Privacy Policy

1. Who We Are

Zari Vault is a mobile application and website operated from Cape Town, Western Cape, South Africa. We provide a biometric-locked document vault that stores identity documents securely on your device.

Data Responsible Party: Zari Vault, operated by ZINKULU (PTY) LTD
Contact: hello@zarivault.co.za
Address: Cape Town, Western Cape, South Africa

2. What Information We Collect

Website (zarivault.co.za)

When you visit our website, we may collect:

• Email address - only if you voluntarily join our waitlist or submit the contact form. This is used solely to notify you of our launch or to respond to your inquiry.

That is the only information the website collects. We run no analytics, no tracking cookies, and no advertising trackers of any kind.

Mobile Application

The Zari Vault app collects:

• Nothing on our servers. All document data, biometric references, and personal information you add to the app is stored exclusively on your device, encrypted with AES-256.
• Crash reports (optional, with your consent) - anonymised technical data to help us fix bugs. This contains no document data or personal information.

3. What We Do Not Collect

We explicitly do not collect, transmit, or store:

• Your identity documents (Smart ID, passport, driver's licence, etc.)
• Your biometric data (fingerprints, facial recognition data)
• Your ID number, date of birth, or any document field values
• Your physical location or GPS data
• Your device contacts, camera roll, or microphone data
• Any data from documents you store in the vault

This is not a policy choice - it is an architectural fact. The app has no capability to transmit your documents externally because it is designed to work entirely offline.

4. How We Use Information

We use the limited information we collect for the following purposes:

• Email address (waitlist/contact): To notify you of app launch, respond to inquiries, or send product updates. You can unsubscribe at any time.
• Crash reports: To identify and fix technical issues in the app.

We do not use your information for advertising, profiling, or selling to third parties.

5. Data Storage and Security

On your device

All documents stored in Zari Vault are encrypted using AES-256 encryption. The encryption key is derived from your biometric authentication and stored in your device's Secure Enclave (iOS) or StrongBox (Android). This means your documents cannot be accessed without your biometric, even by us.

Email addresses (waitlist and contact form)

Email addresses and messages you submit on the website are stored in our own secured database (Supabase), with the personal fields encrypted at rest using AES-256-GCM. The encryption key is held separately from the database, so the stored records cannot be read by anyone who only has database access. Email notifications are delivered via Resend. We retain this information until you unsubscribe or request deletion.

6. Sharing of Information

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

We work with the following service providers who may process limited data on our behalf:

• Supabase - secured database for waitlist and contact submissions (personal fields encrypted at rest)
• Resend - transactional email delivery
• Vercel - website hosting

We may disclose information if required by South African law or a valid court order.

7. POPIA Compliance

Zari Vault is designed to comply with the Protection of Personal Information Act 4 of 2013 (POPIA). As a responsible party, we:

• Collect only the minimum personal information necessary
• Use personal information only for the purpose it was collected
• Store personal information securely and for no longer than necessary
• Do not transfer personal information outside South Africa without adequate protections
• Provide you with access to and control over your personal information
• Notify you in the event of a data breach that affects your personal information

Our Information Officer can be contacted at hello@zarivault.co.za.

8. Your Rights

Under POPIA, you have the right to:

• Access - request a copy of the personal information we hold about you
• Correction - request that we correct inaccurate information
• Deletion - request that we delete your personal information
• Objection - object to the processing of your personal information
• Withdrawal of consent - withdraw consent at any time (e.g. unsubscribe from emails)
• Complaint - lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, email hello@zarivault.co.za. We will respond within 30 days.

Information Regulator of South Africa:
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za

9. Cookies and Tracking

Our website uses:

• Session storage - to remember that you have dismissed our privacy banner. This is not a cookie and contains no personal information.

We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party marketing trackers.

10. Children's Privacy

Zari Vault is not intended for use by children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify waitlist members by email.

Continued use of Zari Vault after changes are posted constitutes your acceptance of the revised policy.