Zoka — Privacy Policy

Effective date: 12 June 2026 · Last updated: 13 June 2026

English · Português

Zoka (“Zoka”, “we”, “us”) operates the Zoka mobile application, a hyperlocal delivery service connecting people with shops in their neighbourhood. This policy explains what personal data we collect, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).

Data controller: Zoka · Contact: info@zoka.app

1. Data we collect

We only collect what we need to run the service.

Data	When	Why
Phone number	When you sign in	To create and secure your account via a one-time SMS code, and to let the shop reach you about your order
Name (first and last)	In your profile	To identify your order to the shop
Email address (optional)	If you add it	Account-related contact; you can leave it blank
Profile photo (optional)	If you add one	To personalise your account
Location (approximate, and precise with your permission)	When you choose your area or place an order	To show shops within delivery range. You can enter a postcode instead of granting precise location
Delivery address (street, floor, notes)	When you place a delivery order	To deliver your order
Order history	When you order	To show your past and active orders and their status
Push notification token	When you enable notifications	To send order-status updates to your device

We do not collect payment-card or bank details. Payment is settled directly with the shop (cash or MB WAY); Zoka never sees or stores card numbers. We do not use analytics, advertising, or crash-reporting SDKs.

2. Legal bases (GDPR Art. 6)

• Performance of a contract — account, orders, delivery, order-status updates.
• Consent — precise device location and push notifications, granted via system prompts and withdrawable at any time in your device settings.
• Legitimate interests — keeping the service secure and preventing abuse.

3. Who we share data with

• The shop fulfilling your order receives your name, delivery address, order contents and — if you choose to share it at checkout — your phone number, so they can prepare and deliver your order.
• Twilio (SMS provider) processes your phone number to send your one-time sign-in code.
• Google (Firebase Cloud Messaging) processes your notification token to deliver push notifications.

These providers act as processors on our behalf. We do not sell your data or share it for advertising.

4. Data retention

• Account data is kept while your account exists and is deleted when you delete your account.
• Shop ratings are automatically deleted after 24 months.
• We may retain limited records where required by law (e.g. transaction records).

5. Your rights

• Access and export your data — in-app: Profile → Privacy → Export my data.
• Delete your account and data — in-app: Profile → Privacy → Delete account. Deletion is immediate and permanent.
• Rectify inaccurate data — edit it in your profile.
• Withdraw consent for location or notifications — in your device settings.
• Lodge a complaint with the Portuguese supervisory authority (CNPD).

To exercise any right you cannot complete in-app, email info@zoka.app.

6. Security

All traffic between the app and our servers is encrypted in transit (HTTPS/TLS). One-time sign-in codes are stored hashed, are single-use, and expire after ten minutes. Sign-in tokens are held in the device’s secure storage (Keychain / Keystore).

7. Children

Zoka is not directed to children and is intended for users aged 18 and over. We do not knowingly collect data from children.

8. International transfers

Our servers are located in the EU. Where a processor (e.g. Twilio, Google) processes data outside the EEA, that transfer is covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. Changes to this policy

We may update this policy. Material changes will be notified in-app or by email. The “Last updated” date above always reflects the current version.

10. Contact

Questions or requests: info@zoka.app