Privacy Policy

Testing and availability. Zavobank is being developed and tested. Some screens show example balances, accounts, cards, recipients and transactions. Example data is not a real financial account. Access to a test does not open a regulated payment account, issue a card or guarantee eligibility for future services. Do not submit real identity documents or financial details when testing demonstration features. Future regulated services will require separate availability, provider disclosures and applicable terms before activation.

1. Who to contact

Zavobank is responsible for the website and application information it processes for its own platform, testing and support purposes. For privacy questions, access requests, corrections, deletion or complaints, contact [email protected]. Please identify the Zavobank service concerned and the email or other identifier you used. Do not send passwords, one-time codes, full payment-card details or copies of identity documents in ordinary email.

2. Information we process

The information involved depends on which features are enabled and which you choose to use. A screen or an installed software library alone does not mean that all of the information below is collected.

• Contact and access requests: your name, email address, request details and correspondence when you ask for access, report a problem or contact support. Website access requests are delivered to our support/onboarding team by email.
• Authentication and profile information: identifiers such as name, email address, phone number and account ID, and authentication information when an enabled sign-in or registration flow is used. If you choose Google or Apple sign-in, the provider may supply identity and authorisation information, including your account identifier, name and email. The provider also processes information under its own privacy notice.
• Technical and security information: IP address, request time, browser or device characteristics, operating-system and app information, session identifiers, authentication events, errors and technical logs needed to deliver and protect the platform. Infrastructure providers process request metadata when serving the site or APIs.
• Feature inputs: information entered into enabled forms, such as recipient details, payment references, amounts and currencies. In local demonstration flows, example account and transaction information is simulated. Where a connected feature sends an input to a server, that input is processed to provide the requested feature. Do not use a demonstration screen to send real money.
• Identity verification, only where enabled and expressly started: an identity-verification flow may process identity and contact details, identity-document information and images, photographs, video or audio, liveness/facial verification information and device or risk signals. The integrated verification provider is Sumsub. Its privacy information and the feature's disclosures apply when you enter that flow. Live Sumsub verification is disabled in the app's demo mode. Device biometric unlocking is different from remote identity/liveness verification.
• Notifications, where configured and enabled: device or installation identifiers, push tokens, permission status and notification-delivery information to send requested service/security messages. The app includes Firebase Cloud Messaging integration; functionality depends on configuration and your device permissions.

3. Device permissions and local storage

• Camera: used for a QR scanner or an enabled identity-verification/document capture flow when you invoke that feature and grant access. A QR login request is used to identify the session you choose to review.
• Microphone: may be requested by an enabled verification flow for audio/video capture. We do not use it for advertising or background listening.
• Location: the Android app declares coarse and fine location permissions for supported verification/risk-check functionality. Declaring a permission is not the same as collecting location. If an enabled feature requests location, review its explanation and your device's permission prompt before granting it.
• Biometric unlock: your device's authentication service performs local fingerprint/face authentication. Zavobank receives its authentication result, not your device's fingerprint or face template. This does not describe photographs or liveness data voluntarily supplied to an identity-verification provider.
• Local storage: the app uses secure storage for session/authentication information and stores settings needed for the interface. The website uses essential session cookies for protected sign-in. Signing out clears app-held session information; your device may retain other settings until you clear app data or uninstall.

You can manage or revoke permissions in your device or browser settings. Declining an optional permission may prevent its associated feature from working.

4. Why we use information and legal grounds

We use information to provide requested access and functionality, authenticate users, respond to support and privacy requests, operate tests, diagnose faults, prevent fraud or abuse and comply with legal obligations. Where European data-protection law applies, our grounds are taking steps at your request or performing an applicable agreement, legitimate interests in operating and securing the platform and supporting testers, legal obligations, and consent for optional processing where required. Device permission is not by itself consent to unrelated processing. You may withdraw consent for consent-based processing without affecting prior lawful processing. We do not use this policy as blanket permission to activate future financial or biometric services.

5. Recipients and service providers

Information is made available to personnel who need it and providers supporting the enabled service: Cloudflare for website hosting, delivery and security; Mailgun and our email providers for access-request delivery and correspondence; Google or Apple when you choose their sign-in; Firebase/Google for enabled push notifications; and Sumsub for an enabled verification flow. Each receives the information needed for its role. Relevant provider notices include Cloudflare, Mailgun, Google, Apple and Sumsub.

We may disclose information when required by law or a valid legal request, to protect rights and security, or to professional advisers under confidentiality. We do not sell personal data. Testing participation alone does not authorise sharing your identity or financial information with a future banking provider. Before activating a regulated-provider integration, we will identify that provider and explain the data flow and respective responsibilities.

6. International processing

Our hosting, email, identity and device-platform providers may process information in countries other than where you live. Where the law requires safeguards for an international transfer, we use the applicable adequacy framework, standard contractual clauses or another lawful transfer mechanism. Contact us to request information about safeguards relevant to your data.

7. Security

We use HTTPS for the website and configured production API communications, protected session handling, device secure storage and access controls appropriate to the information processed. Security also depends on your device, enabled integrations and service providers. No system is completely secure. Never share a sign-in password or one-time code with testers or support. Testers should use dedicated test credentials and synthetic information.

8. Retention and deletion

We retain server-held information only as long as reasonably necessary for the purpose for which it was collected, including resolving support requests, running the test, maintaining security, complying with law and handling disputes. Access-request and support correspondence can remain in our email system until it is no longer needed. Local demo information is not a regulated financial record. Where retention is legally required, we retain only the necessary information and restrict its use; we will explain any relevant exception when responding to a deletion request.

To request deletion of your Zavobank account, access request or associated personal data, use our account and data deletion page or email [email protected] with the subject “Zavobank account and data deletion”. You do not need the app installed to make a request. We may ask for proportionate proof of control of the account, without asking for your password or a one-time code. Uninstalling the app does not by itself request deletion of server-held records. Local-only demo data may also be removed by clearing app storage or uninstalling.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may withdraw consent and contact a supervisory authority, including the authority in your place of residence, work or the alleged infringement. We respond within the period required by applicable law, normally one month for GDPR requests, and explain any permitted extension or exception. Contact [email protected] to exercise these rights.

10. Adults and advertising

Zavobank is intended for adults aged 18 and over and is not directed to children. Please contact us if you believe a child has supplied personal information. The current app does not include third-party advertising SDKs or behavioural advertising. We do not use identity-verification data for advertising. Any future change to these practices will require updated disclosures and any required choices before it takes effect.

11. Updates

We will update this policy when our practices change and revise its effective date. Significant changes, including activation of regulated financial services, will be explained through the relevant service before the changed processing begins where required. This notice does not confirm a banking licence, provider approval or availability of financial products.