Privacy Policy

This Privacy Policy explains how Dimetech Group Ltd ("Dimetech", "we", "us" or "our") collects, uses, shares and protects personal data when you use the ZetuXP mobile application, our websites at zetuxp.com and app.zetuxp.com, and the related services we provide (together, the "Service").

ZetuXP is a short-form drama streaming service. You create an account, buy coins, and spend those coins to unlock episodes. This policy covers the data we need to make that work.

For the purposes of the Kenyan Data Protection Act, 2019, Dimetech Group Ltd is the data controller. Where the EU or UK General Data Protection Regulation ("GDPR") applies to you, Dimetech Group Ltd is the controller for the same processing.

1. Data we collect

Account data

When you register we collect your email address and a password. Passwords are never stored in readable form — we keep only a one-way bcrypt hash. You may optionally add a display name, first name and last name. We also store your language preference and time zone so the app shows dates and content correctly.

Purchase and transaction data

When you buy a coin bundle we store the amount paid, the number of coins granted, the transaction status, the payment reference issued by our payment processor, and your resulting coin balance. Payments are processed by Paystack. Card numbers, mobile money PINs and other payment credentials are collected and handled by Paystack directly — we never see or store them.

App activity

We collect information about how you use the Service: the series and episodes you open and unlock, searches you run in the app, coin spending and top-up history, and the sign-up source that referred you to us (for example an advertising or referral campaign identifier).

Support and feedback

If you send feedback or a support request through the app or by email, we keep the title, message and any details you choose to include, linked to your account so we can reply and follow up.

Technical and diagnostic data

Our servers and our video delivery provider automatically log technical information when you use the Service: IP address, approximate location derived from that IP address (country or city level, never precise GPS), device and operating system type, app version, request timestamps, referring pages, and error or crash diagnostics. We use this to keep the Service running, to measure playback quality and to detect abuse.

We do not collect precise device location, your contacts, your photos, your calendar, your microphone or camera input, your call or SMS logs, or health data.

2. How we use your data

• To create and secure your account and sign you in.
• To deliver the Service: streaming episodes, tracking your coin balance, and unlocking the content you paid for.
• To process coin purchases, confirm payments and keep transaction records.
• To send service emails you need — account confirmation, password and email-change links, and purchase confirmations.
• To send optional product or promotional emails, where you have not turned email notifications off. You can opt out at any time.
• To respond to your feedback and support requests.
• To understand aggregate usage of the Service — how many people sign up, which categories are popular, how revenue trends — so we can improve the catalogue and the app.
• To prevent fraud, abuse of payments or coins, and unauthorised access.
• To comply with legal, tax and accounting obligations.

We do not sell your personal data, and we do not use your data for automated decision-making that has a legal or similarly significant effect on you.

3. Legal bases for processing

Where the GDPR or the Kenyan Data Protection Act, 2019 requires us to identify a legal basis, we rely on the following:

• Performance of a contract — to give you an account, stream the episodes you unlock and process your purchases.
• Legitimate interests — to secure the Service, prevent fraud and improve the product using aggregate usage data.
• Consent — for optional promotional emails and, where applicable, for personalised advertising. You may withdraw consent at any time.
• Legal obligation — to retain transaction records required by tax and financial regulation.

4. Who we share data with

We share personal data only with service providers who process it on our behalf under contract, and only as far as they need it to do their job:

• Paystack — payment processing. Receives your email address and the transaction amount and reference. Paystack handles your payment credentials under its own privacy policy.
• Bunny.net — video hosting and content delivery. Receives your IP address and playback request data when you stream an episode.
• Our email provider — delivery of account and notification emails. Receives your email address and the message content.
• Our hosting and database provider — operates the servers on which the Service and its database run.
• Google — where advertising is enabled in the app, our advertising partner may collect device identifiers, IP address and ad interaction data to serve and measure ads, in line with Google's own privacy policy.

We may also disclose personal data where we are legally required to do so — for example in response to a valid court order, a lawful request from a regulator or law enforcement agency, or to establish or defend a legal claim. If Dimetech Group Ltd is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, and we will notify you before it becomes subject to a different privacy policy.

5. International transfers

We are based in Kenya, and some of our service providers store or process data outside Kenya and outside the European Economic Area. Where we transfer personal data across borders, we do so on the basis of an adequacy decision, the European Commission's Standard Contractual Clauses, or another safeguard permitted under the Kenyan Data Protection Act, 2019 and the GDPR.

6. How long we keep data

• Account data — kept while your account is active.
• Payment and transaction records — kept for up to seven years after the transaction, as required by tax and accounting law, even after you delete your account.
• Support and feedback messages — kept for up to two years after the matter is resolved.
• Server and diagnostic logs — kept for a short period, normally no more than 12 months.

7. Deleting your account and data

You can ask us to delete your ZetuXP account at any time. Submit the form at app.zetuxp.com/delete-account , which does not require you to be signed in, or email privacy@zetuxp.com from the address registered to the account.

When we action a deletion request we remove your identifying details — your email address and any name you gave us are irreversibly replaced with anonymous values, so the account can no longer be linked back to you or signed into. Your coin balance and any unlocked episodes are forfeited at that point and cannot be restored. Anonymised transaction records are retained for the period described in section 6 to meet our legal obligations, and aggregate statistics that cannot identify you may be kept indefinitely.

We aim to complete deletion requests within 30 days and will confirm by email when it is done.

8. Your rights

Subject to the conditions in applicable law, you have the right to:

• be informed about how we use your personal data;
• access a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted, as described in section 7;
• object to, or ask us to restrict, certain processing;
• withdraw consent where our processing is based on consent;
• receive your data in a portable, machine-readable format;
• not be subjected to unlawful automated decision-making.

To exercise any of these rights, email privacy@zetuxp.com. We will respond within the time limits set by applicable law and may ask you to verify your identity first.

If you are unhappy with how we have handled your personal data, you may lodge a complaint with the Office of the Data Protection Commissioner in Kenya (odpc.go.ke). If you are in the EEA or the UK, you may complain to your local data protection supervisory authority.

9. Security

We protect your data with measures appropriate to the risk, including encryption of traffic in transit over HTTPS, one-way bcrypt hashing of passwords, signed and expiring authentication tokens for the mobile app, signature verification on incoming payment webhooks, and restricted, role-based access to our administrative tools. No system can be guaranteed completely secure, so please use a strong, unique password and tell us immediately if you believe your account has been compromised.

10. Children

ZetuXP is not directed at children. The Service is intended for users aged 13 and over, and some content carries a higher age rating shown on the Google Play listing. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact privacy@zetuxp.com and we will delete the account and its data.

11. Changes to this policy

We may update this policy as the Service changes or as the law requires. When we do, we will revise the "Last updated" date at the top of this page. If the changes are significant we will give you notice in the app or by email before they take effect. The current version is always available at app.zetuxp.com/privacy.

12. Contact us

For any question or request about this policy or your personal data: