authorities — when the law requires it, for example tax filings a shop has asked us to make on its behalf.

5. Your rights

• See and correct your data — on the Account page.
• Disconnect Google or Facebook — remove a sign-in method on the Account page at any time. You can also revoke zaokaiy's access in your Google Account (Security, Third-party apps and services) or in Facebook (Settings and privacy, Settings, Apps and websites).
• Disconnect a Page or WhatsApp number (sellers) — remove the channel in the dashboard under Social selling, Channels. Its access token is deleted immediately and we stop receiving its comments and messages.
• Ordered by comment or chat without an account — you can still ask us to delete your name, comments, messages and delivery details. Tell us the shop and the phone number or Facebook name you used.
• Delete your account — email [email protected] from the address on your account. We delete the account and its personal data within 30 days and confirm when it is done.
• Request data deletion — you can also ask us to delete specific data, such as your profile picture or phone number, without closing the account.
• Contact support — for any privacy question or complaint, write to [email protected]. We reply within 7 days.

6. Google user data

• We use Google user data only to provide the functionality you request: signing you in, creating your account and showing your name and picture in it.
• We do not sell Google user data to third parties.
• We do not use Google user data for advertising, and we do not use it to build, train or improve AI or machine-learning models.
• We do not transfer Google user data to others, except when needed to provide the sign-in feature, to comply with the law, or to protect against fraud and abuse.
• Our staff do not read your Google user data unless you ask us to, it is needed for security, or the law requires it.

zaokaiy's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. developers.google.com/terms/api-services-user-data-policy

7. Meta platform data (Facebook, Messenger, WhatsApp)

• We use data received from Meta only for the features you or the shop asked for: Facebook sign-in, WhatsApp sign-in codes, turning comments and messages into orders, automatic replies and order updates.
• We do not sell, license or rent Meta platform data to anyone.
• We do not use Meta platform data for advertising, to build profiles of people, or to train AI models.
• For a connected Facebook Page we read only comments on that Page's posts and live videos and messages sent to that Page, and we reply only to the person who wrote. We do not publish posts, change Page settings or read Page insights.
• On WhatsApp we send only sign-in codes you request, replies to messages you send to a shop, and updates about an order you placed. We do not send marketing messages.
• We share Meta platform data only with the shop concerned and with the service providers in section 4 that host it for us, or when the law requires it.
• You can ask for data we received from Meta to be deleted at any time — see "How to delete your data".

We handle this data in line with the Meta Platform Terms and Developer Policies. developers.facebook.com/terms

8. Changes to this policy

If we change this policy we will update the date at the top of this page. If the change affects how we use Google user data or Meta platform data, we will tell you and ask for your consent before using it in the new way.

9. Contact

Questions about this policy or your data: [email protected]