Data Protection
Last updated: 17 October 2026
This page summarises how Zest Snap protects personal information under South Africa’s Protection of Personal Information Act (POPIA), the EU and UK General Data Protection Regulation (GDPR) and similar laws. Our full Privacy Policy has the details.
Who is responsible
Zest Snap is developed and operated by Stability Group (Pty) Ltd, a company registered in South Africa under registration number 2018/605063/07. Stability Group (Pty) Ltd is the responsible party (controller) for personal information processed through Zest Snap. Our Information Officer can be reached at privacy@zestsnap.app.
Our principles
- Minimal: we collect only what’s needed to provide Zest Snap and keep it secure.
- Purpose-limited: your scans, plans and messages are used to provide the service to you, not for advertising, and not to train AI models.
- No selling: we don’t sell or rent personal information.
- Your control: you choose how long scans are kept, can export your data, and can delete your account at any time.
- Review first: AI suggestions are never saved until you confirm them.
Where your data is stored and who processes it
Your account and content are stored in our database in the European Union. We use carefully chosen service providers (operators / processors) that process data only on our instructions and under contracts that require appropriate security. Some are outside South Africa and the EU; where data is transferred, we rely on the safeguards those laws require, such as contractual protections (POPIA section 72; GDPR standard contractual clauses).
How we keep it secure
- Encryption in transit (HTTPS/TLS) everywhere and encryption at rest by our hosting providers.
- Database row-level security: each account can reach only its own records; shared plans only their members.
- Private file storage with links that expire after one hour.
- Payments are handled by Apple and Google in the apps; we never see or store card numbers.
- Secrets are kept in our hosting provider’s encrypted settings, never in the app.
- Staff access to production data is limited to people who need it, and admin actions are logged.
- Abuse protection uses hashed identifiers rather than raw device or network addresses.
How long we keep it
- Scans: 30 days on the Free plan; on Pro, as long as you choose in Settings (30 days, 90 days by default, 1 year, or until deleted).
- Planner, reminders, shared plans: until you or the plan owner delete them, or you delete your account.
- Temporary scan results and guest network identifiers: about 2 days.
- Payment records: up to 5 years after the payment, as tax and accounting law requires.
- Support attachments: a year after the conversation is closed, or until you delete your account.
- Offline Planner changes on a device after sign-out: up to 30 days.
- After account deletion: see Delete your account.
Your rights
You can ask to access, correct, delete, restrict or object to the processing of your personal information, ask for a portable copy, and withdraw consent (for example to Tips and offers) at any time. Many of these you can do yourself in Settings. For anything else, email privacy@zestsnap.app from your account email; we reply within 30 days.
You can complain to the Information Regulator (South Africa) or to the data protection authority where you live, but please contact us first so we can try to help.
Security incidents
If a security breach is likely to affect your personal information, we’ll notify you and the relevant regulator as quickly as the law requires, explain what happened and what you can do.