Privacy Policy

What we collect, why, how we protect it, and how to get it deleted. Plain language, no tricks.

Who we are

All AI (“we”, “us”) provides AI employees for businesses at allai.co.zw. If you have any question about your data, write to hello@allai.co.zw.

What we collect

• Account details: your email address and a password. We never store your password itself, only a one-way hash (argon2id). If you sign in with Google we receive your Google account ID, your email address, whether Google has verified it, and your name.
• Your plan and payments: which plan you chose, its status, and a payment reference from the payment provider. If you pay by EcoCash we keep only a masked version of your phone number. We never see or store full card numbers.
• Your AI employee’s mailbox: the email address assigned to you and its login credentials. The credentials are encrypted at rest with AES-256-GCM, and are only shown to you after you re-enter your password.
• Business audit requests: if you ask for a business audit on our audit page we keep what you type (name, business name, email, phone number, business size, preferred times, town, notes) and the time you agreed to be contacted. We use it only to reply to you and arrange the meeting, and we email you a receipt and, once agreed, the meeting details. We store a one-way hash of your network address to limit abuse, never the address itself. We keep a request only as long as we need it to handle it and follow up, and we delete it sooner if you ask.
• Messages: what you write in the chat with us and our replies.
• Security and service logs: sign-in events, two-factor events, and technical request logs (time, page, result). Logs do not contain passwords or the text of your messages.
• Cookies: one essential session cookie that keeps you signed in, and a short-lived security cookie used while signing in with a provider. We do not use advertising or analytics cookies.

Why we use it

To create and run your account, take payment, set up and secure your AI employee, answer your messages, prevent fraud and abuse, and meet our legal duties. We do not sell your data and we do not use it for advertising.

How we protect it

• Everything travels over HTTPS.
• Stored mailbox credentials and our database backups are encrypted with AES-256-GCM. Encryption keys are kept separately from the data.
• Passwords are hashed. You can turn on two-factor authentication on your Security page (you need to be signed in). Admin accounts must use it.
• Staff access is limited to what is needed to support you and is recorded in an audit log. Staff cannot read your stored mailbox password.

No system is perfectly secure. If a breach affects your data we will tell you without undue delay.

Who else handles your data

• Fly.io hosts our servers and database in Johannesburg, South Africa.
• Google, if you choose “Continue with Google”. Google’s own privacy policy applies to your Google account.
• Payment providers process payments once real payments are switched on (card, EcoCash or crypto). They receive what is needed to take the payment and have their own policies.
• Authorities, if we are legally required to disclose something.

Because our host is outside Zimbabwe, your data is stored and processed in South Africa.

Test mode

Payments are not open yet (TEST MODE). No real money is taken and no payment details are collected on this site yet. Please do not send payment details to anyone claiming to act for All AI. We will update this page when real payments open.

How long we keep it

We keep your account data while your account is open. Sign-in sessions expire automatically (30 minutes idle, 12 hours at most). Technical logs are kept for a short operational period. Encrypted backups are rotated and old ones are deleted. We may keep payment and audit records for as long as the law or fraud prevention requires.

Your choices

• See, correct or delete your data: email us at hello@allai.co.zw and we will respond promptly. We may need to confirm it is really you.
• Cancel your subscription any time from your dashboard, or message us on WhatsApp and we will help.
• Withdraw consent or object to how we use your data by contacting us.

Children

Our service is for businesses and adults. It is not meant for children.

Changes

If we change this policy in a way that matters, we will update this page and the date below.

Last updated: 16 October 2026.