Privacy Policy

Last updated: 23 May 2026

Zealo is a product of HashData (Pty) Ltd, a South African company. This policy explains what personal information we collect when you use Zealo, why we collect it, how we protect it, and the rights you have under the Protection of Personal Information Act (POPIA).

Information we collect

• Account data — your name, email, password (hashed), organization name, role.
• Operational data — creditor and customer details you enter, bills, invoices, payment batches, opportunities, contacts, and any notes attached.
• Banking details — supplier banking info you capture for creditor payments (stored encrypted at rest, scoped to your organization only).
• Integration credentials — service keys for Netcash and AWS Partner Central, encrypted at rest, used only to make API calls on your behalf.
• Usage data — server logs (IP, timestamps, requested URLs) retained for operational and security purposes, typically for 90 days.

How we use it

• To deliver the Zealo service to your organization.
• To facilitate payments to your suppliers via Netcash on your instruction.
• To send transactional emails (password resets, account notifications, batch status updates).
• To diagnose issues and maintain platform security.

We do not sell your data, share it with advertisers, or use it to train external machine-learning models.

Third parties we share data with

Zealo integrates with a small set of trusted providers, only to deliver functionality you explicitly enable:

• Netcash — creditor payment submission, account balance, status polling.
• AWS Partner Central (ACE) — when you push or pull opportunities.
• Amazon Web Services — infrastructure hosting (af-south-1), email delivery (SES), and object storage (S3).
• Cloudflare — DNS and edge protection for selected domains.

Each transmission is the minimum data required to complete the action you requested.

Where your data lives

Operational data is stored in PostgreSQL hosted in AWS South Africa (af-south-1, Cape Town). File assets are stored in AWS S3 in the same region. Backups are encrypted at rest.

Your rights under POPIA

You have the right to:

• Access the personal information we hold about you.
• Correct or update inaccurate information.
• Request deletion (subject to legal retention requirements like SARS records).
• Object to processing.
• Lodge a complaint with the Information Regulator (South Africa).

Contact us

For privacy questions or to exercise any of the rights listed above:

Changes

We may update this policy from time to time. Material changes will be notified to organization administrators by email at least 14 days before they take effect.