zanzaPrivacy Policy
Version of 2 September 2026
This policy explains what personal data Zanza collects, what it is used for, who it is shared with and what rights you have over it. It covers the playzanza.com site and the app at app.playzanza.com.
Who handles your data
Your data is handled by Simple Smooth Safe LDA Unipessoal, a company incorporated in Portugal, tax number 518264742, acting as data controller. For anything privacy-related, write to info@simplesmoothsafe.com.
What we collect
- Account — display name, email address and password (stored encrypted by the authentication service; we never see it), the date the account was created and the date you last signed in.
- Gameplay — your match, race and special-question predictions, the points they score, and the leagues and groups you belong to.
- Notifications — your browser's notification subscription (the technical address and keys needed to deliver them), your email reminder preference and a log of what was sent.
- Support — the messages you send through the problem-report form and the app page you were on when you wrote them.
- Audience — aggregate traffic and performance measurement for the app's pages, with no cookies and no individual profiles.
We do not collect photos, phone numbers, postal addresses, dates of birth, payment details or location.
Why we use it, and on what basis
Each purpose rests on a legal basis under Article 6 GDPR:
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in and keeping the session | Performance of a contract — Art. 6(1)(b) |
| Running the leagues: recording predictions, scoring them and showing the leaderboard | Performance of a contract — Art. 6(1)(b) |
| Generating the AI pundit's write-ups | Performance of a contract — Art. 6(1)(b) |
| Sending account emails: confirmation and password recovery | Performance of a contract — Art. 6(1)(b) |
| Sending prediction reminders by email or notification | Legitimate interest — Art. 6(1)(f). You can turn these off at any time |
| Answering problem reports and providing support | Legitimate interest — Art. 6(1)(f) |
| Keeping the service secure, preventing abuse and running backups | Legitimate interest — Art. 6(1)(f) |
| Measuring audience and performance in aggregate | Legitimate interest — Art. 6(1)(f) |
The AI pundit
The pundit is text generated automatically by a language model. Once a day we send the model provider the display names of the league's members, their predictions, their points and the standings, so the text makes sense. We do not send email addresses or account identifiers.
The generated write-ups are stored in the service and visible to league members. They are also kept as files in Zanza's private code repository, where they remain — along with the display names and predictions they mention — even after an account is deleted.
Who we share it with
We use the following processors, which handle data on our behalf and only for the purposes listed:
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication and server functions | Ireland (EU) |
| Vercel | App hosting and aggregate audience measurement | Ireland (EU); company based in the USA |
| Resend | Delivery of account and reminder emails | USA |
| Anthropic | Generating the AI pundit's write-ups | USA |
| GitHub | Code hosting and storage of the database backups | USA |
The scheduled routines — the daily recap and the backups — run on our own server rented from Hostinger.
There are two further cases where your browser contacts third parties directly: notifications travel through your browser's own push service (Apple, Google or Mozilla), and the app loads fonts and club crests from external servers, which receive your IP address. The playzanza.com site loads nothing from third parties.
We do not sell or hand personal data to third parties for marketing.
Transfers outside the European Union
Some providers are based in the United States. Those transfers rely on those providers' data processing agreements, which include the standard contractual clauses approved by the European Commission.
How long we keep it
- Account, predictions and league membership: for as long as the account exists.
- Log of reminders sent: 60 days.
- Technical logs from the scheduled routines: 14 days.
- Database backups: 90 days.
- Pundit write-ups: no set period, for the reasons explained above.
- Archived leagues are not deleted — they stay as the competition's history.
Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing we carry out on the basis of legitimate interest.
To exercise any of these rights, write to info@simplesmoothsafe.com. We will answer and act on the request within 30 days at the most. If you own a league, it has to be archived or handed to another member before the account can be deleted — we will tell you so in our reply.
If you believe we have not handled your data properly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados, at cnpd.pt.
Cookies and local storage
The playzanza.com site uses no cookies and no analytics.
The app at app.playzanza.com uses two cookies: a session cookie that keeps you signed in, and one holding your chosen language. There are no advertising or tracking cookies — which is why there is no consent banner to click through. Audience measurement is done without cookies.
In your browser's local storage we keep preferences: light or dark theme, language, whether you have seen the guided tour, whether you snoozed the notifications prompt, and the group you selected. In the iOS app, your session is also stored there.
Minimum age
Zanza is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you know of an account in that situation, write to us and we will delete it.
Changes to this policy
If this policy changes, we publish the new version here and update the date. Material changes are also announced inside the app.
Contact
For anything to do with this document, write to info@simplesmoothsafe.com.