Your information, and what we do with it.

Who we are

Zami is a social intelligence platform operated by AletSys PLC (“we”, “us”, “our”), of Addis Ababa, Ethiopia. This policy explains what we do with personal information when you use zami.et and the Zami application.

For information you give us about yourself — your account, your billing details, how you use the product — we are the data controller. For the research material you bring into the platform and the work you do with it, you are the controller and we act as your processor, handling that material on your instructions and for no purpose of our own. Section 5 sets out what that division means in practice.

If you have a question about anything here, write to us at contact@zami.et.

Information we collect

We collect four kinds of information, and we collect them for different reasons.

• Account information. Your name, email address, password (stored only as a cryptographic hash, never in a form we can read), organisation, and role. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier from Google instead — we never see your Google password, and we ask Google for nothing beyond your basic profile and email.
• What you put into the product. The questions you ask, the searches and investigations you run, the files and notes you upload, the dossiers and reports you generate, and the conversations you have with the assistant.
• Usage and technical information. Pages and features used, actions taken, timestamps, approximate location derived from your IP address, browser and device type, and error and performance logs. We use this to keep the service running and to understand which parts of it are worth improving.
• Billing information. The plan you are on and the contact and invoicing details attached to it. Card details, where they apply, are handled by our payment provider and are not stored on our systems.

How we use information

We use personal information to:

• provide the platform, and run the searches, analyses and reports you ask for;
• create and secure your account, and authenticate you when you sign in;
• respond to your support requests and tell you about changes to the service;
• bill you, and keep the accounting records the law requires us to keep;
• monitor for abuse, fraud and security incidents, and enforce our terms of service;
• diagnose faults and improve the product, using aggregated or de-identified usage data wherever that is enough to answer the question.

We do not sell personal information. We do not share it with advertisers, and we do not use the content of your research to build advertising profiles of anyone.

Our legal bases

Where data protection law requires us to name a legal basis for processing — including under the EU and UK GDPR — we rely on the following.

• Performance of a contract. Providing the platform to you, maintaining your account and billing you for it.
• Legitimate interests. Keeping the service secure and available, preventing abuse, and improving the product — weighed each time against the interests and rights of the people the data concerns.
• Legal obligation. Tax, accounting and records we are required to keep, and responses to lawful requests from authorities.
• Consent. Optional things you switch on, such as marketing email. You can withdraw consent at any time without affecting what came before it.

For the research material described in the next section, the legal basis is the customer’s to identify and record, not ours.

Information about people you research

Zami is used to research organisations, creators and individuals. That means the platform processes personal information about people who are not our users and who have not agreed to anything with us — collected from public sources such as social platforms, public websites and public records, or supplied by the customer.

Where we process that material, we do so as a processor acting for the customer who asked for it. The customer decides what is researched and why, and the customer is responsible for having a lawful basis for it, for confining the research to a legitimate purpose, and for meeting any notice obligations they owe the people concerned. Our terms of service make that a condition of using the platform, and prohibit using it to stalk, harass, profile unlawfully, or discriminate against anyone.

Information gathered from a public source is still personal information, and it still carries rights. If you believe Zami holds information about you as the subject of someone’s research, write to contact@zami.et. Because that material belongs to a customer’s workspace and we hold it on their behalf, we will ordinarily refer your request to them and support them in answering it — and we will tell you that we have done so.

How we share information

We share personal information only in these circumstances.

• Within your organisation. Workspaces are shared. Other members of your organisation can see the investigations, dossiers and files in it, according to the roles you set.
• Service providers who run the platform for us. Cloud hosting and storage, database hosting, email delivery, payment processing, and error and performance monitoring. Each is bound by contract to process data only on our instructions and to protect it.
• AI model providers. Section 7 explains what is sent and to whom.
• Legal and safety. Where we are required by law, or where disclosure is genuinely necessary to investigate abuse or protect someone’s safety. We will tell you about a request for your data unless we are legally prevented from doing so.
• Business transfers. If the business is sold or reorganised, data may transfer with it — under the terms of this policy, and we will tell you before it does.

AI and automated processing

Zami uses large language models to read source material and draft the analysis you see. To do that, the content of your prompts and the material being analysed is sent to our model provider — currently Google, through the Gemini API — which processes it to return a response and does not use it to train its models.

Model output is generated, not verified. It can be wrong, incomplete or confidently mistaken, and it should be checked against the cited sources before anyone acts on it — particularly where it concerns a named individual. We do not make decisions about you by automated means that produce legal or similarly significant effects.

Cookies and sessions

We use a small number of cookies, and all of them are necessary for the product to work:

• a session cookie that keeps you signed in, and the token behind it;
• security cookies that protect sign-in against cross-site request forgery and let us detect abuse;
• preference storage that remembers choices such as your theme and layout, held in your browser.

We do not use advertising cookies and we do not allow third-party tracking on the product. Blocking the necessary cookies will stop you from being able to sign in.

How long we keep it

We keep your account information for as long as your account is open. When you close it, we delete or anonymise your personal information within 90 days, except where we must keep something longer — invoices and tax records, for example, or material subject to a legal hold.

Research material in your workspace is kept until you delete it or close the account. Backups are retained on a rolling basis and are overwritten within 35 days, so deleted material can persist in a backup for a short period after it disappears from the product. Operational logs are kept for up to 12 months.

How we protect it

Traffic to zami.et and to our API is encrypted in transit with TLS. Passwords are stored only as salted hashes. Access to production systems is restricted to the people who need it, and workspace data is separated by organisation.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information and is likely to present a risk to you, we will notify you and the relevant supervisory authority as the law requires, and tell you what we know and what we are doing about it.

International transfers

We operate internationally and our service providers do too, so personal information may be processed outside the country where you live, including in jurisdictions whose data protection laws differ from your own. Where we transfer information out of the EEA or the UK, we rely on appropriate safeguards — ordinarily the European Commission’s Standard Contractual Clauses, together with any additional measures the transfer requires. You can ask us for the detail of a specific transfer.

Your rights

Depending on where you live, you have some or all of the following rights over your personal information:

• to know what we hold, and to get a copy of it;
• to have inaccurate information corrected;
• to have information deleted;
• to restrict or object to how we use it, including a general right to object where we rely on legitimate interests;
• to receive it in a portable, machine-readable form;
• to withdraw consent, where consent is what we relied on;
• to complain to your data protection authority.

Write to contact@zami.et and we will respond within 30 days. We will not charge you or treat you differently for exercising any of these rights. Where the information sits inside a customer’s workspace rather than in your own account, section 5 explains how we handle the request.

Children

Zami is a business tool and is not intended for children. We do not knowingly collect personal information from anyone under 18, and we do not offer accounts to them. If you believe a child has given us personal information, write to contact@zami.et and we will delete it.

Changes, and how to reach us

We update this policy when the product or the law changes. The date at the top always shows when it last changed, and if a change materially affects your rights we will tell you before it takes effect — by email, or in the product.

For anything in this policy, including a request about your own information, write to contact@zami.et, or to AletSys PLC, Addis Ababa, Ethiopia.