Flog ItPrivacy policy
Last updated 19 September 2026
1. What we collect
Account info (name, phone, email, photos), listing details, messages and call metadata, device tokens for push notifications, location when you opt in for "directions to shop", payment metadata (we never store full card numbers), and standard app diagnostics (crash logs, error reports). If you choose to verify as a seller, we collect a photo of your ID document (NRC, passport, or driver's licence) and a selfie holding it — stored encrypted and used only for verification — plus a record that the $15.99 verification fee was paid (the Google Play purchase reference and product id; we never see or store your card or Google account details, Google handles those).
2. How we use it
To run the marketplace: matching buyers and sellers, processing payments, delivering messages and calls, verifying seller identity, fraud prevention, customer support, and improving the product.
3. Legal basis
Under the Zambia Data Protection Act 2021, we process your data on the basis of: performance of our contract with you (to provide the marketplace); your consent (for optional features such as marketing, location, and identity verification); our legitimate interests (fraud prevention, security, product improvement); and legal obligations (tax records, AML checks, lawful requests).
4. Who we share with
Licensed payment processors and mobile money operators for processing transactions. Google Play Billing for the seller subscription and identity-verification-fee purchases you make in-app on Android — Google processes that payment and handles your card/Google-account details directly; we only receive a purchase token and product id to confirm it. Push notification providers for delivering alerts. Identity verification providers when you choose to verify. Cloud infrastructure providers for hosting. Our visual search feature sends photos you capture to Google's Gemini API to identify the product — those images are not stored by us beyond the request. Voice search sends your speech to your device's speech-recognition service (Google on Android, Apple on iOS) to convert it to text — we only receive the resulting text, not the audio. Authorities only when legally compelled. We do not sell your personal data.
5. International transfers
Our servers and some processors may be located outside Zambia. Where personal data is transferred internationally, we rely on standard contractual safeguards to protect it.
6. How long we keep it
For the life of your account, plus the minimum retention period required by Zambian tax and consumer protection law (typically up to 6 years for transaction records). When you delete your account, there is a 30-day grace period during which signing back in restores it in full. After that, we erase personal identifiers — including your name, contact details, profile photos, and any ID verification documents — while financial history is retained as required.
7. Your rights
You can edit your profile at any time from Settings, request a copy of your data by emailing [email protected], correct or restrict processing of your data, object to processing, and delete your account from Settings → Account (30-day grace period, then permanent). Deletion erases personal identifiers, including ID verification photos, but preserves anonymised transaction records.
8. Right to complain
If you believe we have mishandled your data, you can lodge a complaint with the Zambia Data Protection Commissioner at the office responsible for data protection.
9. Automated decision-making
We use automated systems for fraud detection, search ranking, and recommendations. These do not make legally significant decisions about you on their own; you can request a human review by contacting support.
10. Marketing
We send transactional messages (order updates, security alerts, OTP) because they are part of the service. Promotional messages are opt-in and you can unsubscribe at any time from Settings → Notifications.
11. Security
Passwords are stored using industry-standard secure hashing. Sessions are protected with cryptographically signed tokens. Personal data is encrypted at rest. We do not store full card numbers — those are held by our payment provider.
12. Cookies and tracking
The mobile app does not use third-party advertising trackers. We use the device push token strictly for delivering notifications you opted into. If we add a web version, a cookie notice will appear there.
13. Third-party links
Some screens link out to external pages (payment providers, Google sign-in, social shares). Once you leave the app, those parties' own privacy policies apply.
14. Children
Flog It is not directed at children under 18 and we do not knowingly collect their data.
15. Changes
Material changes to this policy are notified in-app. The "Last updated" date above reflects the most recent change.