Privacy Policy

Last updated: 25 September 2026

Pre-launch draft · v2 · under review by Zimbabwean counsel

Famba ("we", "us") is a peer-to-peer car-rental marketplace being built for Zimbabwe. It has not launched: no real rentals take place yet, no payments are taken and no insurance cover is in force. This policy explains what information we collect today, why, and how we protect it. We've written it in plain language on purpose.

1. What we collect

Waitlist details you give us: your name, phone/WhatsApp number, email (optional), city, preferred contact channel and, for car owners, your car's make, model and year, whether it has a tracker, and what insurance it has.
Your account, if you create one: your email address, name and (optionally) phone number, and a password, which we never see in readable form. If you sign in with Google, Google shares your name and email address with us; we do not receive your Google password.
What you do in the app while signed in: messages you send to hosts or renters, preview booking requests, reviews you write, and car listings you create (the car's details, price, city and photos).
Usage information: how you arrived (campaign/UTM tags). Product analytics are kept in your own browser and are not sent to us or to anyone else.
Device storage: we use your browser's local storage to remember things like saved cars, recently viewed cars and your display currency, and to keep a copy of your data so the app works on a poor connection. Signing out clears your personal items from it.
Error reports: if something breaks, the app sends us the technical error message, the address of the page you were on, and your browser type, so we can fix it. It does not send your name, email or anything you typed.
Pick-up searches: when you type an address or place into the pick-up box, that text is sent to Photon (an OpenStreetMap address-lookup service) to turn it into a map point. If you tap "use my current location", your browser asks your permission first, and only then are your coordinates used: on your device to sort cars by distance, and sent to the same service to name the street you're on.

2. What we do NOT collect (yet)

During this pre-launch phase we do not collect payments, ID documents, driver's licences, or location tracking data. The verification screens in the app do not upload your documents: we check documents with you in person at onboarding. Your location is never stored on our servers and never tracked in the background. When the marketplace launches, verification documents and trip data will be collected under an updated version of this policy, which we'll publish before it applies.

3. How we use your information

To contact you about the launch on the channel you chose (WhatsApp, SMS or email). That's the whole point of the waitlist.
To run your account: signing you in, showing your messages and listings, and sending one welcome email when you create an account.
To understand demand (e.g. how many owners in Harare vs Victoria Falls) and plan the pilot.
To demonstrate real interest to launch partners (insurers, investors), only ever as aggregate numbers, never your personal details.
We will never sell your personal information.

4. Where your data lives

Account, waitlist and app data is stored with Supabase, in a database hosted in London, United Kingdom, with access controls that prevent public reads of personal details. The website is served by Cloudflare. Emails from us are sent through Google Workspace. The site's fonts are loaded from Google Fonts, which means your browser's IP address reaches Google when a page loads. Pick-up address lookups are handled by Photon (komoot), which receives the search text and nothing that identifies you or your account. Each of these providers processes data under its own security and privacy commitments.

5. Who else can see it

The other person in a conversation or booking: if you message a host or send a booking request, that host sees your name and what you wrote. If you are a host, renters see the name you list under.
Everyone: a car listing, once it is live, is public: its details, photos, city and the host's display name. Reviews are public and show the reviewer's name.
Nobody else. We don't share your personal data with anyone else today. At launch, limited data will be shared only as needed to run the service (e.g. identity-verification, insurance and vehicle-recovery partners), and this policy will be updated first.

6. Your choices

Delete your account or leave the waitlist: email us and we'll delete your account, your waitlist entry and what is linked to them. Messages you sent stay visible to the person you sent them to unless you ask us to remove those too.
Correct your details: edit your name and phone in your profile, or just ask.
A copy of your data: ask and we'll send you what we hold about you.
We send launch-related messages only; no spam, and any marketing will include an opt-out.

7. Contact

Questions or requests: [email protected].

8. Changes

We'll update this page as Famba moves from pre-launch to live marketplace, and material changes will be flagged clearly. Continued use after an update means you accept the revised policy.

⚠ This is a good-faith v2 drafted before launch and is being finalised with a Zimbabwean lawyer (including alignment with the Cyber and Data Protection Act). A fuller policy ships before any real bookings do.