Privacy Policy

1. Data we collect

• Account data: email address or Google sign-in identifier, username, display name, avatar, date of birth confirmation.
• Content you create: videos, photos, text posts, comments, stickers, messages, live-stream chat.
• Usage data: watch time, completion, replays, likes, follows and interest choices, used to rank your feed.
• Approximate location: country and region, either from a permission you grant or derived coarsely from your connection.
• Payment data: coin purchase references, amounts, currency and status received from Paystack. We never receive or store card numbers.
• Identity verification data, from creators only: legal name, date of birth, nationality, residential address, government-issued ID or passport image, a selfie for liveness matching, tax identifier where required, and payout account details.
• Support data: tickets, appeals, evidence you attach, and our replies.

2. Why we use it

• To operate the app, show your feed and deliver the features you use.
• To process payments, credit coins, calculate creator earnings and pay withdrawals.
• To meet legal obligations: identity verification, sanctions screening, fraud and money-laundering prevention, tax and accounting records.
• To keep the platform safe: moderation, abuse detection, appeal review.
• To communicate with you about your account, tickets and payments.

3. Sharing

We share data only with providers that help us run the service: Paystack (payments and payouts), our managed cloud hosting and database provider, our identity-verification provider, and our email delivery provider. We share with law enforcement or regulators where legally required. We do not sell personal data and we do not share it for third-party advertising.

4. Retention

Content and account data are kept while your account exists. Identity verification records and payment records are retained for seven years after the last transaction, as required by Kenyan anti-money-laundering, tax and accounting rules, even if you delete your account. Usage signals used for ranking are kept for 24 months.

5. Security

• Row-level security on every user table: you can only read your own wallet, ledger, messages, tickets and verification records.
• Verification documents and media are held in private storage, served only through short-lived signed links, and are accessible only to trained review staff.
• All traffic is served over HTTPS. Payment secrets are held server-side, never in the browser, and never logged.

6. Your rights

You may access, correct, download or delete your personal data, object to processing, and withdraw location permission at any time. Write to support@zuma.social and we respond within 30 days. We handle personal data in line with the Kenya Data Protection Act 2019 and, for users in Europe, the GDPR. You may complain to the Office of the Data Protection Commissioner (Kenya) or your local authority.