Zirzir privacy policy

Zirzir (ዝርዝር) is a free app that helps small businesses in Ethiopia record orders, sales, payments, expenses and the day’s money. It is made by Lomilab, Addis Ababa, Ethiopia (“we”). Questions about privacy: Telegram @Lomilab_dev or [email protected].

What we collect

• When you sign in with Google: your name, email address, profile picture and Google account ID. We never see or store your Google password.
• When you create or join a business: the business details you enter (name in English and Amharic, business type, phone number, optional Telegram handle, branch names and addresses, business-day settings), and who works there (each member’s name, email, role and branches).
• When the business uses Zirzir: orders, menu or item lists, prices and stock; payments (amount, method such as cash, telebirr or CBE, the transfer reference number if one is entered, who recorded it and when); expenses, day-close counts and notes, voids and their reasons; and a log of who changed what and when.
• When a gym uses Zirzir: the gym’s members’ names, phone numbers, card numbers, Telegram usernames (optional), gender (optional, used only for women-only hours), notes the staff write, the plans they bought and their payments, and the date and time of each check-in. Zirzir doesn’t collect health or body data: no weight, measurements or medical notes.
• Automatically: when the app talks to our servers we record technical logs (IP address, time, the request and any error, your app version) to keep the service working and secure.

Order labels (such as a table number or a customer’s first name) and transfer reference numbers can relate to a business’s customers, so businesses should enter only what they need.

We don’t collect your location, contacts, photos, files or anything from other apps. The app uses your camera only to scan a staff invite QR code or a gym member’s card: the picture stays on your phone and isn’t saved or sent. Zirzir has no advertising and no third-party tracking or analytics.

A gym member’s card is made as a picture on the staff member’s phone and shared from there. Its QR code holds a random code, not the member’s name or phone number. Reminders are sent by the gym’s staff from their own Telegram; Zirzir doesn’t message members.

Why we use it

• To run the service: sign you in, show each business its own records, and let owners control staff access.
• To keep it secure: prevent misuse, investigate problems and keep a trail of money records.
• To help you when you contact us, and to meet legal obligations.

We never sell personal data, and we don’t use business records for advertising.

Who can see it

• Inside a business: what each member sees depends on the role and branches the owner gives them.
• Lomilab: our administrators see business names and account status to run the service, but not a business’s financial records, unless the owner asks us to look into a problem.
• Service providers that process data for us: Google (sign-in) and Microsoft Azure (servers and database, in Azure’s Central India region). Your data is stored outside Ethiopia.
• Authorities, only when the law requires it.

How long we keep it

• Your account, until you delete it.
• Business records, while the business uses Zirzir. Money records are never edited or silently deleted: corrections are recorded as voids, so the books stay trustworthy.
• Backups, 7 days. Technical logs, 30 days.

Deleting your data

Delete your account in the app (More → Delete my account) or ask us on Telegram @Lomilab_dev or at [email protected] (see how to delete your account). If you own a business, archive it first (the app walks you through it); archiving ends your staff’s access to it. Your sign-in details and profile are deleted. If you were a member of a business, the records you entered stay with that business (for example “recorded by”), because the owner needs complete books. An owner can archive a business and ask us to delete its records. We complete deletion within 30 days, except where the law requires us to keep something.

Gym members: the gym’s owner can delete a member in the app. The member’s name, phone number, Telegram username, gender, notes, check-ins and reminders are deleted and their card stops working; the plans and payments stay in the gym’s books without a name. Members can ask their gym, or us, to do this.

Your rights

You can ask us to see, correct or delete your personal data, or to stop using it, and you can complain to the relevant Ethiopian authority. Contact us first on Telegram @Lomilab_dev or at [email protected]; we reply within 30 days.

Security

Data travels encrypted (HTTPS). Each business’s records are kept apart, our servers check access on every request, money records can’t be changed once written, and the database is backed up every night. No system is perfectly secure; if a breach affects you, we’ll tell you. So it opens fast and works through a weak connection, the app keeps a copy of your recent screens on your phone; it’s deleted when you sign out or delete your account.

Children

Zirzir is a business tool and isn’t meant for anyone under 18.

Changes

If this policy changes, we’ll update this page and the date at the top, and tell you in the app about important changes.