Privacy Policy

1. Who we are

Zara Face is the "data controller" for the information described here. For any privacy question or request, email hello@zaraface.com. [Name the Data Protection Officer here if one is appointed, and state our NDPC registration status if required.]

2. What we collect

• Account details: your name, email address, password (stored scrambled, never in readable form), and your Google account ID if you sign in with Google.
• Agreement records: when you confirmed you are 18 or older and accepted our terms, and which version.
• Payments: the amount, credits bought, payment reference, status, payment method type, and a scrambled fingerprint of your card used only to help spot fraud. We never see or store your full card number; Paystack handles card details.
• Wallet: a record of every credit added, reserved, used or refunded.
• Studio sessions: when each session started, connected and ended, how many seconds were reserved and used, and a session ID from our AI partner. Not the video or photos themselves.
• Abuse reports: the reporter's email, what they tell us, any link, the reported account, and the internet address (IP) the report came from.
• Technical information: your IP address and browser type (in short-lived server logs), and the cookies described in section 11.
• Usage statistics: which of our pages are visited and key steps such as signing up, starting a payment, opening the Studio and starting a session. These are stored in our own database, without your IP address, and deleted after 180 days. See section 11.

4. Why we use your information (and our legal basis)

• To provide the service you signed up for (your account, credits, payments, live sessions, emails like verification and receipts). Basis: performing our contract with you.
• To keep records required by law (for example tax and accounting records of payments). Basis: legal obligation.
• To keep the service safe: preventing fraud and misuse, handling abuse reports, and securing our systems. Basis: our legitimate interests, and protecting others.
• With your consent where we ask for it, for example signing in with Google. You can withdraw consent at any time.

5. Who we share it with

We only share what each company needs to do its job for us:

• Decart (Decart.ai Inc., USA): live face transformation. Receives your camera video and reference photo directly from your browser (see section 3).
• Paystack (Paystack Payments Ltd, Nigeria): processes payments. Receives your email and payment details.
• Google (Google LLC, USA): only if you choose "Continue with Google", to confirm who you are.
• Brevo (Sendinblue SAS, France/EU): sends our emails, such as verification links, password resets and receipts. Receives your email address and the email content.
• [HOSTING PROVIDER]: the company whose servers run our website and database.
• TikTok (TikTok Pte. Ltd. and its affiliates): only if you click "Accept all", the TikTok Pixel tells TikTok which of our pages you visited, so we can measure our TikTok ads. See section 11.
• Authorities, where the law requires it or to protect people from serious harm.

We don't sell your personal information.

6. Sending data outside Nigeria

Decart and Google are in the USA, and Brevo is in the European Union, so some of your information leaves Nigeria. We do this only as the NDPA allows (Part VIII), relying on the protections those companies provide, such as contractual safeguards and recognised data-protection frameworks. [LAWYER TO REVIEW: transfer basis under NDPA sections 41–43.]

7. How long we keep it

• Account details: while your account is open. When it's closed, we remove your name, email address, Google link and password.
• Payment and wallet records: kept for [6] years after the payment, in anonymous form after your account is closed, because tax and accounting laws require it.
• Studio session records (times and seconds only): kept with your wallet records.
• Abuse reports: [2] years after the report is closed, or longer if needed for a legal matter.
• Server logs: about 14 days.
• Usage statistics: 180 days, then deleted automatically.
• Camera video and photos: never stored by us (see section 3 for Decart).

8. Your rights

Under the NDPA you have the right to:

• know what information we hold about you and get a copy (access);
• have wrong information corrected (correction);
• have your information deleted (erasure), except what the law requires us to keep;
• ask us to limit or stop using your information (restriction and objection);
• receive your information in a common format (portability);
• withdraw consent you've given; and
• complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

How to ask: email us at hello@zaraface.com from the email address on your account. To close and delete your account, use "Request account deletion" on your profile page. We'll reply within 30 days, and may need to confirm your identity first. When we close your account, we remove your personal details but keep anonymous payment and wallet records as explained above. To ask Decart about data it holds, you can also contact Decart directly.

9. Security

Our website uses encrypted connections (https). Passwords are stored scrambled. Our partners' secret keys are kept only on our servers, and only a few authorised staff can see customer records. If a breach puts your information at risk, we will tell the Nigeria Data Protection Commission within 72 hours as the NDPA requires, and tell you where the risk to you is high.

10. Children

Zara Face is only for people aged 18 or older. If we learn that an account belongs to someone younger, we will close it and delete their information.

11. Cookies and analytics

When you first visit, we ask you to choose "Necessary only" or "Accept all". You can change your choice any time with "Cookie settings" at the bottom of every page.

• Necessary cookies (always on): keep you logged in, protect our forms from forgery, and remember your cookie choice.
• Our own usage statistics (always on, no tracking cookie): we count page visits and key steps in our own database, without your IP address, to see what works and fix what doesn't. With "Necessary only", these are anonymous counts, not linked to a visitor. If you're logged in, steps such as starting a session are linked to your account, because they're part of using the service.
• With "Accept all" only: an analytics cookie (a random ID, kept for 6 months) that lets us connect one visitor's steps, for example from visiting the home page to signing up. If we run TikTok ads, also the TikTok Pixel, which tells TikTok which pages you visited. Nothing in this list loads unless you click "Accept all".

12. Changes

We'll update this page if our practices change, and tell you about important changes by email or on the site.