What information we keep, what we use it for, and who we share it with. All in plain language.
Last updated: April 27, 2026
When you sign up: email, hashed password, name. When you ship: delivery address, order number. When you're a traveler: government ID, selfie, banking details for payouts. We also store session cookies and usage data (which pages, from where).
To operate the service (process shipments, payments, support), prevent fraud, improve the product, and meet legal obligations (banking KYC). We don't sell your data to anyone. Period.
Only providers we need to operate: Supabase (database), Stripe (payments and identity verification), Vercel (hosting), Cloudflare (DNS and CDN), Resend (emails), Twilio (WhatsApp), Anthropic (receipt processing). Each under data processing agreements.
You can access, modify or delete your data at any time from your profile, or by writing to privacy@heyzawo.com. If you delete your account, we wipe everything in 30 days (except records we are legally required to keep).
We hash passwords with bcrypt, encrypt data in transit with TLS 1.3, encrypt at rest with AES-256. We never ask for password or 2FA codes via email or WhatsApp. If you receive a suspicious message, don't reply and let us know.
We use essential cookies (session, language) and privacy-friendly analytics (PostHog self-hosted). We don't use third-party tracking like Facebook Pixel.
We keep transactional data (payments, shipments) for 7 years per accounting law. Account data is deleted 30 days after closure. Security logs purge at 90 days.
ZAWO is for users 18+. We don't knowingly collect minors' data. If we discover a minor's account, we delete it.
If we update this policy, we email you with 30 days advance notice.
For privacy questions: privacy@heyzawo.com. To exercise data rights: privacy@heyzawo.com with subject 'Personal data'.
