Privacy Policy
How we collect, use, and protect your information
Introduction
BirthMemo ("we," "our," or "us") is a birthday reminder application operated in Harare, Zimbabwe. We are committed to protecting your personal information in accordance with the Data Protection Act [Chapter 3:33] (No. 24 of 2023), the Constitution of Zimbabwe (Section 57, right to privacy), and any regulations issued by the Data Protection Authority of Zimbabwe and the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ).
This Privacy Policy explains what data we collect, why we collect it, how we store and protect it, and the rights you have as a data subject. By using BirthMemo, you consent to the practices described in this policy.
Data Controller
The data controller responsible for your personal information is:
- Name: Birthmemo
- Jurisdiction: Republic of Zimbabwe
- Email: privacy@birthmemo.app
- Security concerns: security@birthmemo.app
Personal Data We Collect
Account Information
- Full name
- Email address (used for login and account identification)
- Phone number
- Password (stored as a secure hash, never in plain text)
Profile Information
- Country preference
- Preferred message tone
- Profile picture (compressed before upload)
Birthday Information
- Names of people whose birthdays you track
- Birth dates
- Relationship type (e.g., friend, family, colleague)
- Message tone preference
- WhatsApp phone numbers (for message sharing)
- AI-generated and saved birthday messages
Usage Data
- Total number of birthdays saved
- Basic device and browser information (for service delivery)
Lawful Basis for Processing
Under the Data Protection Act [Chapter 3:33], we process your data on the following lawful bases:
- Consent: You provide your data voluntarily when you create an account and add birthdays. You may withdraw consent at any time by deleting your account.
- Contractual necessity: Processing is necessary to provide the service you have requested (birthday reminders, AI message generation, and message delivery).
- Legitimate interest: We may process limited data for service improvement, fraud prevention, and security monitoring.
Data Storage and Security
BirthMemo uses Supabase as its cloud database provider. Your account information, birthdays, messages, and profile data are stored on Supabase's cloud infrastructure.
- Data is stored in Supabase-managed PostgreSQL databases
- All data is encrypted at rest and in transit
- Supabase infrastructure is hosted on AWS in secure data centres
- Row Level Security (RLS) ensures you can only access your own data
Local caching: The app also caches some data locally in your browser for offline access and faster performance. This cached data mirrors what is stored in the cloud and is cleared when you log out.
Cross-Border Data Transfers
Your data may be processed on servers located outside Zimbabwe (Supabase/AWS operates global infrastructure). Under the Data Protection Act [Chapter 3:33] and the Cyber and Data Protection (Transfer of Personal Information) Rules, we ensure that:
- Data is transferred only to jurisdictions with adequate data protection laws, or subject to appropriate safeguards (e.g., standard contractual clauses)
- The transfer is necessary for the performance of the contract between you and BirthMemo
- You have given explicit consent to the transfer
AI Message Processing
BirthMemo uses Google Gemini AI to generate personalised birthday messages. When you request AI-generated messages:
- Your request is sent to our secure server endpoint first
- Our server forwards only the necessary details (name, relationship, tone, interests) to Google Gemini
- The Gemini API key is kept securely on our server and is never exposed to your browser
- Google processes the request and returns three unique messages
- The message you select is saved to your account
- Your data is not used by Google to train AI models
Rate limiting: AI generation is limited to five requests per minute per user to prevent abuse.
By using AI message generation, you also agree to Google's terms of service and privacy policy for the Gemini API. See policies.google.com/privacy
WhatsApp Integration
BirthMemo helps you send birthday messages via WhatsApp:
- We use the official wa.me deep link format to open WhatsApp
- Messages are pre-filled but NOT automatically sent
- You must manually tap "Send" in WhatsApp to deliver the message
- BirthMemo does not have access to your WhatsApp account, contacts, or message history
- Phone numbers stored in your account are never shared with third parties
Cookies and Local Storage
Cookies: BirthMemo does not use tracking cookies or third-party analytics trackers. We use essential browser storage for authentication sessions and app functionality only.
Progressive Web App (PWA): When installed as a PWA:
- The app caches static assets (HTML, CSS, JavaScript) for offline use
- Page content is fetched from the network first, with cached fallbacks when offline
- API requests are never cached and always go to the server
- When a new version is deployed, a banner will prompt you to reload
- Old caches are automatically cleaned up on update
Offline and Online Functionality
BirthMemo is primarily an online application. Your birthday data, messages, and profile are stored in the cloud and require an internet connection to access.
What requires internet:
- Signing in and accessing your account
- Viewing, adding, editing, or deleting birthdays
- Generating AI birthday messages
- Sending messages via WhatsApp
- Updating your profile
What works offline: If you have installed BirthMemo as a PWA, the app shell (interface) may load from cache, but you will not be able to view or modify your data until you reconnect.
Data Retention
We retain your personal data for as long as your account is active. When you delete your account, all personal data is permanently removed from our servers within 30 days. Data stored in automated backups is purged within 90 days.
AI-generated messages that you have saved are retained until you delete them or your account. Messages that were not saved are not retained on our servers.
Your Rights Under Zimbabwean Law
Under the Data Protection Act [Chapter 3:33] and Section 57 of the Constitution of Zimbabwe, you have the following rights:
- Right of access: View all your data within the app at any time
- Right to rectification: Modify any birthday, profile, or message information
- Right to erasure: Remove individual birthdays, messages, or request full deletion of your account and all associated data
- Right to data portability: Request an export of your data in a machine-readable format
- Right to withdraw consent: Stop using the service and request deletion of your data at any time
- Right to object: Object to processing of your data for purposes beyond those described in this policy
To exercise any of these rights, email us at privacy@birthmemo.app. We will respond within 30 days as required by law.
Complaints: If you are not satisfied with our response, you may lodge a complaint with the Data Protection Authority of Zimbabwe in accordance with the Data Protection Act [Chapter 3:33].
Children and Age Requirements
BirthMemo is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@birthmemo.app and we will promptly delete that information.
Contact Us
If you have any questions about this Privacy Policy, our data practices, or wish to exercise your data rights, please contact us:
- Email: privacy@birthmemo.app
- Security issues: security@birthmemo.app
We are committed to handling your data in accordance with the Data Protection Act [Chapter 3:33] and all applicable Zimbabwean data protection laws and regulations.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of BirthMemo after any changes constitutes your acceptance of the updated policy.