1. What data we collect
When you sign up: email, hashed password, name. When you ship: delivery address, order number. When you're a traveler: government ID, selfie, banking details for payouts. We also store session cookies and usage data (which pages, from where). For fraud prevention: we store a hash of your IP address, browser characteristics, device timezone, and a device fingerprint at the time of account creation. This data is used exclusively to detect suspicious activity and is never shared for commercial purposes. If you use the screenshot feature in the quoter: images are sent to our AI provider to extract products automatically (see section 5). Chat messages between buyers and travelers are stored securely.
2. What we use it for
To operate the service (process shipments, payments, support), prevent fraud, improve the product, and meet legal obligations (banking KYC). We don't sell your data to anyone.
3. Who we share with
Only with providers we need to operate: Supabase (database), dLocal (payments in Argentina and Brazil), Stripe Identity (traveler identity verification), Vercel (hosting), Cloudflare (DNS and CDN), Resend (emails), Google (screenshot processing with Gemini). Each under data processing agreements.
4. Your rights
You can access, modify, or delete your data at any time from your profile, or by writing to privacy@heyzawo.com. If you delete your account, we wipe everything in 30 days (except records we are legally required to keep).
5. AI and screenshot processing
When you upload a screenshot in the quoter, that image is sent to Google (Gemini) to automatically read the visible products. The image is stored privately and securely in a restricted-access bucket, linked to your quote, so the ZAWO team can process your order. We do not use your screenshots to train AI models. By using this feature, you accept that the image is sent to Google (Gemini) for this specific purpose.
6. Biometric data (travelers)
For traveler identity verification, we collect a government-issued ID and a selfie photograph. These are classified as biometric and sensitive personal data. They are processed exclusively by Stripe Identity for identity verification. ZAWO does not store copies of original documents. We only store the verification outcome (verified/not verified) and the timestamp. Stripe's handling of biometric data is governed by Stripe's privacy policy.
7. Security
We hash passwords with bcrypt, encrypt data in transit with TLS 1.3, and encrypt at rest with AES-256. We never ask for your password or 2FA codes via email or WhatsApp.
8. Cookies
We use essential cookies (session, language) and privacy-friendly analytics.
9. Retention
We keep transactional data (payments, shipments) for 7 years per accounting law. Account data is deleted 30 days after closure. Security logs purge at 90 days.
10. Age
ZAWO is for users 18+. We don't knowingly collect minors' data. If we discover a minor's account, we delete it.
11. Your rights under LGPD (Brazil)
If you are a resident of Brazil, you have additional rights under the Lei Geral de Proteção de Dados (Law 13.709/2018): confirmation of data processing, access, correction, anonymization or deletion, data portability, information about third parties we share with, the right to withdraw consent at any time, and the right to file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados). To exercise these rights: privacy@heyzawo.com.
12. Habeas Data (Argentina)
If you are a resident of Argentina, you have the right to access, rectify, update, and delete your personal data (Ley 25.326). To exercise these rights, write to privacy@heyzawo.com with subject 'Personal data'. ZAWO responds within 5 business days.
13. Changes
If we update this policy, we email you with 30 days advance notice.
14. Contact
For privacy questions: privacy@heyzawo.com. To exercise data rights: privacy@heyzawo.com with subject 'Personal data'.
