Zara AI ← Back to Zara

Zara Privacy Policy

Last updated: 2026-07-28  ·  Moove Digital (Pty) Ltd, trading as Zara AI

1. Introduction and About This Policy

This Privacy Policy explains how Zara ("Zara", "Zara AI", "we", "us" or "our") collects, uses, shares, stores and protects your personal information when you use the Zara personal AI assistant. Zara is a WhatsApp-native personal AI assistant for South Africa that you can reach over WhatsApp on the number +27 83 200 2127 and through our web application at https://zaraai.digital.

Zara is operated by MOOVE DIGITAL (PTY) LTD, a private company registered in South Africa with the Companies and Intellectual Property Commission (CIPC), trading as "Zara AI". MOOVE DIGITAL (PTY) LTD is the "responsible party" under the Protection of Personal Information Act, 2013 (POPIA) and the "data controller" under the EU General Data Protection Regulation (GDPR) for the personal information described in this Policy.

We have written this Policy to be thorough and plainly worded so that you, and where relevant a regulator, can understand exactly what happens to your information. Because Zara does not only answer questions but takes real actions on your behalf, this Policy pays particular attention to what happens to your data when Zara makes phone calls, sends messages, manages your connected accounts and builds a long-term memory of your life. Please read it carefully alongside our Terms of Service and our Cookie Policy.

If there is anything in this Policy you do not understand, or you would like a copy in another format, please contact us at privacy@zaraai.digital before you continue using the service.

2. Scope of This Policy

This Policy applies to all personal information we process when you create a Zara account, link your WhatsApp number, connect third-party services, chat with Zara by text or voice, use the web app, or allow Zara to take actions on your behalf. It applies whether you interact with Zara over WhatsApp or through the web application.

This Policy does not cover the privacy practices of third parties whose services you connect to Zara (for example Google, Meta/WhatsApp, Spotify or LinkedIn) or businesses that Zara contacts on your behalf. When Zara acts through one of those services, that third party processes your information under its own privacy policy as well. We encourage you to review the privacy policies of any service you connect.

Where we refer to "personal information" we mean personal information as defined in POPIA and personal data as defined in the GDPR — broadly, any information relating to an identifiable living person (and, under POPIA, an identifiable existing legal entity).

3. Summary — The Short Version

This summary is a quick overview only and does not replace the full Policy below. The detailed sections govern in the event of any difference.

4. The Personal Information We Collect

We collect the categories of personal information set out below. We only collect what we need to provide and improve the assistant and to carry out the actions you ask of it. The exact information collected depends on which features you use and which services you connect.

5. Sensitive Information and a Note on Categories You Control

Some of the information Zara can hold may be sensitive — for example health-related learnings in your digital twin, or personal details revealed in your messages and connected accounts. Under POPIA, certain information (such as health and religious or political beliefs) is "special personal information", and under the GDPR it is a "special category" of data that attracts extra protection.

Zara only records digital-twin learnings in a given category (such as health) where you have allowed that category. You can lock any category at any time, which stops further learning in it, and you can delete what has already been learned. Because you control which categories are active, you control whether and how this more sensitive information is collected.

Please be thoughtful about the information you choose to share with Zara or expose through connected accounts. Avoid sharing other people's sensitive information, or information you are not comfortable being processed as described in this Policy.

6. How We Collect Your Information

We collect information in three main ways: directly from you, automatically as you use the service, and from third-party services you choose to connect.

Most information comes directly from you — when you register, verify your WhatsApp number, type your suburb and city, set preferences, chat with Zara by text or voice, or approve an action. Some information is generated automatically as you use Zara, such as authentication events, sync logs and nudge delivery records, and the learnings Zara forms from your interactions. Other information reaches us from services you connect through OAuth consent, where the provider (such as Google, Meta, Spotify or LinkedIn) shares data with Zara according to the permissions you grant.

7. How and Why We Use Your Information

We use your personal information to provide the Zara assistant, to carry out the actions you authorise, to personalise the experience, to keep the service safe, and to meet our legal duties. The specific purposes are set out below.

A defining feature of Zara is that it acts on your behalf. To do this responsibly, Zara routes actions through confirmation/approval gates — for example asking you to reply "YES" or "SEND IT" before it places a call or sends a message. We use your information to prepare, present and execute those actions once you approve them.

