Privacy Policy

1. Data We Collect

From business owners (you)

• Account data: Email address, first and last name, business name, phone number.
• Payment data: Paystack customer and subscription codes. We do not store card numbers — Paystack processes payments directly.
• Bank account details: Your bank account number, bank name, and account name for the bank transfer payment flow. These are encrypted at rest (see Section 5 below) and are never stored in plaintext.
• WhatsApp and Instagram credentials: Your WhatsApp Business Account (WABA) phone number ID, access token, and Instagram Page/Account ID, used solely to send and receive messages via the Meta API on your behalf.
• Catalogue data: Product names, descriptions, prices, images, and stock information you upload to your Zella catalogue.
• Subscription and billing history.

From your customers (collected on your behalf)

When your customers message your business via WhatsApp or Instagram and Zella handles those conversations, we collect and process the following data on your behalf:

• WhatsApp or Instagram user ID and display name.
• Phone number (if provided by the customer or available from WhatsApp).
• Delivery address (if provided by the customer during an order).
• Full message history within Zella-handled conversations.
• Order history, including items ordered, order status, and payment status.
• Payment receipt images submitted by the customer.

Collected automatically

• Conversation logs and AI response data.
• Platform usage metrics (e.g. messages sent, features used) for service improvement.
• Device and connection metadata (e.g. IP address, browser type) when you access the Zella dashboard.

2. How We Use Your Data

We use collected data to:

• Operate and deliver the Zella platform — generating AI responses, processing orders, and forwarding receipts.
• Bill you for your subscription via Paystack.
• Send you transactional notifications (new orders, receipt submissions, low stock alerts, account status changes) via WhatsApp and email.
• Improve and train our AI models on anonymised, aggregated conversation patterns (never on identifiable personal data).
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your data or your customers’ data to any third party.

3. NDPR Compliance (Nigeria)

Zella complies with Nigeria’s Data Protection Regulation (NDPR) 2019, issued by the National Information Technology Development Agency (NITDA).

Your role as a data controller

As a business owner using Zella, you act as an independent data controller with respect to your own customers’ personal data. You are responsible for ensuring you have a lawful basis to process your customers’ data. A customer who voluntarily sends a message to your business WhatsApp or Instagram account has provided implied consent for you to process that communication. You must have your own privacy notice available to your customers upon request.

Zella acts as a data processor on your behalf, processing your customers’ data only as necessary to provide the platform service.

Data retention

• Conversation and message data: retained for 24 months from the date of the conversation, or until you delete your Zella account, whichever comes first.
• Order data: retained for 5 years for accounting and dispute resolution purposes.
• Encrypted bank account details: deleted within 30 days of account closure.
• Payment receipt images: deleted after 90 days from upload.

Data subject rights

Individuals (including your customers) may exercise the following rights under the NDPR by contacting us at privacy@zella.com.ng:

• Right of access: Request a copy of personal data we hold about them.
• Right to correction: Request correction of inaccurate personal data.
• Right to deletion: Request deletion of personal data, subject to legal retention obligations.
• Right to object: Object to certain types of processing.

We will respond to verifiable data subject requests within 30 days of receipt.

4. Third-Party Data Processors

Zella uses the following sub-processors to deliver the platform. By using Zella, you acknowledge that your data and your customers’ data may be processed by these services:

AI processing note: Customer conversation content is processed by the configured AI provider (Groq, Anthropic Claude, or Google Gemini — as set in the Zella backend configuration) to generate AI responses. This processing is necessary to deliver the core service. Conversation data is not used by these providers to train their models under our enterprise agreements.

5. Bank Account Details Security

Your bank account number, account name, and bank name are stored in an encrypted format using AES-256 symmetric encryption (Fernet). The encryption key is stored separately from the encrypted data and is never written to the database.

Bank details are only decrypted at the specific moment when a genuine customer payment inquiry is being processed in conversation — at no other time. The decrypted value is used solely to generate the payment instruction message sent to that customer and is not stored, logged, or transmitted in any other context.

Staff at Zella Technology Limited do not have access to your decrypted bank details in normal platform operations.

6. Cookies and Analytics

The Zella public website (zella.com.ng) may use cookies or similar technologies for basic session management and performance measurement. This section will be updated to name the specific analytics tool once a final choice is made.

The Zella merchant dashboard (app.zella.com.ng) uses only essential session cookies required for authentication. No advertising or behavioural tracking cookies are used on the dashboard.

You may configure your browser to refuse cookies, though this may affect functionality on certain pages.

7. International Transfers

Some of our sub-processors (including Supabase, Groq, Anthropic, and Cloudflare) are based outside Nigeria and process data on servers located in the United States or Europe. By using Zella, you acknowledge and consent to this transfer. We ensure that all international data transfers are governed by appropriate safeguards consistent with NDPR requirements.

8. Data Breach Response

In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, Zella will notify affected merchants within 72 hours of becoming aware of the breach, in accordance with NDPR obligations. We will also take reasonable steps to contain and remediate any breach as quickly as possible.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision.

10. Contact

For privacy-related enquiries, data subject requests, or to report a concern:

• Email: privacy@zella.com.ng
• Company: Zella Technology Limited, Lagos, Nigeria