Privacy Policy

Last updated: 29 October 2026

Who we are

Zumi is a property platform for Zambia. This policy explains what personal data we collect, why, and what rights you have under the Data Protection Act No. 3 of 2021.

What we collect

• Account: name, email, phone number, account type (owner or agent), the date you accepted the Terms and this Privacy Policy, and — only if you tick the box — the date you agreed to receive Zumi news and offers by WhatsApp and/or email (you can turn each off any time in Settings).
• If you sign in with Google or Facebook: they share your name, email address and profile picture with us. We use only the name and email to create your account. We never see your Google or Facebook password, and we do not get your contacts, friends, posts, files or anything else from those accounts.
• Profile: photo, agency name, "about you" and business WhatsApp number (agents), ZIEA licence number (agents), and how people may contact you (phone or chat only).
• Listings: photos, description, price, the pin on the map, the address and "what's nearby" (if you add them), contact number you add.
• Messages you send in Zumi chats and to support.
• Phone-number views: when you open a phone or WhatsApp number, we record who opened whose number and when. This protects agents and owners from spam and lets us find bots.
• Confirmation codes: the phone number or email we sent a code to, when, and how many attempts were made (the code itself is stored only in protected, scrambled form).
• Safety records: reports about listings or reviews, blocked accounts and the reason, and a log of actions taken by Zumi moderators.
• Checks: whether your phone number is confirmed and, for agents, the ZIEA registration number and the result of our check. Zumi does not collect ID documents, selfies or ownership documents.
• View statistics for ads, promotions and listings: your IP address and a random device code, used only to count each person once a day. They are deleted after 2 days. Authors see only the numbers, never who viewed their listing.
• Usage statistics: anonymous counts only — how many visits per hour, day and month, how many people come back, whether Zumi is opened on the website, Android or iPhone and which app version, and how often search filters and neighbourhoods are used. To count each person once, we keep a scrambled code of your account or device for up to 35 days. No names are stored with these numbers.
• Error reports: when the app breaks, the text of the error (numbers and emails are removed), the platform and the app version.
• Help articles: whether an article was helpful and your optional comment.
• App feedback (only if you send it): your rating, what did not work, your comment, the platform and app version, and your account (or a scrambled device code for guests). Kept for up to 1 year.
• Technical data: device type, app version and error logs, to keep the app working.
• On your device only: your saved (favourite) listings, recently viewed listings and the random device code. You can remove them by clearing the app or browser data.

Why we use it

To run your account and show your listings; to let people contact you; to prevent scams and keep users safe; to show the "Number checked" and "Licensed agent" badges; to answer support requests; to improve the app. We do not sell your personal data.

Who can see what

• Public: your listings (without the phone number), your name and photo, and — for agents — the agent page with agency name, "about you", licence status and reviews.
• Phone numbers in listings and agents' WhatsApp numbers are not public. They are shown only to signed-in users who have confirmed their own phone, one at a time when they tap "Show number" or "WhatsApp", and only up to a daily limit. Each such view is recorded.
• Agents and owners can choose "Chat only" — then their number is not shown at all and people contact them through Zumi chat.
• Private: your email, your personal phone number and your confirmation codes.

Storage and security

• Where your data is stored: Zumi uses the cloud provider Supabase. Your account data, listings, photos and messages are stored on Supabase servers in the European Union (Ireland), which means outside Zambia.
• Other services we use: Google — to send emails from Zumi (codes and messages about your account); GitHub Pages — to deliver the Zumi website; a map provider — to show maps (it sees your IP address when map images load). They receive only what they need for that job.
• Your consent: when you create an account, you give your explicit consent to this transfer and storage of your data outside Zambia. Without it we cannot create an account, because Zumi has no servers in Zambia yet.
• How it is protected: data in the European Union is protected by the EU General Data Protection Regulation, which gives a level of protection at least equal to the Data Protection Act No. 3 of 2021 of Zambia. On top of that, data is encrypted when it travels between your device and our servers and when it is stored; access is limited by strict rules to what each person needs; phone numbers are hidden from other users; only the Zumi team can open the team panel and every moderator action is logged.
• If something goes wrong: if a data breach affects your data, we will inform the Data Protection Commissioner and you as required by law.
• If the rules for keeping data in Zambia change, or the Commissioner requires it, we will move or copy the data as required.

How long we keep it

We keep data only as long as we need it for the reason it was collected.

Account data of active users (including checked phone numbers and licence numbers) — in protected form for as long as the account is open, to keep Zumi safe. IP addresses and device codes for ad statistics — 2 days. Phone-number view records — up to 1 year. Accounts blocked for fraud, scams or abuse: the data needed to prevent the same person from coming back and to help the police or other authorities (name, email, phone number, the reason and the evidence) is kept for up to 2 years after the block, or longer only while a police investigation or court case needs it.

When you delete your account, your profile, listings, photos and chats are deleted within 30 days, except what the law requires us to keep or what is needed for a fraud case described above. Records of payments may be kept without your name where the law requires it.

Your rights

Under the Data Protection Act No. 3 of 2021 you can: see and correct your data in Settings; ask for a copy of your data or ask questions through Help & support; object to or ask us to limit some uses of your data; withdraw consent for news and offers (Settings); and delete your account at any time (Settings → Delete my account). Withdrawing consent to storage outside Zambia means closing the account. You can also complain to the Data Protection Commissioner of Zambia.

Children

Zumi is for people aged 18 and over. We do not knowingly collect data about children.

Contact

Questions about privacy: Profile → Help & support → "My account".