We only process your personal information where the law allows. Under POPIA, processing must meet a lawful justification (such as consent, performance of a contract, compliance with a legal obligation, or our legitimate interests properly balanced against your rights). Under the GDPR, we rely on a corresponding lawful basis for each purpose. The main bases we rely on are set out below.

Where we rely on your consent — for example to link WhatsApp chats, to connect a third-party account via OAuth, or to enable a sensitive digital-twin category — you may withdraw that consent at any time, and we explain how in the section on your rights. Withdrawing consent does not affect processing that already happened, and may mean a feature can no longer work.

9. How Zara Uses AI — and What That Means for Your Data

Zara is powered by artificial intelligence. To understand your messages, generate replies, build your digital twin and decide how to carry out a task, relevant parts of your input and context are sent to AI providers that run large language models. These providers are Anthropic (Claude), OpenAI and Google Gemini. This means the content of your prompts, and surrounding context Zara assembles to do the job well, may be transmitted to and processed by these providers to generate a response.

The context sent to an AI provider can include the substance of your request, relevant digital-twin learnings, and information drawn from your messages or connected services where that is needed to complete the task. We aim to send only what is needed for the task at hand. We use these providers as our processors / sub-processors and rely on our agreements with them to govern how they may handle your data.

AI can make mistakes. Zara's responses and suggested actions may be inaccurate, incomplete or out of date, and Zara is not a substitute for professional legal, medical or financial advice. You remain responsible for any action you confirm and authorise Zara to take. Please review important outputs and confirmations before approving them.

10. When Zara Acts on Your Behalf — Calls and Messages

Zara is built to take real actions in the real world. When you ask it to, and after you confirm, Zara can place outbound phone calls to businesses, make bookings and appointments, draft and send WhatsApp messages, and act within your connected accounts. These actions involve processing and sometimes disclosing your information so the action can be completed.

To place a phone call or send an SMS within South Africa, Zara uses Africa's Talking. To synthesise the voice used on a call, Zara uses ElevenLabs, and for a photorealistic avatar in the web app it can use Simli. To deliver WhatsApp messages, Zara uses the Meta / WhatsApp Cloud API. To carry out an action, Zara may share the details needed for that specific task — for example your name, your booking details, the relevant phone number, or the content of a message you approved.

Actions pass through confirmation/approval gates. Zara will typically tell you what it intends to do and wait for you to reply (for example "YES" or "SEND IT") before acting. You should review what Zara proposes, because once you confirm, Zara will act, and the receiving business or contact will see the information necessary to complete the request. Calls and messages Zara makes for you may be received, recorded or logged by the other party under their own practices and applicable law.

11. Sharing Your Information and Our Sub-Processors

We do not sell your personal information. We share it only as needed to run the service, carry out the actions you authorise, comply with the law, or protect rights and safety. The third parties below act as our operators (under POPIA) / processors and sub-processors (under the GDPR), processing your information on our instructions under contract.

Beyond the processors listed, we may disclose information to a connected service when you direct Zara to act there (for example sending an email through Gmail), to a business or contact when Zara completes an action for you, to professional advisers, to authorities or other parties where required by law or legal process, and to a successor entity in connection with a merger, acquisition or reorganisation (subject to this Policy).

12. International Data Transfers

Our servers are hosted in the European Union (Hetzner Cloud, in Germany), so your account and stored data are primarily held in the EU. Because the EU benefits from strong data-protection law, this also supports protection for South African users' information.

Some of the processors we use to run the assistant operate, or process data, in other countries — for example AI providers and certain platform and communications providers. As a result, transmitting your information to deliver the service may involve a transfer of personal information across borders, including outside South Africa and outside the EU/EEA.

When we transfer personal information internationally, we take steps to ensure it remains protected. Under POPIA, we rely on lawful grounds for trans-border information flows, such as your consent, the necessity of the transfer to perform our contract with you, or contractual safeguards requiring an adequate level of protection. Under the GDPR, where we transfer data outside the EU/EEA we rely on an appropriate transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with any additional measures needed.

13. How Long We Keep Your Information

We keep personal information only as long as we need it for the purposes described in this Policy, or as required by law. In general, we keep your information for as long as your account is active, and you can delete most of it yourself at any time. The specific retention periods are set out below.

