Privacy Policy for Zerozaya

A. Information You Provide Directly

• Account & Profile Data: Name, phone number, email address, profile avatar, and account credentials.
• Transaction & Order Data: Surprise bag orders, order history, transaction totals, payment identifiers, pickup verification codes, and dietary preferences.
• Communications: Feedback, support tickets, reviews, and messages sent to customer support.

B. Information Collected Automatically

• Location Data: Precise and approximate device location (GPS and network-based) when granted permission, used to show nearby surplus food bags, calculate travel distance, and enable distance-based search.
• Device & Usage Data: Device model, operating system, unique device identifiers, IP address, app performance metrics, crash logs, and interaction records.
• Local Storage & Cache: Session tokens and cached preferences stored securely on your device.

We process your data to:

• Provide, operate, and maintain Platform features.
• Connect you with partner stores/restaurants and facilitate surplus food pickups.
• Verify pickups and process transactions via authorized payment gateways.
• Send transactional notifications (order confirmation, ready-for-pickup alerts).
• Calculate real-time distances to partner restaurants.
• Prevent fraud, abuse, and security incidents.
• Comply with legal obligations and enforce terms of service.

We do not sell, rent, or trade your personal data. We share data only under these circumstances:

• Partner Merchants: Order items, customer first name/initial, and pickup confirmation codes needed to prepare and hand over orders.
• Payment Processors: Payment tokenization and processing handled by PCI-DSS compliant third-party gateways (e.g., Razorpay/Stripe). We do not store complete payment card credentials on our servers.
• Infrastructure & Cloud Providers: Backend hosting, database management, and authentication services (e.g., Supabase, cloud servers).
• Legal Requirements: When required by law, subpoena, or to protect the safety, rights, or property of users or the public.

• Foreground Location: Used when browsing nearby restaurants and calculating distance metrics.
• User Control: Location permissions can be enabled, disabled, or revoked at any time via your device operating system settings.
• If location permission is disabled, you can manually select or search an area.

We implement technical and organizational safeguards:

• Encryption in transit (TLS/HTTPS) and encryption at rest.
• Role-based access controls (Row Level Security on databases).
• Secure authentication tokens.

No electronic transmission over the internet or storage system is 100% secure. We encourage strong account hygiene.

• We retain personal information as long as your account remains active or as necessary to fulfill orders and legal/tax record-keeping requirements.
• Account Deletion: You may request account and associated data deletion directly from app settings (Profile → Settings / Delete Account) or by contacting us via email. Upon request, personal identifiers are permanently erased or anonymized, subject to statutory retention obligations.

The Platform is not directed to individuals under 13 (or under applicable local legal age). We do not knowingly collect personal information from children.

We may update this Privacy Policy periodically. Notice of material changes will be posted within the Platform or updated with a new "Last Updated" date.

For questions, data access requests, or privacy inquiries: