Privacy at Zambi

01Who is responsible for your data

The controller of the personal data processed in Zambi, under article 5, VI of the LGPD, is the developer responsible for the app. The same contact channel serves as the data protection officer (article 41 of the LGPD).

• Service: Zambi — mobile app and website www.zambi.com.br
• Controller and data protection officer: the developer responsible for Zambi
• Email for privacy matters: rickfontes007@gmail.com
• Response time: up to 15 (fifteen) days from receipt of the request

02What data we collect

We only collect what the app needs to work. Much of Zambi can be used without an account; in that case we only process technical data and, if you allow it, your location. The table below lists every category of data Zambi processes:

Zambi deals with African-matrix religious tradition. We do not use any data to infer your religious beliefs, we do not build behavioral profiles, we do not track you across third-party apps and websites, and we do not link what you read or listen to with any advertising purpose.

The information in this section matches what we declare in the App Store privacy details and in the Google Play Data safety form.

03App permissions

Zambi only asks for a permission when you trigger the feature that needs it, always with an explanation first and through the operating system's own prompt. No permission is mandatory: you can decline all of them and keep using the app — only that specific feature becomes unavailable.

Location is used at the moment of the search: the approximate position is sent to the server only to find nearby places and is not saved to your account. The images you choose are uploaded and stored on our servers for as long as they exist in the app. You can revoke any permission at any time in your system settings — on Android, Settings → Apps → Zambi → Permissions; on iOS, Settings → Zambi.

04How we use the data and on what legal basis

Every processing activity in Zambi has a specific purpose and a legal basis under article 7 of the LGPD:

We do not make automated decisions that produce legal effects or affect your interests (article 20 of the LGPD).

05Who we share data with

We do not sell, rent or trade your personal data with anyone. We do not share data with data brokers or advertising networks, and we do not show ads in the app.

Other users see what you make public in the app: your profile, your feed posts and comments, and the public houses you register or belong to. Direct messages are seen only by you and the recipient, and a house's conversations only by its members.

Beyond that, we share only what is strictly necessary with the processors that run the service, all of which are bound to handle the data according to our instructions and their own policies:

We may also disclose data under a court order, a request from a competent authority, or when needed to exercise rights in legal proceedings (article 7, VI of the LGPD). If that happens and the law allows it, we will let you know.

06International data transfers

The providers we use (Supabase, RevenueCat, Google, Apple and OpenStreetMap) may keep servers outside Brazil, including in the United States and the European Union. This means your data may be transferred to and stored abroad.

These transfers take place under article 33 of the LGPD and are backed by contractual clauses with the providers, which commit to ensuring a level of data protection compatible with Brazilian law.

07How long we keep data

• Account, profile, posts, comments, messages and houses: for as long as your account exists, or until you delete the content. Deleting the account erases this data.
• Reports: for as long as needed for moderation and the defense of rights.
• Subscription data: while the subscription exists and afterwards for the period required by tax and consumer protection rules. Apple and Google keep their own purchase records under their policies.
• Location: not stored — it is only used at the moment of the search.
• Application access logs: 6 months, as required by article 15 of Brazil's Marco Civil da Internet (Law No. 12,965/2014).
• Data needed to meet a legal obligation or to exercise rights in legal proceedings: for the applicable legal period.

08How to delete your account and data

You can delete your account at any time, on your own, without contacting support and without giving a reason. There are two ways:

1. In the app: open the Eu (Me) tab, tap the menu and choose Excluir conta (Delete account). You will be asked to confirm before it completes.
2. On the website: go to www.zambi.com.br/conta, sign in and tap Delete my account.

Deletion is permanent and immediate. We remove from the server your account and profile, the posts, likes, comments and messages you sent, your images, your favorites, the notification token and every other record linked to your user identifier. The account cannot be recovered afterwards, and we keep no copy of your profile.

Rolling backups are overwritten within 30 days. After that, only the following may remain: (a) aggregated and anonymized statistics, which do not identify you and cannot be reversed; and (b) data the law requires us to keep, such as the access logs required by the Marco Civil da Internet and purchase records required by tax rules.

If you have lost access to your account and cannot sign in, write to rickfontes007@gmail.com from the registered email address. We will confirm ownership and complete the deletion within 15 days.

09Your rights as a data subject

Article 18 of the LGPD guarantees you, at any time and free of charge, the right to obtain:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability of your data to another provider, upon express request;
• deletion of data processed on the basis of your consent;
• information about the entities we share data with;
• information about the possibility of withholding consent and the consequences of doing so;
• withdrawal of consent, at any time;
• objection to processing based on legitimate interest.

To exercise any of these rights, write to rickfontes007@gmail.com from the email address registered on your account. We will reply within 15 days. You may also file a complaint with Brazil's ANPD — National Data Protection Authority (gov.br/anpd).

10How we protect your data

• All traffic between the app, the website and the servers is encrypted with HTTPS/TLS.
• Stored data is encrypted at rest by our infrastructure providers.
• The database uses Row Level Security policies, so each person only accesses what concerns them — for example, only the participants of a conversation can read its messages.
• Administrative access is restricted to the responsible developer and protected by two-factor authentication.
• We apply data minimization: we do not collect what the service does not need to work.

No system is entirely immune to incidents. If a security incident occurs that may pose a relevant risk or harm to you, we will notify you and the ANPD within a reasonable time, as required by article 48 of the LGPD. Keep your password confidential and do not share it with anyone.

11Children and teenagers

Zambi offers cultural and educational content and may be used by families, including children and teenagers accompanied by their parents or guardians.

Under article 14 of the LGPD, children's data is always processed in their best interest and requires specific, prominent consent from at least one parent or legal guardian. If you are responsible for a child who uses Zambi, the account — and any purchase, such as the subscription — must be created or authorized by you. Apple's and Google's family sharing and parental control features help with this.

Under no circumstances do we show ads in the app, sell data or build behavioral profiles — of any user, let alone minors. We do not make participation in any app activity conditional on providing more data than necessary.

If we learn that a child's account was created without guardian consent, we will delete the data. Guardians may request access to, correction of or deletion of the data at any time at rickfontes007@gmail.com.

12Cookies and technologies on the website

The www.zambi.com.br website uses a session cookie that keeps you signed in to your account and a preference stored in your browser with the light or dark theme you picked.

The website may display Google AdSense ads. To do so, Google and its partners may use cookies and identifiers to serve and measure ads, including based on previous visits to this and other websites. Learn how Google uses data from partner sites and turn off personalized ads in My Ad Center. This applies only to the website — the app shows no ads.

13Changes to this Policy

We may update this Policy to reflect changes in the service or in the law. The version in force is always published on this page, with the update date at the top.

When a change is material — for example, a new category of data or a new purpose — we will announce it prominently in the app or by email before it takes effect. If the new purpose depends on consent, we will ask for your consent again.

14Contact

Questions about this Policy, how your data is used or how to exercise your rights: write to rickfontes007@gmail.com. We reply within 15 days.

The same address handles support requests, subscription questions, content reports and security communications.