Privacy notice
In short. Ziara holds the travel records your organisation needs: requests, approvals, check-ins, expenses and back-to-office reports. Your organisation decides who uses Ziara and what it keeps. We do not sell personal data, show advertising or use tracking for analytics. Voice is turned into text on your phone; we receive only the text you confirm.
Who we are
Ziara is provided by Gigapp Technologies Ltd, a company in Kenya ("we", "us"). This notice explains how personal data is handled in the Ziara app for Android, the Ziara web app and this website, under the Kenya Data Protection Act, 2019.
When your employer or another organisation uses Ziara, that organisation is the data controller for its staff's travel records: it decides who has an account, which rules apply and how long records are kept. We act as its data processor and handle the data only on its instructions and under our agreement with it. For this website and for enquiries sent to us, we are the controller.
What Ziara holds
| Data | Where it comes from | Why |
|---|---|---|
| Your name, work email, staff number, job title, unit, role and supervisor | Your organisation | To sign you in and route requests to the right approver |
| Travel requests: destination, dates, purpose, people travelling, budget line, estimated cost, approvals and their notes | You and your colleagues | The travel workflow your organisation runs in Ziara |
| Check-ins, expenses (amount, category, description) and back-to-office reports with findings, recommendations and actions | You | Records your organisation must keep for each trip |
| Bookings the travel desk records: tickets, hotels, vehicles, references and costs | Your organisation's travel desk | Arranging the trip |
| Sign-in details: one-time codes (valid for 10 minutes), signed-in devices (device name, platform, last used) and an activity log of changes | Created as you use Ziara | Security, and so every change has a receipt your organisation can audit |
| Feedback and account-deletion requests you send from the app | You | To answer and act on them |
Ziara does not collect your location, contacts, advertising identifier or browsing history, and does not include advertising or analytics trackers.
Your microphone
The microphone is used only while you tap it to record a check-in, an expense or a report. Your phone's speech service turns speech into text (on Android, Google's speech recognition; offline, the recognition built into the phone where it has one). You see and can correct the text before anything is saved. A recording made without a connection stays on your phone until it can be turned into text. The Ziara service receives the text you confirm, not the audio.
Your camera and photos
The camera and photo picker are used only when you choose to photograph or pick a receipt. If you ask Ziara to read the receipt, the photo is sent to our service, read once to fill in the amount and details, and not stored. Only the expense you confirm is saved.
The Ziara assistant
When you ask Ziara to plan a trip, read a receipt or draft a report, the relevant text (and the receipt photo, if you asked for one to be read) is sent to Anthropic's Claude service to prepare a suggestion. Nothing it prepares is saved until you confirm it. Under Anthropic's commercial terms, this data is not used to train its models. Your organisation can switch the assistant off.
Who else handles the data
We use these service providers, each bound by contract to protect the data and use it only to provide their service to us:
| Provider | What it does | Where |
|---|---|---|
| Render | Runs the Ziara service and web app | Frankfurt, Germany |
| Neon | Database | Frankfurt, Germany |
| Anthropic | The Ziara assistant (Claude) | United States |
| Resend | Sends sign-in codes and reminders by email | United States |
| Speech-to-text on Android phones; distribution through Google Play | Global |
Because some providers are outside Kenya, personal data is transferred abroad. We do this with the safeguards the Data Protection Act requires, including contracts that protect the data, and your organisation can ask us for details. Records are shared inside your organisation according to its roles and rules (for example with your approver, finance and the travel desk), and with authorities only where the law requires it.
How long it is kept
Travel records are kept for as long as your organisation's financial and audit rules require, and are then deleted or returned to the organisation. One-time sign-in codes expire after 10 minutes. Signed-in devices are kept until you sign out or the organisation removes your access. When an organisation stops using Ziara, its data is returned to it or deleted, as agreed with it.
Keeping it safe
Data travels over encrypted connections (HTTPS) and is encrypted at rest by our providers. On your phone, the sign-in token is kept in the phone's secure storage. Every request is checked against your role, and every change is recorded with who made it. Only the people who need to see a record can see it: a back-to-office report, for example, stays private to you until you submit it.
Your rights
Under the Data Protection Act you can ask to be told what data is held about you, to have it corrected, to have it deleted, to object to its processing and to receive a copy. Because your organisation controls its records, the quickest route is usually your organisation's Ziara administrator; you can also write to us and we will pass the request on and help. To delete your account, see Delete your account.
If you are not satisfied with how a request was handled, you can complain to the Office of the Data Protection Commissioner.
Children
Ziara is a workplace tool for adults. It is not meant for anyone under 18.
Changes and contact
When this notice changes, the new version is published here with a new date. Questions about privacy: gigapptechnologies@gmail.com, Gigapp Technologies Ltd, Kenya.