Privacy Policy

1. Summary

• We collect what is needed to run a local discovery service: your account details, the content you post, the location you choose, and how Zayalle is used.
• Your account e-mail and phone number are never shown publicly. Contact details are shown only where you choose, or shared with a specific person when you agree.
• Precise GPS location is used only with your browser’s permission. Marketplace posts and provider skills show an approximate area.
• We do not store IP addresses in our application database, and we do not sell personal information or use advertising cookies.
• You can view and download the data linked to your account, correct it, and ask us to delete your account.

2. Who is responsible

Zayalle is the service responsible for the personal information described here. Zayalle is an early-stage project; the legal entity, address and any data-protection contact will be published on this page once confirmed. Until then, privacy questions and requests can be sent through Account → Privacy or the contact page.

3. Information we collect

Account information

When you register: your display name, e-mail address and password (the password is handled by our authentication provider and is not visible to us), your account type (visitor or business owner) and your role. You may add an optional phone number, WhatsApp number or contact e-mail in Account → Contact Details. We also record which version of the Terms of Use you accepted and which version of this Privacy Policy you acknowledged, with the time — without your IP address.

Signing in with Google

If you choose “Continue with Google”, Google shares your Google account name, e-mail address, profile picture link and Google account ID with Zayalle through our authentication provider (Supabase Auth). We never receive your Google password. We use this information only to sign you in, set up your profile and keep your account secure. Signing in with Google does not mean you have accepted our Terms of Use or this Privacy Policy — you are asked to do that separately.

Content you create

Community Finds (including photos and the location you pick), reviews and replies, reports, product corrections, business and branch details and listings if you are a business owner, independent provider profiles and skills, profile photos and work samples, Marketplace posts and their images, messages in Marketplace discussions, “Interested” requests, skill requests, and the contact fields you choose to share.

Location

The location you choose to browse from (an area you select, a point you pick on the map, or — only if you allow it in your browser — your device’s GPS position), saved and recent locations, and the location of the things you post. Searches are recorded with coordinates rounded to roughly a kilometre.

Usage information

Searches (including searches with no results), clicks on results, views of listings, events, providers and posts, favourites, and similar interaction events. These are linked to your account if you are signed in, and otherwise to a random identifier that lives only for the current browser tab.

Account-linked activity records

To keep the platform safe and to resolve disputes, we keep an activity record of meaningful actions — for example creating or editing a Community Find, posting or closing a Marketplace post, sending or deleting a message, expressing interest, sharing contact details, publishing a provider profile, writing a review, updating a business, filing a report, and moderation actions taken by administrators. Each record contains your account ID, the action, the type and ID of the item, the time and limited technical details. It does not copy the content of your messages and does not include your IP address.

4. Why we use it

• Providing the service — showing nearby products, businesses, services, providers, events, deals, Community Finds and Marketplace posts, and running your account.
• Search and location results — sorting by distance, filtering by area and remembering your preferred location.
• Communication — in-app notifications about interest in your posts, replies, skill requests and shared contact details; and service messages such as account confirmation and password reset e-mails.
• The contact-sharing workflow — letting you decide who sees your contact details, and recording that decision.
• Safety and moderation — reviewing reports, removing harmful content, suspending abusive accounts and preventing fraud, scams, spam and impersonation.
• Troubleshooting and analytics — understanding which features are used and which searches find nothing, so we can improve coverage.
• Legal compliance — responding to valid legal requests and keeping records the law requires.

5. Location in more detail

Precise GPS location is requested only when you tap “Use my current location”, and your browser asks for permission first. You can always choose an area manually or pick a point on the map instead. Independent providers never need to publish a home address: their skills show an area and a service radius, and public coordinates are rounded to about one kilometre. Marketplace posts show an approximate area. When you share a Community Find you can choose to show only the approximate area; the exact point is then visible only to you and the moderation team.

6. Contact details in more detail

Your sign-in e-mail address and the phone number in your profile are private by default and are never shown on public pages. An independent provider’s phone, WhatsApp or contact e-mail appears only if the provider ticks that channel, and only to signed-in visitors. In the Marketplace, tapping “Interested” does not reveal anyone’s details; the owner decides whether to share chosen fields with that one person, and we record which fields were shared and when.

7. Photos and other media

Images are stored with our hosting and storage provider. Images attached to public content — product photos, business photos, Community Find photos, provider photos and work samples, Marketplace and message images — are publicly accessible by their link. Files uploaded for brochure or website imports by administrators are kept in private storage. To avoid storing the same image twice, we calculate a fingerprint (hash) of each image; identical product images are stored once and shared between sellers. Please do not upload photos that show other people without their permission.

