Privacy Policy
Last updated 18 October 2026
Who we are
Zolo is a local directory and ordering platform in Abu Dhabi, United Arab Emirates, operated by ZOLO SOLUTIONS (commercial licence CN-6781440). This policy explains what personal data we collect, why we collect it, and the rights you have under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL"). For any privacy question or request, contact privacy@zolo.ae.
What we collect
Your phone number (used to sign in with an SMS code), your name, an optional profile picture, your saved delivery addresses and the delivery locations you choose (including your device's location while you use the app, which we use to show shops near you and to place your delivery pin; you can refuse location access and pick an area instead), your orders, enquiries and reviews, your language preference, your notification choices and the consents you give, the help requests and reports you send, and the basic device information needed to run the app and deliver status notifications.
Camera and photos
In the Zolo app, the camera is used only to scan table QR codes; nothing is recorded or stored. If you add a profile picture, the photo you pick from your library is stored with your account and is removed when you replace it or delete your account. In the Zolo Merchant app, the camera and photo library are used to photograph and upload menu and shop images.
Merchant account data
For merchant accounts we also hold the staff names and phone numbers an owner adds to their store, the business contact and WhatsApp numbers shown to customers, and, for orders in the app, the business's legal name, trade licence (with the uploaded licence) and TRN. This data is used only to operate the store account; the legal name, licence number and TRN are shown to customers once we have checked them.
How we use it
To send your orders and enquiries to the merchants you choose, to show you merchants that actually deliver to your location, to keep you updated on your order, to handle your help requests and reports, to prevent fraud and abuse, and to improve the service. We never sell your personal data and we do not use it for third-party advertising.
What the shop and its rider see
When you order in the app, the shop receives your name, the items, your delivery address and the delivery point you chose, and a button to call you; your phone number is never shown to the shop or its rider as text inside Zolo. We ask your consent to share these with the shop at your first order. When you send an enquiry on WhatsApp, you message the shop from your own WhatsApp, so the shop sees your number as it would for any WhatsApp contact.
Notifications
You choose which notifications you get, per channel (push, WhatsApp, SMS and email): order updates, reminders such as "did your order go through?", and marketing. Marketing is off on every channel until you switch it on, and each time you switch it on or off we record your consent or its withdrawal. You can change these choices at any time in the app.
Age
Zolo is for people aged 18 and over. We ask you to confirm your age when you sign up, and we do not knowingly collect personal data from anyone younger. If you believe a child has given us personal data, contact privacy@zolo.ae and we will delete it.
Help requests and reports
When you contact Help in the app, report a problem with an order, or report incorrect info on a listing (in the app or at zolo.ae/report), we keep what you write, a ticket number and, if you give them, your contact details, so we can handle it and tell you the outcome. A problem with an order goes to the shop first. The report form on zolo.ae needs no account; we keep only a scrambled form of your IP address, to limit abuse.
Where your data lives
Your account, orders, addresses and uploaded images are stored with our cloud database provider, Supabase, which also runs sign-in and file storage. It is hosted in Singapore today. Where processing happens outside the UAE, we rely on providers offering appropriate safeguards, as the PDPL permits.
Who processes data for us
Supabase (database, sign-in and file storage, hosted in Singapore). Vercel (hosts zolo.ae and app.zolo.ae and keeps short-lived request logs). Expo (delivers push notifications to your device using its push token, through Apple and Google's notification services). Message Central (sends and checks the SMS sign-in code: it receives your phone number). Google Maps (draws the map when you place your delivery pin: it sees the map area and your IP address). OpenStreetMap Nominatim (on app.zolo.ae only, turns a map pin into a street address: the coordinates of the pin are sent; the phone apps use the phone's own address lookup). Sentry (error monitoring: when the app or site hits an error it receives the error details, the device and app version and your account id, never payment details). Google Places (source of public business details such as a shop's name, address, phone and opening hours; no customer data is sent to Google). Cloudflare Turnstile (checks that a form on zolo.ae, such as a claim, takedown, listing report or privacy request, is sent by a person; it sees your IP address and browser signals). Each receives only what it needs to do that job.
Processor we will add
Before it is switched on we will name it here: a product-analytics tool (it would receive device and usage data about the app, never payment details).
Your rights
You may request a copy of your data, ask us to correct it, or object to its processing. You can delete your account at any time from Account → Privacy & my data → Delete my account in the app (an order still in progress has to be delivered or cancelled first): your profile, profile picture, addresses and phone link are erased, and past orders are kept only in anonymised form where the law requires. Merchants delete their account from Zolo Merchant → Settings → Delete account. See zolo.ae/delete-account for the full deletion steps. You may also lodge a complaint with the UAE Data Office.
Retention
We keep personal data only while your account is active, or as long as needed for the purposes above and to meet legal obligations, within these windows: a deleted address is erased after 30 days; the delivery address on a completed or cancelled order after 1 year; the text of WhatsApp enquiries and their notes after 180 days; messages in problem reports after 1 year; rider link logs after 90 days. The text of help requests is erased when you delete your account. For tax records, a record of each order and enquiry without personal details (the items, prices, delivery fee, menu version and time) is kept for 5 years. Anonymised records don't identify you and may be retained for statistics.
Changes to this policy
As Zolo evolves we will update this policy and revise the date at the top. Significant changes will be announced in the app before they take effect.
To use any of these rights, send us a request here, or email privacy@zolo.ae.