Privacy policy

Last updated: 20 September 2026

Zemenay is run by Gafat Technologies PLC in Ethiopia. This page says what we hold about you, why we hold it, and how to get rid of it. It covers the website at zemenay.et, the Telegram Mini App, and the Android app com.gafattechnologies.zemenay.

Privacy questions go to [email protected], or by post to Addis Ababa, Ethiopia.

What we hold, and why

• Your phone number, in international form. You type it to sign in and again at checkout. There is no username and no password — the number is the account, and it is what the courier rings.
• Your name and delivery address, from checkout. We print the parcel label from them.
• An email address, for designers only, set at sign-up. It signs you in and verifies the account.
• Your orders. We need them to fulfil, to support and to account for what you bought.
• Images you upload in the design editor. They are printed, and they become public when you publish a design.
• The payment receipt you photograph in your banking app. We read the transaction reference and the amount off it to confirm your transfer.
• A notification token, if you allow notifications in the app. It carries order updates and nothing else.
• Product analytics events and a device identifier, collected automatically in the app and on the web.
• Crash and diagnostic logs, collected automatically, so we can fix faults.

The camera and your photo library are reached only when you tap to add an image. Nothing happens in the background, and the app takes a photo only on a tap.

We do not collect your location, your contacts, your SMS or your call log, and we never handle a card or bank credential — you pay inside your own banking app, so a card number never reaches us.

Your phone number

Your phone number is your login. We send a six-digit code to it by SMS. The code is stored only as a hash, it expires within minutes, and the number itself is masked everywhere it appears in our logs.

Who else sees it

• Google Firebase Cloud Messaging delivers push notifications. It receives the device token and the text of the notification.
• PostHog, hosted in the EU, receives product analytics events and an account identifier — never your phone number or your address.
• Sentry receives crash reports and an account identifier.
• Our hosting provider stores the data.
• Printing partners and delivery couriers receive the recipient's name, phone number and address for the parcel they are handling, and nothing more.

We do not sell personal data.

If you are a designer

Your shop name, display name and published artwork are public. Your payout bank details are not. Everything you upload is screened automatically before it can go live, and a person may review it as well.

How long we keep it

• Order and payment records stay for as long as tax law requires us to keep accounts.
• Analytics and crash data stay until the provider's own retention limit expires.
• Notification tokens go when you sign out or turn notifications off, and are dropped automatically once a device stops accepting them.

Deleting your account

You can delete your account yourself, from Account in the app or at zemenay.et/account/delete. Deleting erases your phone number, and the name and delivery address on every past order. Every notification token is dropped and every session is signed out.

Your orders, payments and — if you are a designer — royalty records stay, with your personal details taken out of them. They are accounting records and we are required to keep them. We would rather say that plainly than promise an erasure we cannot carry out. A designer's request goes to a person first, because published artwork may be on sale and royalties may still be owed.

Security

Everything travels over HTTPS. Designer passwords are hashed with argon2id. Sessions are held on our server and can be revoked at any moment. Phone numbers and addresses are masked in our logs, and staff access to them is recorded.

Children

Zemenay is not meant for children and we do not knowingly collect anything about them.

Where the data is stored

Your data is held on our hosting provider's servers in Germany. The services named above process some of it outside Ethiopia.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to [email protected] from the phone number or email address on the account. Deleting is also self-service — see above.

Changes

Any change is published on this page with a new “Last updated” date. If a change matters to you, we will say so in the app as well.