Privacy Policy

1. Introduction

This Privacy Policy explains how [LEGAL ENTITY NAME], operating The Applaya ("Applaya," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you use our website, mobile applications, and related services (the "Services"). This Policy should be read together with our Terms and Conditions.

We built Applaya for African creators and learners, and we take the responsibility of handling your data seriously — this Policy is written to be genuinely clear, not just legally sufficient.

2. Information We Collect

2.1 Information you give us directly

• Account information: name, email address, password (stored as a secure hash, never in plain text), profile photo, and any bio, expertise areas, or social links you choose to add.
• Authentication data: if you sign in with Google, we receive the information your Google account permissions allow (typically name, email, and profile photo) — we do not receive your Google password.
• Creator application information: any details submitted as part of applying for Creator status, including verification information requested during that process.
• Payment information: transaction details (amount, currency, status, payment method type such as card, EcoCash, or OneMoney). We do not store your full card number, mobile money PIN, or equivalent credentials — these are handled directly by our payment processor, Paynow, under its own security and privacy practices.
• Content you create: Course content, community posts, comments, chat messages, reactions, lesson notes, reviews, and any files, images, or videos you upload.
• Communications: messages you send to our support team, and any information you provide when responding to surveys or feedback requests.

2.2 Information collected automatically

• Usage data: pages and screens viewed, features used, courses/communities interacted with, session duration, and general navigation patterns.
• Device and technical data: IP address, browser type, device type, operating system, and general location inferred from IP address (city/country level).
• Progress and engagement data: lesson completion status, quiz results (where applicable), points earned, streaks, and leaderboard standing.
• Cookies and similar technologies: see Section 7.

2.3 Information from third parties

• Referral and promotional tracking: if you arrive via a Creator's shared link, trackable link, or lead-magnet landing page, we may record the referral source (e.g., which platform or link the click originated from) to attribute the visit or signup.
• Payment confirmation data: status updates from Paynow confirming whether a transaction succeeded, failed, or is pending.

3. How We Use Your Information

We use personal information to:

• Create and manage your account, and authenticate your access to the Services;
• Process payments, enrollments, memberships, and Creator payouts;
• Deliver the core functionality of the Platform: Course access, Community participation, chat, notifications, progress tracking, and Certificate issuance;
• Personalize your experience, including homepage content, search results, and recommendations based on your activity;
• Calculate and display points, streaks, and leaderboard standings within Communities;
• Communicate with you about your account, transactions, and updates to the Services or these policies;
• Send notifications you have not opted out of (e.g., replies, mentions, new lessons, community announcements) — see Section 8 for control over these;
• Detect, investigate, and prevent fraud, abuse, spam, and violations of our Terms;
• Analyze usage patterns to improve the Platform's features, performance, and reliability;
• Comply with legal obligations, including tax and financial recordkeeping requirements related to payments and payouts.

We do not sell your personal information to third parties.

4. How We Share Your Information

We share personal information only in the following circumstances:

• With Creators, to the extent necessary for them to operate their Course or Community — e.g., a Creator can see the display name, avatar, and engagement activity (posts, progress) of Learners enrolled in or members of their own Course/Community. Creators do not receive your payment credentials, password, or full account email unless you choose to share it directly (e.g., in a chat message).
• With service providers who perform functions on our behalf under contractual confidentiality and data protection obligations, including:
  • Paynow — payment processing;
  • Supabase — database hosting, authentication infrastructure, and file storage;
  • Email delivery providers — for transactional and notification emails;
  • Any analytics or infrastructure providers engaged to operate the Services, which will be listed here as they are formally adopted.
• For legal reasons, where we believe disclosure is necessary to comply with a legal obligation, protect the rights, property, or safety of Applaya, our users, or the public, or investigate potential violations of our Terms.
• In connection with a business transaction, such as a merger, acquisition, or sale of assets, subject to standard confidentiality protections and, where required by law, notice to affected users.
• With your consent, for any other purpose we disclose to you at the time of collection.