When you delete data, lock a digital-twin category, disconnect a service, or delete your account, we act on that request. For operational and security reasons, some information persists for a limited period after deletion, as described below, before it is fully removed.

14. How We Protect Your Information

We take the security of your information seriously and apply technical and organisational measures designed to protect it against loss, misuse and unauthorised access. No system can be guaranteed completely secure, but the measures below are central to how we protect your data.

If a security compromise affecting your personal information occurs, we will respond in line with our legal obligations, which under POPIA can include notifying the Information Regulator and affected users where required.

15. Your Privacy Rights and How to Exercise Them

You have rights over your personal information under POPIA and, where it applies, the GDPR. We have built controls into Zara so you can exercise many of these rights directly, and you can always contact us for help. We will respond to verified requests within the timeframes required by applicable law and will not charge a fee except where the law allows (for example for excessive or repetitive requests — [any fee — to be inserted]).

To make a request, or if you are unhappy with how we handle your information, email privacy@zaraai.digital. We may need to verify your identity before acting. If you are an EU/EEA data subject, additional GDPR rights apply as noted below.

16. The Digital Twin, Profiling and Automated Decisions

Zara builds a persistent "digital twin" — a life graph that remembers context about you over time, such as your routines, goals, relationships, career and (where you allow it) health, along with timeline events and channel metadata. This profiling lets Zara personalise its help, anticipate your needs, and act more usefully on your behalf.

Zara also uses automated processing to decide what to suggest, which proactive nudges to send, and how to prepare an action. Importantly, actions that affect the outside world — such as calls, bookings and messages — are placed behind confirmation/approval gates, so a human (you) approves them before they happen. This keeps you in control of consequential decisions.

You have meaningful control over profiling. You can lock any digital-twin category to stop further learning in it, delete learnings already held, opt out of proactive nudges, export your twin, and disconnect services or delete your account. Where the GDPR applies, you have rights in relation to decisions based solely on automated processing that produce legal or similarly significant effects, including the right to obtain human intervention — and Zara's confirmation gates are designed to keep a human in the loop for such actions.

17. How to Delete Your Account and Data

You can delete your information in stages or all at once. To remove specific content, delete individual chats and digital-twin learnings, or lock categories to stop further learning. To stop a connected service from sharing data, disconnect it — this revokes the stored OAuth tokens. To remove everything, delete your account.

When you delete your account, we remove your personal information from active systems, subject to the limited retention described in this Policy: encrypted backups may persist for up to 30 days before removal, and authentication logs may be retained for up to 24 months for security and fraud-prevention purposes. If you need help, contact privacy@zaraai.digital.

18. Children's Privacy

Zara is intended for adults and is not directed at children. We do not knowingly collect personal information from children without the consent of a competent person (such as a parent or guardian) where the law requires it. Under POPIA, the personal information of children is treated as a special category requiring additional protection.

If you are a parent or guardian and believe a child has provided us with personal information without appropriate consent, please contact us at privacy@zaraai.digital and we will take appropriate steps to delete it.

Minimum age to use Zara: 18 years.

19. Cookies and Similar Technologies

Our web app at https://zaraai.digital uses cookies and similar technologies to keep you signed in, remember your preferences, keep the service secure, and help us understand how it is used. Some of these are necessary for the app to work, while others are optional.

For full details of the cookies and similar technologies we use, their purposes and durations, and how to manage your choices, please see our separate Cookie Policy. You can also control cookies through your browser settings.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our service, the third parties we use, or the law. When we make changes, we will update the date below and, where the changes are significant, we will take reasonable steps to let you know — for example by a notice in the app or a message over WhatsApp.

Your continued use of Zara after an updated Policy takes effect means you accept the updated Policy, so we encourage you to review it periodically.

21. Contact Us and the Information Officer

If you have any questions about this Policy, want to exercise your rights, or wish to make a complaint about how we handle your personal information, please contact us. We will do our best to resolve any concern directly.

MOOVE DIGITAL (PTY) LTD has designated an Information Officer responsible for compliance with POPIA, as required by the Act. Privacy and data requests should be sent to privacy@zaraai.digital, and you can reach general support at support@zaraai.digital and partnership enquiries at partnerships@zaraai.digital.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator (South Africa). EU/EEA data subjects may also complain to their local data-protection supervisory authority.

Questions about this policy? Email privacy@zaraai.digital — we respond within 2 business days.