Privacy Policy

Orbit Revolution of Harare, Zimbabwe, is the data controller and the operator of ZimData. This policy covers the site at zimdata.org, the accounts on it, and the files stored for those accounts.

If the GDPR applies to you, these rights sit with that controller. The same request covers the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe, including access, correction, and deletion.

Account details, when you create one:

• Email address and a password. We do not see your password in plain text.
• Optional phone number, in international format.
• Display name, username, bio, location, website, avatar URL, theme, and which emails you want.
• If you use Google or GitHub, the name, email address, and avatar those services give us. We do not ask for your contacts, private repositories, or permission to post as you.

Content you choose to put on the site: datasets, files, column notes, notebooks, comments, use-case suggestions, issues, and reports. A publisher also chooses a licence for each dataset.

Usage: pages you open in a session, stars, bookmarks, follows, and search text when you search the catalogue. Each download stores the account, the dataset, the version, the file, the time, and limited technical details used to prevent abuse.

Analytics cookies: if you choose Accept on the cookie banner, we load PostHog and Google Analytics. Those tools set their own cookies (and similar storage) to measure page views, basic product use, and signed-in account activity (user id and email as a person property). Session replay is off. Form field values are masked. Analytics stays off on Reject, when keys are missing, and on localhost or preview hosts. Separately, when you arrive from another site or a campaign link we keep that source in our own cookie and save it with your account if you sign up, so we know which places bring people to ZimData; Reject deletes it. See the Cookie Policy.

Support mail you send to hello@zimdata.org, and the takedown form if you use it (your email, the dataset URL, and the reason).

Catalogue metadata is not personal data. Source files keep their original licence terms.

We use this data to run the account, show the catalogue, deliver a file you are allowed to download, keep a count of those downloads, moderate reports, and answer you. The lawful bases, where the GDPR applies, are the contract (running the account you asked for), legitimate interests (securing the site, counting downloads, and preventing abuse), and consent where we ask for it (the analytics choice).

We do not use personal data for advertising.

These categories of providers process data for us. We do not send them a copy of the catalogue for their own marketing.

• Accounts and database (EU region): sign-in and stored account records.
• Hosting, file storage, and bot checks on forms.
• Analytics (PostHog and Google Analytics), only after you choose Accept on the cookie banner. See the Cookie Policy.
• Google and GitHub: only when you choose that button. We receive your name, email address, and avatar.
• Transactional email: verification, password reset, organisation invites, and moderation notices.
• Optional AI processing: a short snippet of dataset content for a summary and a personal-data check (see below). We do not send your account email, name, or password.
• Payment processors: only if you pay for ZimData Pro, a paid file, or Support ZimData. Cards go through a card merchant of record; EcoCash, OneMoney, and ZimSwitch go through a local payment provider.
• Optional error reporting: crash reports, with account details removed where we can.

A download is recorded when a download link is issued, not when you merely open the dataset page. You can see your own history. The publisher of that dataset can see downloads of their files. An admin can see every download.

After a file is uploaded, a background job may send a short snippet to an AI model: column names and a sample of rows, or the first part of a text file, capped in size. The model writes a plain-language summary and project ideas, and a second check looks for emails, phone numbers, and national id numbers in that snippet. The prompt does not include your account profile. If the file itself contains personal data, that text can be inside the snippet, which is why publishers are told not to upload personal data they are not allowed to share.

If that service is not connected, the page shows a heuristic insight and no model is called.

Card checkout uses a merchant of record, which receives the billing details needed to take the payment and handle tax. Local mobile money and bank options use a local payment provider with the amount, a reference, and a return URL. We store the result on our side: the account, the kind of purchase, the status, and the provider’s reference. We do not store a card number. Support ZimData helps cover running costs. It does not unlock files.

You can ask for access, correction, deletion, a copy you can take elsewhere, and, where the law gives them, restriction and objection. Settings has two controls that start this:

• Download my data exports a JSON file of the account this browser is using. File contents are listed by name, not copied into the export.
• Delete account starts deletion. The account is removed after confirmation.

Write to hello@zimdata.org if you want us to correct something Settings does not cover, or if you want to complain. You can also complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the Data Protection Authority under the Cyber and Data Protection Act [Chapter 12:07]. If the GDPR applies to you, you can complain to a supervisory authority in your country.

We keep the account while it is open. After deletion is confirmed, we delete the profile and sign-in record. Dataset files you published are unpublished or deleted with that confirmation, unless we have to keep a copy for a legal claim, a takedown dispute, or a security investigation.

Download records are kept for 24 months. Operational logs are kept for a short period to run and secure the site. They are not used to build a marketing profile. A takedown request is kept while the dispute is open and then for as long as we need to show what we decided.

ZimData is not for children under 13. We do not knowingly collect personal data from anyone under 13. If you believe an account belongs to a child under 13, write to hello@zimdata.org and we will delete it.

The operator is in Zimbabwe. Account data may be stored in the EU. Hosting, email, sign-in providers, and payment companies may process data in other countries. Where the GDPR applies, we rely on the transfer tools those providers offer, such as standard contractual clauses.

We will post a new date at the top of this page when the policy changes. The date on this version is 15 October 2026.