8. Who we share information with

We do not sell personal information. We share it only as needed with the following categories of service providers, who process it on our behalf:

• Database, authentication, hosting and file storage — Zayalle runs on Supabase (database, sign-in, file storage and server functions).
• Google (only if you use “Continue with Google”) — Google confirms your identity to us; Google’s own privacy policy applies to your Google account.
• AI processing — when an administrator imports a brochure or an approved website, the page is sent to an AI provider (currently Anthropic) to extract product and price information for human review. Future Orbit features may also use an AI provider to understand questions. We do not send account data for these tasks, and we do not permit providers to use this data to train their models where the provider offers that choice.
• Maps — the location picker loads map tiles from a map tile provider (by default OpenStreetMap’s public tile servers). Your browser requests those tiles directly, which means the tile provider sees your browser’s network address and the map area being viewed.
• Permitted external data sources — some business listings are imported from open datasets (such as OpenStreetMap), official open data, merchant submissions or approved websites. These records describe businesses and places, keep their source and licence, and are reviewed before publication. If a listing contains information about you that you want corrected or removed, contact us.
• External links — if you follow a link to a business website, WhatsApp, a map application or an event organiser, that service’s own privacy policy applies.

Other users see the content you publish, your display name next to it, and contact details only as described above. We may disclose information if required by law, to protect people from harm, or as part of a future transfer of the service (in which case this policy would continue to apply).

9. Cookies and browser storage

Zayalle does not use cookies for advertising or cross-site tracking. It uses your browser’s local storage and session storage for things that are needed for the service to work or that you ask it to remember:

Because this storage is essential or user-requested, Zayalle does not show a cookie banner. If optional analytics or advertising cookies are ever introduced, we will ask for your consent before enabling them.

10. How long we keep information

• Account information — while your account is open; after a deletion request we remove or anonymise it, except where described below.
• Marketplace posts — expire automatically after a set period (currently 30 days). Expired, sold and closed posts are hidden from discovery but kept for a limited time for safety and disputes; their images become eligible for automatic clean-up 30 days after the post ends.
• Messages — kept with the post; deleted messages lose their content immediately. Messages removed by moderators are kept in the moderation record.
• Search and usage events — kept for as long as they are useful for improving the service; we intend to aggregate or delete detailed events after about 24 months.
• Activity records, agreement history and moderation records — kept for as long as needed for safety, dispute resolution and legal obligations, including after an account is deleted, but they contain identifiers rather than message content.
• Unused images — removed by an automatic clean-up process after a safety period once nothing refers to them.

11. Your choices and rights

Depending on where you live you may have legal rights over your personal information. We offer the following to everyone:

• Access and export — Account → Privacy → “Download my data” gives you a copy of the data linked to your account.
• Correction — edit your profile, contact details, posts and listings yourself, or send a correction request.
• Deletion — Account → Privacy → “Request account deletion”. We will close your active posts, cancel open requests, remove your private contact details and anonymise your profile. Some records are kept as described above, and public reviews or messages may remain with the name “Deleted user”. Deletion is not always instant because we check requests to prevent abuse.
• Your content — you can edit, close or delete your own posts and messages.
• Location and contact settings — choose areas manually instead of GPS, revoke location permission in your browser, and control which contact channels are visible.
• Withdrawing consent — where we rely on your consent (for example GPS location), you can withdraw it at any time.

If you are not satisfied with our answer you may be able to complain to a data-protection authority where you live.

12. Security

We use reasonable safeguards: sign-in through Supabase Auth; database row-level security rules that decide who can read or change each record; restricted administrator access; separation of secret server keys from the code that runs in your browser; storage permissions on uploaded files; encrypted connections (HTTPS) in production; and activity records of important actions. No system is perfectly secure, so please use a strong, unique password and tell us if you notice anything suspicious.

13. Children

Zayalle accounts, independent provider profiles and the Marketplace are not designed for children and require users to be adults. We do not knowingly collect personal information from children. If you believe a child has created an account or that a child’s personal information or image has been posted, please contact us and we will review and remove it where appropriate.

14. International processing

Our service providers may store or process information in countries other than the one where you live. Where required, we will use appropriate safeguards for such transfers. The data-hosting region will be stated here once the production setup is final.

15. Changes to this policy

Each version of this policy has a version number and effective date. If we make a material change, we will ask signed-in users to review it. These policies may be updated as Zayalle evolves.

16. Contact

Use Account → Privacy for data requests, or the contact page for any other privacy question.