Privacy Policy

Last updated: pending review

This document is being finalized and is pending legal review. It accurately describes Zoulna's current practices but may be updated before launch.

Introduction

This Privacy Policy explains how Zoulna ("Zoulna", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use the Zoulna platform — our mobile applications, websites, and related services (together, the "Service"). Zoulna is a food-delivery marketplace based in and serving Sudan, connecting customers, restaurants (merchants), and delivery riders.

Zoulna is governed by the laws of Sudan. Sudan does not currently have a comprehensive data-protection statute in force. In the absence of such a statute, Zoulna voluntarily commits to handling personal data in good faith and in line with widely recognized international data-protection best practices, including the principles of lawfulness, purpose limitation, data minimization, security, and respect for your rights as described in this Policy.

By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

Information We Collect

We collect only the information we need to operate the Service. Depending on whether you are a customer, a rider, or a merchant, this may include:

Account information (all users)

• Phone number (required — this is your unique primary identifier on Zoulna)
• Email address (optional)
• Name
• Password (stored only as a secure cryptographic hash; we never store your password in plain text)
• Your role (customer, rider, or merchant)
• Profile picture / avatar (optional)

Customer information

• Delivery addresses, including the street address and GPS coordinates (latitude and longitude) of the location
• Order history
• Favorite restaurants and items
• Reviews and ratings you submit

Rider information

• Identity-verification (KYC) documents: a photo of the front of your ID card, a photo of the back of your ID card, a selfie, and a photo of your vehicle
• Live GPS location (current latitude and longitude) while you are online and available to take deliveries
• Vehicle type and license-plate number
• Cash-settlement and earnings records

Merchant information

• Business and restaurant details
• Menu data
• Business-verification documents

Order information (for everyone involved in an order)

• Items ordered and amounts
• Delivery address
• Payment method. Zoulna currently supports cash and wallet payments. Card and mobile-money payments are planned but not yet active.
• Order status history

Technical information

• Device push-notification tokens (via Firebase Cloud Messaging) so we can send you notifications
• IP address and browser/device user-agent, captured in our security and audit logs
• App usage and error/diagnostic data

Marketing-website leads

If you contact us through our marketing website rather than as a registered user, we collect only what you provide on the relevant form:

• Restaurant-partner application: restaurant name, contact person, phone number, city, and email
• Rider application: full name, phone number, city, vehicle type, and (optionally) email
• Contact-form message: name, email, and your message
• Customer waitlist: phone number, city, and (optionally) email

Phone verification

When you sign up, we send a one-time verification code (OTP) to your phone number via WhatsApp (operated by Meta) to confirm that the number belongs to you.

How We Use Your Information

We use your information to:

• Operate the marketplace — place, dispatch, and deliver orders between customers, merchants, and riders
• Verify identity — confirm your phone number through the WhatsApp OTP, and verify riders and merchants through KYC documents
• Process payments — handle cash and wallet settlements and keep accurate earnings records
• Communicate with you — send order updates, account notifications, and service messages
• Provide support — respond to your questions and resolve issues
• Keep the Service secure — prevent fraud and abuse, enforce our terms, and maintain security and audit logs
• Improve the Service — understand how the Service is used and diagnose and fix errors

Data Retention

We keep personal data only for as long as we need it to provide the Service and to meet our legal and operational obligations. After that, we delete it or anonymize it.

In particular:

• Security and audit logs (including IP address and user-agent) are retained for approximately 365 days by default.
• Notifications are pruned automatically on a regular schedule.
• Accounts support soft-deletion: when an account is deleted, it is marked as deleted and removed from active use, and is then deleted or anonymized in line with our retention practices and any legal requirements.

Security

We take reasonable technical and organizational measures to protect your information, including:

• Passwords are stored only as secure cryptographic hashes (bcrypt) — never in plain text
• Sessions are managed using signed access tokens (JWT)
• Rate limiting to defend against abuse and brute-force attempts
• Role-based access controls limiting who can access what data
• KYC and verification documents are kept in private storage and are accessible only through signed, time-limited URLs

No method of transmission or storage is completely secure, but we work continuously to protect your information and to respond promptly to any incident.

Your Rights

You can ask us to:

• Access the personal data we hold about you
• Correct data that is inaccurate or out of date
• Delete your data
• Withdraw consent you have previously given
• Object or complain about how we handle your data

To exercise any of these rights, contact us through our WhatsApp support line (see "Contact Us" below). We may need to verify your identity before acting on a request.

Children

The Service is not directed to children under the age of 18, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the "Last updated" date at the top of this Policy and, where appropriate, notify you through the Service. Your continued use of the Service after an update means you accept the revised Policy.

Contact Us

If you have any questions about this Policy or wish to exercise your rights, you can reach us through our WhatsApp support line:

• WhatsApp: https://wa.me/393756199164