Privacy Policy

1. Who is responsible for your data

Search Zimbabwe, of 13 Bascaw Court, 40 Selous Avenue, Harare, Zimbabwe, is the data controller for information collected through search.co.zw, siesta.co.zw and gallery.co.zw. All three are one platform sharing one account system, so this policy covers all of them.

We handle personal information in line with Zimbabwe's Data Protection Act (Chapter 11:12, 2021). If you are in the European Economic Area or the United Kingdom, we also apply the GDPR standards described below.

Data protection enquiries: hello@search.co.zw.

2. What we collect

Information you give us

• Account — your name, email address, a password (stored only as a one-way hash, never in a form we can read), and optionally a phone number, avatar and handle.
• Your business or profile — everything you publish: business name, description, categories, address, contact numbers, opening hours, photos, prices, products and services. This is intended to be public.
• Orders — what you bought, from whom, and the delivery name, address and phone number you supply.
• Bookings — the dates, number of guests and any message you send a property.
• Messages and requests — chats with other users, quote requests, reviews, reports and disputes, including anything you attach to them.
• Payouts — where you sell, the mobile-money or bank details you give us so we can pay you.

Information we generate or observe

• Transaction records — payments, wallet movements, earnings and fees. These form an append-only ledger, for the reasons in section 6.
• Technical data — IP address, browser and device information, and server logs of the requests you make. Used to keep the service running, to apply rate limits, and to investigate abuse.
• Location — only if you use a “near me” feature and your browser asks your permission first. We use the coordinates to sort results by distance; we do not build a movement history from them.

3. Cookies and local storage

We use the minimum needed to make the site work:

• A session cookie, which is what keeps you signed in and keeps your basket attached to you before you have an account.
• A CSRF token cookie, which stops another site from submitting forms as you.
• A “remember me” cookie, only if you ask us to remember you.
• Your theme preference (light or dark), stored in your browser's own local storage and never sent to us.

All of these are strictly necessary or set at your request, so there is no advertising consent banner to click through. Clearing them signs you out and empties a guest basket.

4. Why we use it

• To provide the service — your account, listings, search, checkout and bookings. (Performance of a contract.)
• To process payments, hold funds in escrow, settle payouts and handle refunds. (Contract, and legal obligation.)
• To send transactional messages: verification, password resets, order and booking updates, dispute and payout outcomes. These are part of the service and cannot be turned off while you have an active account. (Contract.)
• To keep the platform safe — moderation, fraud prevention, rate limiting, and investigating reports. (Legitimate interests.)
• To meet accounting, tax and regulatory obligations. (Legal obligation.)
• To improve the site, using aggregate patterns rather than individual profiles. (Legitimate interests.)

We do not sell your personal information, and we do not share it with advertisers.

5. Who else sees it

• Sellers you buy from receive your name, delivery address and phone number for that order — they cannot deliver without it. They receive it for that purpose only.
• Properties you request a booking from receive your name, your dates, guest numbers and your message.
• Paynow, our payment provider, processes payments. You enter card or mobile-money details on their systems; we receive only the result and a reference. We never see or store your card number.
• Our email provider delivers transactional messages, and therefore handles your email address and the contents of those messages.
• Search infrastructure. To make search understand meaning rather than just match words, the text you type into the search box may be sent to an embedding service outside Zimbabwe to be converted into a numeric vector. It is sent as a standalone query, not attached to your account.
• Hosting and infrastructure providers, who store the data on our behalf under contract.
• Authorities, where we are legally required to disclose, or where it is necessary to prevent or investigate a crime.

6. What is public, and what stays private

Public: your business or professional profile, its address and contact details, your listings and prices, artwork you publish, collections, reviews you write, and your handle and display name.

Not public: your email address, your password, your delivery addresses, your order history, your wallet and earnings balances, your payout details, your private messages, and any report or dispute you raise.

Public pages are indexed by search engines, so treat anything you publish as genuinely public. If you post a personal phone number as a business contact, it is public.

7. How long we keep it

• Account and profile data — while your account is open, and for a short period after you close it so a dispute or reversal can still be resolved.
• Orders, payments and ledger entries — retained for as long as accounting and tax law requires, typically several years, even after an account closes.
• Published content — removed when you unpublish or delete it, though search engines and caches may hold copies for a while afterwards.
• Server logs — kept for a short period for security and troubleshooting.

8. Your rights

Under the Data Protection Act (and the GDPR, where it applies to you) you can ask us to:

• Access the personal information we hold about you.
• Correct anything inaccurate — much of this you can do yourself from your dashboard.
• Delete your information, subject to the retention rules above.
• Restrict or object to a particular use, including any use we base on legitimate interests.
• Receive a copy of the data you gave us in a portable format.
• Withdraw consent where we relied on it, such as location access.

Email hello@search.co.zw with “Data request” in the subject. We will respond within the period the law allows, and we may need to verify who you are first. You also have the right to complain to Zimbabwe's data protection authority (POTRAZ).

9. Security

Traffic is encrypted in transit. Passwords are stored only as hashes and cannot be recovered — only reset. Payment card details never touch our servers. Access to production data is limited to the people who need it to run the platform.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the authority as the law requires.

10. Children

The platform is not intended for children. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will remove it.

11. Information leaving Zimbabwe

Some of the providers described in section 5 — hosting, email delivery, search infrastructure — operate outside Zimbabwe, so some processing happens abroad. Where that is the case we use providers that offer protections comparable to those required here, and we share only what the provider needs to do its job.

12. Changes to this policy

We will update this page when what we do with your information changes, and the date at the top tells you when it last changed. Significant changes will be notified in-app or by email rather than made quietly.

The rules for using the platform itself are in our Terms of Service, and other ways to reach us are on the contact page.