Privacy Policy

Two kinds of people use Zova. Providers are the businesses who create a page and take bookings or orders. Customers are the people who book or buy from them. We collect different things from each, and this policy says which is which.

• Your name, your business name, your WhatsApp number, and an email if you give one
• Your business details: what you offer, your prices, your working hours, your address
• Photos and videos you upload
• Your bank account number and bank, so Paystack can pay you
• Basic information about the devices you sign in from, so you can see and end your own sessions

We never see or store your card details. We do not store your bank password or BVN. The only bank information we hold is the account number you enter and the account name your bank returns.

• Your name and WhatsApp number
• Your address, only when you ask for delivery or for someone to come to you
• What you booked or bought, and when
• Any review, photo or message you choose to leave

You do not need an account to book or buy on Zova. We do not ask you to create one.

When anyone loads a Zova page we record the page or item viewed, the time, and basic technical information such as browser type and IP address. We use it to show providers how many people looked at their page and which items were opened, and to spot abuse.

The counts a provider sees are aggregated. A provider cannot see who visited their page, only how many did and what they looked at.

Zova uses one cookie that matters: the sign-in cookie that keeps a provider logged in. It is set only after you sign in, your browser will not hand it to JavaScript, and it is replaced every time it is used. Signing out deletes it.

We do not use advertising cookies and we do not run third-party trackers on storefronts.

A provider can choose to verify their business by uploading their CAC certificate. We use it to confirm the registered name and RC number against the public CAC register, and for nothing else.

Once a decision is made we delete the document. What we keep is the registered name and the RC number, both of which are already public record. We ask only for business registration documents and never for personal identification such as a NIN slip, a passport or a driver's licence.

Verification is optional. A provider who is not registered can still use every part of Zova.

Payments are processed by Paystack. Your card details go to them and never pass through Zova. We receive only a reference, an amount, and whether the payment succeeded.

Paystack requires an email address on every transaction. Customers do not have accounts on Zova and we do not ask for one, so we generate a placeholder from the phone number you already gave. Nothing is ever sent to it.

Money from a sale goes directly to the provider's own bank account through Paystack's split payment system. Zova never holds your money, which means there is nothing sitting in an account of ours waiting to be released.

If a provider subscribes to Zova Pro, Paystack stores their card so the subscription can renew. We never see or store those card details. What we keep is the subscription reference Paystack gives us, so we can tell whether a plan is active and cancel it when asked.

Zova sends booking confirmations, order updates, payment receipts and review requests over WhatsApp. That is why we ask for a WhatsApp number rather than any phone number.

To do this we share your number and the message content with Meta, who operate WhatsApp. Their handling of it is covered by their own privacy policy. If you would rather not receive these, you can reply to any message asking us to stop, though you will then not receive your ticket or updates about your order.

Meta also tells us what happened to each message: whether it was delivered, whether it was read, and whether it failed. We keep that against the message so we can tell a provider their number has stopped working rather than letting bookings arrive somewhere nobody is reading. We do not use read receipts for anything else.

When you book or buy from a provider, they see your name, your WhatsApp number, what you ordered, and your address if delivery was involved. They need this to do the work and deliver it.

Providers do not see your payment details, and they do not see anything about your dealings with other providers on Zova.

Reviews are public and appear on the provider's page. If you post one anonymously, your name is hidden from that page, but we still keep it on our records so we can look into a review that turns out to be abusive.

Photos you attach to a review are public. A provider can choose to show your photo in their gallery as an example of their work. They cannot delete it.

We use a small number of services to run Zova:

• Paystack, for payments, payouts and Pro subscriptions
• Meta, for WhatsApp messages and their delivery status
• Cloudinary, for photos and videos
• Railway, for hosting and databases
• Vercel, for hosting the website and storefronts
• Groq, which reads the description you type during setup to turn it into a price list. Providers only, and only that text
• Resend, for account emails such as password resets
• Sentry, which records errors so we can fix them. We strip out request contents, phone numbers and tokens before they reach it

We do not sell your information. We do not share it for advertising. We will hand it over if a Nigerian court or a law enforcement agency lawfully requires us to.

Some of the services above operate outside Nigeria, so information reaches servers in other countries. Meta, Groq, Sentry, Vercel, Railway and Cloudinary all do. We use them under their standard data protection terms, and we only send what each one needs: Groq receives the text a provider typed and nothing else, Sentry receives error traces with personal details stripped out.

• Bookings, orders and payment records: kept, because they are financial records and both sides may need them
• Messages we sent you: 30 days once delivered, 90 days if they failed and we are still investigating
• Sign-in sessions: cleared once expired
• Usage events we use to build your dashboard numbers: 180 days
• Reviews and photos: until removed
• Business verification documents: deleted as soon as a decision is made. The registered name and RC number are kept

When a provider closes their account, their page goes offline immediately. Their past bookings and payouts stay on record, because the customers involved have a right to theirs.

Under the Nigeria Data Protection Act 2023 you can ask us what we hold about you, ask us to correct it, ask us to delete it, ask for a copy of it, and object to how we use it. Write to hello@usezova.com and we will respond within 30 days. If you are not satisfied with our answer you can complain to the Nigeria Data Protection Commission.

Some things we cannot delete. A completed transaction is a record both you and the other side may need, and financial records have to be kept. We will tell you plainly if that applies to your request.

Passwords are hashed and never stored in a form we can read. Sign-in tokens are held in cookies your browser will not hand to JavaScript, and they rotate every time they are used, so a stolen one stops working. Messages arriving from our payment and messaging providers are checked against a signature before we act on them.

No system is perfectly safe. If something happens that affects your information, we will tell you rather than hope you do not notice, and we will report it to the Commission where the law requires.

Zova is not for anyone under 18. We do not knowingly collect information from children, and we will delete it if we find we have.

If we change this in a way that matters, we will say so on this page and message providers about it. The date at the top always shows the current version.

For anything about your information, including a request under the Nigeria Data Protection Act, write to us and mark it for the attention of our data protection contact.

NEXXI TECHNOLOGIES LIMITED (RC 9766120)
Royal D 2, Orita Obele Estate, Akure, Ondo State, Nigeria
hello@usezova.com