Privacy Policy

1. Who We Are

Zari Vault is a mobile application and website operated from Cape Town, Western Cape, South Africa. We provide a biometric-locked document vault that stores identity documents securely on your device.

Data Responsible Party: Zari Vault
Contact: hello@zarivault.co.za
Address: Cape Town, Western Cape, South Africa

2. What Information We Collect

Website (zarivault.co.za)

When you visit our website, we may collect:

• Email address — if you voluntarily join our waitlist or submit the contact form. This is used solely to notify you of our launch or to respond to your inquiry.
• Analytics data — via Google Analytics 4 and Microsoft Clarity, we collect anonymised usage data including pages visited, time on site, and general geographic region. No personally identifiable information is included.

Mobile Application

The Zari Vault app collects:

• Nothing on our servers. All document data, biometric references, and personal information you add to the app is stored exclusively on your device, encrypted with AES-256.
• Crash reports (optional, with your consent) — anonymised technical data to help us fix bugs. This contains no document data or personal information.

3. What We Do Not Collect

We explicitly do not collect, transmit, or store:

• Your identity documents (Smart ID, passport, driver's licence, etc.)
• Your biometric data (fingerprints, facial recognition data)
• Your ID number, date of birth, or any document field values
• Your physical location or GPS data
• Your device contacts, camera roll, or microphone data
• Any data from documents you store in the vault

This is not a policy choice — it is an architectural fact. The app has no capability to transmit your documents externally because it is designed to work entirely offline.

4. How We Use Information

We use the limited information we collect for the following purposes:

• Email address (waitlist/contact): To notify you of app launch, respond to inquiries, or send product updates. You can unsubscribe at any time.
• Analytics: To understand how people use our website so we can improve it. Data is aggregated and anonymised.
• Crash reports: To identify and fix technical issues in the app.

We do not use your information for advertising, profiling, or selling to third parties.

5. Data Storage and Security

On your device

All documents stored in Zari Vault are encrypted using AES-256 encryption. The encryption key is derived from your biometric authentication and stored in your device's Secure Enclave (iOS) or StrongBox (Android). This means your documents cannot be accessed without your biometric, even by us.

Email addresses (waitlist)

Email addresses collected via our waitlist are stored securely with our email service provider (Brevo/Sendinblue), which is GDPR-compliant. We retain email addresses until you unsubscribe or request deletion.

Website analytics

Analytics data is stored by Google (GA4) and Microsoft (Clarity) in accordance with their respective privacy policies. We have configured both services to anonymise IP addresses and minimise data collection.

6. Sharing of Information

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

We work with the following service providers who may process limited data on our behalf:

• Brevo — email delivery for waitlist communications
• Web3Forms — contact form submission handling
• Google Analytics — website analytics (anonymised)
• Microsoft Clarity — website heatmaps (anonymised)
• Vercel — website hosting

We may disclose information if required by South African law or a valid court order.

7. POPIA Compliance

Zari Vault is designed to comply with the Protection of Personal Information Act 4 of 2013 (POPIA). As a responsible party, we:

• Collect only the minimum personal information necessary
• Use personal information only for the purpose it was collected
• Store personal information securely and for no longer than necessary
• Do not transfer personal information outside South Africa without adequate protections
• Provide you with access to and control over your personal information
• Notify you in the event of a data breach that affects your personal information

Our Information Officer can be contacted at hello@zarivault.co.za.

8. Your Rights

Under POPIA, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate information
• Deletion — request that we delete your personal information
• Objection — object to the processing of your personal information
• Withdrawal of consent — withdraw consent at any time (e.g. unsubscribe from emails)
• Complaint — lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, email hello@zarivault.co.za. We will respond within 30 days.

Information Regulator of South Africa:
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za

9. Cookies and Tracking

Our website uses:

• Analytics cookies (Google Analytics, Microsoft Clarity) — to understand site usage. You can opt out via our cookie banner or by using browser settings.
• Session storage — to remember that you have dismissed our privacy banner. This is not a cookie and contains no personal information.

We do not use advertising cookies, tracking pixels, or any third-party marketing trackers.

10. Children's Privacy

Zari Vault is not intended for use by children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify waitlist members by email.

Continued use of Zari Vault after changes are posted constitutes your acceptance of the revised policy.