5. Where Your Data Is Stored and International Transfers

Your data is stored using infrastructure provided by Supabase, which may involve processing and storage on servers located outside Zimbabwe. [THIS SECTION REQUIRES CONFIRMATION FROM LEGAL COUNSEL: identify the specific hosting region(s) used, and confirm the legal basis and safeguards for any cross-border transfer of personal data under Zimbabwe's Data Protection Act — e.g., standard contractual clauses, adequacy determination, or explicit consent, as applicable.] We take reasonable steps to ensure any third party that processes your data on our behalf maintains a level of protection consistent with this Policy.

6. Data Retention

We retain personal information for as long as your account is active and as necessary to provide the Services. Following account closure:

• Transaction and payout records are retained as required by applicable tax and financial recordkeeping law [PERIOD TO BE CONFIRMED WITH COUNSEL, typically 5–7 years in most jurisdictions].
• Content you posted in shared spaces (e.g., community posts, chat messages visible to others) may remain visible or be retained in an anonymized or attributed-to-deleted-user form, since removing it entirely could disrupt conversations other users participated in — you may request removal of specific content on a case-by-case basis.
• Account and profile information is deleted or anonymized within [PERIOD, e.g., 90 days] of account closure, except where retention is required for legal, security, or fraud-prevention purposes.

7. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep you signed in and remember your preferences;
• Understand how the Platform is used, in aggregate, to improve it;
• Support referral and promotional link tracking (see Section 2.3).

[SECTION TO BE EXPANDED WITH SPECIFICS ONCE THE ACTUAL COOKIE/ANALYTICS STACK IS FINALIZED: list categories of cookies used (essential, functional, analytics), whether any third-party advertising or analytics cookies are set, and how users can manage cookie preferences — e.g., a cookie consent banner if serving users in jurisdictions that require one, such as the EU.] You can control cookies through your browser settings, though disabling essential cookies may prevent parts of the Platform from working correctly.

8. Your Choices and Rights

• Notification preferences: you can control which notifications you receive (mentions, replies, announcements, new lessons, etc.) in your account settings.
• Profile information: you can update your profile information at any time through your account settings.
• Access, correction, and deletion: you may request a copy of the personal information we hold about you, request correction of inaccurate information, or request deletion of your account and associated data, subject to the retention exceptions described in Section 6. Submit such requests to [PRIVACY CONTACT EMAIL].
• Data portability: where applicable law provides this right, you may request your personal data in a structured, commonly used format.
• Objection and restriction: where applicable law provides these rights, you may object to or request restriction of certain processing.
• Marketing communications: you may opt out of non-essential marketing communications at any time via the unsubscribe link in those communications or your account settings; you will continue to receive essential transactional and account-related communications.

[IF THE PLATFORM SERVES EU RESIDENTS: this section should be expanded to explicitly address GDPR-specific rights (right to erasure, right to lodge a complaint with a supervisory authority, etc.) and identify the legal basis for each category of processing.]

We will respond to verified requests within a reasonable timeframe as required by applicable law.

9. Data Security

We use industry-standard security measures to protect your information, including encrypted password storage, row-level access controls on our database (ensuring users can only access data they are authorized to see), and secure transmission (HTTPS) for data in transit. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and relevant authorities as required by applicable law.

10. Children's Privacy

The Services are not directed at children under 18 (or the applicable age of majority), and we do not knowingly collect personal information from anyone below that age without appropriate consent as described in our Terms and Conditions. If we become aware that we have collected personal information from a minor without appropriate consent, we will take steps to delete it.

11. Third-Party Links and Services

The Platform may contain links to third-party websites or services (including social media platforms accessible through Creator promotional tools). This Policy does not apply to those third-party services, and we encourage you to review their respective privacy policies.

12. Payment Information Handling

Detailed payment credentials (full card numbers, mobile money PINs) are never transmitted to or stored on Applaya's own systems — these are handled directly between you and Paynow, our payment processor, in accordance with applicable payment card industry (PCI) standards where relevant. Applaya retains only transaction metadata (amount, status, method type, timestamp, and a reference identifier) necessary for order fulfillment, dispute resolution, and financial recordkeeping.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or by email at least [X] days before taking effect. The "Last updated" date at the top of this Policy reflects the most recent revision.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of the rights described above, contact us at:

[LEGAL ENTITY NAME]
[REGISTERED ADDRESS]
[PRIVACY CONTACT EMAIL]