Zaloba Privacy Policy

1. Scope and Data Controller

This Privacy Policy governs the processing of personal data collected through the Zaloba communications software ecosystem, including the public website (zaloba.chat), the web client (web.zaloba.chat), and associated mobile applications (collectively, the "Service").

The Data Controller responsible for your personal data is Lienskill Limited ("Lienskill", "we", "us", or "our"), a company incorporated in Kenya. Zaloba is a communications platform operated by Lienskill Limited. We handle your information in accordance with applicable data protection legislation.

2. Account Registration and Identity Information

Zaloba operates an email-first identity and account model:

• Registration Email Address: Your email address serves as your primary account credential for authentication, verification challenges, and essential account security notifications.
• Email Verification Codes: When signing in or registering, one-time verification passcodes are dispatched to your verified email address to confirm ownership.
• Permanent Zaloba Number: Upon registration, your account is assigned a permanent 16-digit identifier (PREFIX@16DIGITS). This Zaloba Number functions as a public product identifier for contact exchange and discovery; it is not an authentication secret.
• Display Profile: You may optionally provide a chosen display name, a short biography, and an optional profile picture (avatar).
• System Identifiers & Sessions: Internal system identifiers (userId) and session credentials used to manage active authenticated devices.

3. Communication Content & Media Handling

In providing messaging and media features, the platform processes:

• Messages: Text messages, reactions, and conversation history transmitted between conversation participants.
• User-Selected Media: Photos, videos, or documents that you choose to send in chats or group channels.
• Voice Notes: Audio recordings captured via your microphone when you initiate voice recording in a chat.
• 48-Hour Status Updates: Photos and text published to your 48-Hour Status. Status updates automatically expire and become inaccessible 48 hours following publication.
• Delivery State: Transient message status (sent, delivered, read) to synchronize conversations across your authorized devices.

Lienskill Limited processes message payloads and attachments strictly to deliver, synchronize, and store content as directed by users, to enforce community trust and safety policies upon receiving user reports, and to maintain service integrity. Lienskill Limited does not inspect private communications for advertising or behavioral profiling.

4. Calls and Structured Meetings

Zaloba treats immediate calls and structured collaborative meetings as distinct product concepts with separate data practices:

5. Artificial Intelligence (AI) Services Notice

While visual interface elements or future controls (such as an "AI Note Taker" toggle) may appear within meeting settings, automated AI transcription, automated meeting summarization, and third-party AI model processing are not active on Zaloba production servers.

Zaloba does not transmit user audio recordings, meeting streams, or message contents to external artificial intelligence model vendors or machine-learning providers.

6. In-App Contacts & Device Permissions

We maintain strict boundaries regarding your mobile device data:

• No Address Book Harvesting: Zaloba does not request the Android READ_CONTACTS permission. We do not read, upload, hash, or scrape your physical mobile device address book.
• In-App Relational Graph: In Zaloba, "Contacts" refers strictly to an in-app relational graph of users you have affirmatively added by Zaloba Number, discovered via search, or communicated with.
• Device Permissions: Permissions such as camera or microphone access are requested at the moment you initiate an action (such as placing a video call or taking a photo).

7. Technical, Session, and Diagnostic Data

When you connect to the Service, our servers record technical diagnostic information necessary for network routing and defensive security:

• Session Information: Device model, operating system, browser user-agent, and session tokens utilized to maintain authenticated connections and allow remote session revocation.
• Network Telemetry: IP addresses and connection timestamps processed for connection routing, rate limiting, and brute-force abuse defense.
• No Advertising Trackers: Zaloba does not collect advertising identifiers (such as Google Advertising ID) or deploy third-party behavioral advertising scripts.

8. Purposes and Lawful Bases of Processing

We process personal data solely for legitimate, transparent purposes under applicable data protection law:

• Service Delivery: Registering accounts, verifying email ownership, synchronizing messages, and facilitating real-time calls and meetings (Contractual Necessity).
• Security & Abuse Prevention: Protecting server infrastructure against intrusion, rate-limiting malicious requests, and managing linked-device authorization (Legitimate Interests).
• Trust & Safety: Reviewing user-submitted abuse reports and enforcing our Child Protection and Safety standards (Legal Obligation & Vital Interests).
• Customer Support: Responding to user inquiries and technical support requests (Legitimate Interests).

9. Infrastructure Providers and Service Providers

Lienskill Limited does not sell, rent, or trade your personal information. To operate a resilient global communication platform, we engage contracted service providers who process data strictly on our instructions:

• Cloud Infrastructure Providers: Hosting application servers, compute clusters, and managed database systems.
• Object-Storage Providers: Providing scalable cloud object-storage infrastructure for user-selected attachments, avatars, and voice notes.
• Network & Media Relay Infrastructure: Operating media relay nodes to assist in establishing low-latency audio/video calling connectivity.
• Transactional Email Providers: Dispatching one-time verification passcodes (OTPs) and account security notifications.
• Other Service Providers: Specialized infrastructure partners acting strictly under confidentiality and data-protection terms on our instructions.

10. International and Cross-Border Data Processing

Technical service providers or infrastructure nodes utilized by Lienskill Limited may process data in countries outside your country of residence. Where personal data is transferred across borders, transfers are handled subject to applicable data protection law and appropriate organizational and contractual safeguards where required.

11. Data Retention Principles

Personal data is retained according to the purpose for which it was collected:

• Account Data: Retained while your account remains active and as needed afterward for legitimate or legal purposes.
• Communications & Content: Retained according to service operation, multi-device synchronization, and user actions.
• 48-Hour Status Media: Photo and text status updates automatically expire 48 hours following publication.
• Security and Access Logs: Retained for limited operational periods necessary for security monitoring and abuse prevention.
• Statutory Compliance: Information required by applicable law is retained for the legally mandated period.

12. Account Deletion and Data Removal

Zaloba is implementing automated in-app account deletion controls for its public release.

Deleting your Zaloba account terminates access to the account and initiates removal or de-identification of personal data associated with it, subject to technical, legal, safety, backup, and shared-conversation retention requirements. Content already delivered to other participants may remain in their conversation history where appropriate.

13. Technical Security Architecture

We implement organizational and technical security measures to protect communications:

• Transport Encryption: Client-server communications, signaling channels, and API requests utilize transport encryption (such as HTTPS, TLS, and WSS). Realtime media streams utilize WebRTC media encryption mechanisms.
• Session Management: Browser terminal pairing requires visual QR verification authorized from your mobile device, with instant revocation capabilities.
• Factual Framing: Zaloba protects data in transit and restricts internal database access through role-based controls. We do not make claims of end-to-end encryption (E2EE) where message payloads are held for server synchronization across devices.

14. Privacy Rights & Contact Information

Under applicable data protection legislation, you may have rights regarding your personal data, including rights of access, correction, deletion, restriction, objection, or portability.

To submit an inquiry or exercise your privacy rights, please contact our Privacy Team:

15. Child Safety & Protection

Zaloba maintains zero tolerance for child sexual abuse, exploitation, or endangerment of minors. For complete safety commitments, reporting pathways, and response procedures, review our Child Protection & Safety Policy.