ZEBEST BUSINESS Privacy Policy

App & WebZEBEST BUSINESS is part of the Zebest platform. This policy applies to the ZEBEST BUSINESS Android app, related web interfaces and supporting services.

1. Data we may collect

Account and business identity

• Name, phone number, email where provided, business name, branches, role and profile information.
• Authentication/security information needed to protect access, such as credential hashes, sessions, device/session identifiers, security events and audit logs. Never send support your PIN, password or one-time code.

Business and operational records

• Sales, purchases, expenses, income, inventory, products/services, invoices, receipts, customers, suppliers, branches, approvals and reports.
• Financial and transaction information users enter or the service generates, such as amounts, references, payment method/status and accounting records where applicable.

Workforce, attendance and industry records

• Staff assignments, responsibilities, attendance, schedules, work reports, payroll-related records, requests and management decisions where those features are enabled.
• Depending on the industry/features used, an authorized business may enter information about customers, employees, students, patients, suppliers or other people needed for that business workflow. The Business Owner and authorized users are responsible for having an appropriate basis to enter and use that data.

Location, geofence and device proof

When attendance, geofencing or field-work features are used, ZEBEST BUSINESS may process precise device location, accuracy, geofence result, installation/device proof and related anti-abuse signals needed to validate the work event and preserve its audit evidence.

Files, support and technical data

We may process receipts, photos, documents, attachments, support messages, notification tokens, device/app version, IP/network metadata, timestamps, error information and security logs needed for the feature being used and for service protection.

2. How we use data

• To create and manage accounts, businesses, branches and staff access.
• To provide sales, inventory, customer/supplier, reporting, workforce, attendance, payroll, accounting and industry workflows that the business enables.
• To authenticate users, enforce roles/permissions, validate attendance/location events, prevent abuse/fraud and investigate security events.
• To create reports, receipts and summaries from data entered by authorized users.
• To provide support, notifications, reliability and troubleshooting.
• To meet applicable accounting, security, fraud-prevention, legal, regulatory and audit obligations.

3. Sharing and access

We do not sell personal data. Data may be processed by infrastructure, authentication, database/storage, notifications, communications, maps/location, security or payment providers where the relevant feature requires them. Authorized members of the same business may access records according to their role and permissions. Disclosure may also occur where lawfully required by regulators, courts or public authorities.

4. Business administrators and staff

A Root Owner or other authorized administrator may create, manage or remove staff access and may view business/work records allowed by that member's role. Removing staff access is different from deleting the business. Historical payroll, attendance, transaction or audit records may remain as legitimate records of the business.

5. Security

ZEBEST BUSINESS uses authentication, credential hashing, session controls, role/tenant/branch permissions, audit logging and controlled administrative access. No digital system can guarantee absolute security; users should protect their phone, PIN/password and account access.

6. Retention

Account and security data is retained while needed to operate and protect access. Business records may be retained for continuity, accounting, audit, fraud prevention, dispute handling or legal/regulatory obligations. Data that no longer needs to remain identifiable may be deleted, minimized or anonymized where appropriate.

7. Account, business and data deletion

The Root Owner can start the canonical ZEBEST BUSINESS deletion flow in the app or on the authenticated web interface. An Owner-requested deletion is scheduled 30 days ahead, not finalized immediately. Business sessions/access are revoked when the request is made, and the Owner can sign in and cancel/recover the account before the deletion date.

Before requesting deletion, the Root Owner can export business data from the Business Data area. At finalization, operational access/credentials are closed while immutable financial, legal and audit evidence that must be retained is not cascade-deleted.

Open ZEBEST BUSINESS Account & Data Deletion

8. Your choices

You may manage Android permissions through device settings, correct supported profile/business information in ZEBEST BUSINESS, request deletion through the deletion controls, and use Help/Support for privacy, access or correction questions. Features that require specific data, such as location-validated attendance, cannot operate without that data.

9. Children and third-party records

ZEBEST BUSINESS is designed for business/workplace use. Some industry workflows can contain records about children or patients when an authorized school/daycare or healthcare business uses those features. Those records are business-controlled operational data; the business is responsible for using them only with the authority and safeguards applicable to that context.

10. International processing

Service providers may process data in countries or regions where they operate. We use reasonable safeguards appropriate to the data and service involved.

11. Changes to this policy

We may update this policy when ZEBEST BUSINESS features, providers or legal requirements change. The effective date above will be updated when the policy materially changes.

12. Privacy contact