Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you create an account or use Zoda, we collect information you directly provide, including:

• Your name, business name, and email address
• Your business location (state and LGA in Nigeria)
• Your business logo and theme preferences
• Customer records you create (names, phone numbers, emails)
• Order data (garment details, prices, pickup notes)
• Expense records you log within the Platform

1.2 Automatically Collected Information

When you access the Platform, we automatically collect limited technical data necessary for the platform to function:

• Authentication session tokens (managed via Supabase, our database infrastructure provider)
• Browser type and operating system (for compatibility and debugging)
• IP address (logged by our infrastructure for security purposes)

We do not collect marketing data, advertising identifiers, or behavioral tracking data. Zoda is a business operations platform, not an advertising platform.

2. How We Use Your Information

We use the information we collect to provide and improve the Zoda Platform, including to:

• Create and manage your secure, isolated business workspace
• Send automated WhatsApp notifications to your customers on your behalf (using the credentials you configure)
• Generate digital receipts and invoices for your business records
• Provide analytics and reports on your orders, revenue, and expenses
• Communicate with you about your account, such as sending activation codes or password resets
• Troubleshoot technical issues and improve platform reliability
• Comply with applicable laws and legal obligations

3. How We Share Your Information

We do not sell, trade, or rent your personal information or your customers' data to third parties. We only share data in the following limited circumstances:

3.1 Service Providers

We use the following infrastructure service providers to operate the Platform:

• Supabase — Database, authentication, and real-time data storage. Your workspace data is stored in an isolated Supabase project.
• Vercel — Cloud hosting and edge deployment for the Platform.
• WhatsApp Business API (via your configuration) — Customer notifications are dispatched using the API credentials you configure in your workspace settings. We do not store or share your WhatsApp API tokens beyond your encrypted workspace.

Each provider processes data only as necessary to perform the services we engage them for and is bound by appropriate confidentiality and data protection obligations.

3.2 Legal Obligations

We may disclose your information if required to do so by law, or in response to valid requests by public authorities (such as a court or government agency).

4. Data Retention

We retain your account and workspace data for as long as your account remains active. If you delete your business workspace from the Platform, your data (including customer records, orders, and expenses) is permanently and irreversibly deleted from our database. We do not retain archived copies of deleted workspaces.

Authentication logs and security records may be retained for up to 90 days after account deletion for fraud prevention and compliance purposes.

5. Security

We take the security of your data seriously. The Platform implements the following measures:

• Row-Level Security (RLS) policies on all database tables to ensure each business workspace can only access its own data
• Encrypted authentication sessions managed by Supabase Auth
• HTTPS encryption for all data in transit
• Hashed and salted password storage
• Email OTP verification required during account activation

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have the following rights with respect to your personal data:

• Access — Request a copy of the data we hold about you.
• Correction — Request that we correct inaccurate or incomplete data.
• Deletion — Request deletion of your personal data. You may also delete your workspace directly from within the Platform settings.
• Portability — Request a machine-readable export of your data.
• Objection — Object to processing of your data in certain circumstances.

To exercise any of these rights, please contact us using the information in the Contact section below.

7. Children's Privacy

The Zoda Platform is intended for use by business owners and operators aged 18 and above. We do not knowingly collect personal information from children under 18. If you believe a minor has registered on the Platform, please contact us immediately so we can remove their account.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of significant changes by updating the date at the top of this page. Your continued use of the Platform after such changes constitutes your acceptance of the revised policy.

9. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy, please contact us at: