Gizie ("Gizie", "we", "us", "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose and protect personal data when you use the Gizie mobile applications and platform (the "Platform") — whether as a client booking appointments through the Gizie app, or as a salon, spa, barbershop, studio or professional using Gizie for Business.
It also describes your rights and how to exercise them, and it reflects the information required for Google Play's Data Safety declaration and Apple's App Privacy details. This Policy is written to meet Ethiopia's Personal Data Protection Proclamation and, where it applies to you, international standards including the EU/UK General Data Protection Regulation (GDPR).
Data controller
Gizie, registered at PlayStream Interactive PLC, Bole Sub-city, Woreda 03, Addis Ababa, Ethiopia, is the data controller responsible for personal data collected through the Platform, unless stated otherwise in this Policy.
Where a business on Gizie keeps its own client records — appointment history, treatment notes, contact details — that business is an independent controller of those records for its own purposes, and Gizie acts as its processor for the parts we host. Section 10 explains how this split works.
For any question about this Policy or our data practices, contact us using the details in Section 20.
Scope
This Policy applies to everyone who uses the Platform:
- Clients — people who browse venues, book appointments, pay, leave reviews and collect rewards in the Gizie app.
- Businesses and professionals — owners, managers, staff and receptionists who use Gizie for Business to manage a calendar, clients, catalogue and payouts.
- Visitors to this website, and people who contact our support team.
Certain sections apply only to businesses, because we collect verification (KYC) and payout data from them that we never collect from clients.
Information we collect
3.1 Information you give us
- Client account details: full name, phone number, email address, password, date of birth, gender (optional), profile photo, preferred language (English or አማርኛ) and notification preferences.
- Booking details: the venue, services, professional, date and time you choose, the number of people in a group booking, membership plans you subscribe to, and any notes you add.
- Payment details: the payment method you select and the identifiers needed to charge it. Payments are processed by our payment partners (for example Telebirr, M‑PESA and card processors) — we do not store full card numbers or your Telebirr PIN on our servers.
- Content you create: reviews and ratings, favourites, promo codes you redeem, support tickets, and messages or reminders exchanged with a venue through the Platform.
- Business account details: business name, category, branch addresses, opening hours, service catalogue and prices, team members and their roles, working hours, and the photos you publish.
- Business verification (KYC) data: trade licence, TIN, owner's government-issued ID, proof of address where required, any service-specific permit, and the bank or mobile-money account used for payouts.
3.2 Information we collect automatically
- Device and log data: IP address, device model and identifiers, operating system, app version, and crash or diagnostic logs.
- Usage data: screens viewed, searches you run, categories and venues you tap, and features you use — used to rank results and improve the product.
- Location data: approximate or precise location, only where you grant the permission, to show venues near you, sort by distance and display the map. You can use Gizie without it by choosing an area manually.
- Cookies and similar technologies on this website and in the apps, for authentication, preferences and analytics — see Section 8.
3.3 Information from third parties
- Sign-in providers (Apple, Google) where you choose to register or sign in with them — we receive your name, email address and a account identifier, not your password.
- Payment partners, confirming that a payment succeeded, failed or was refunded, plus limited metadata such as the masked account or card suffix.
- Identity-verification and fraud-prevention partners, in connection with business KYC checks.
- Businesses on the Platform, when they add you as a client, book you in by phone or record notes about a visit.
App permissions
The Gizie apps request the permissions below. You can review or change them at any time in your device settings — on Android under Settings › Apps › Gizie › Permissions, on iOS under Settings › Gizie. Every permission is optional and the app keeps working, with fewer features, if you decline.
| Permission | Why we ask | Which app |
|---|---|---|
| Location | Show venues near you, sort results by distance, and place venues on the map. | Client app |
| Notifications | Booking confirmations, appointment reminders, reschedule and cancellation notices, review prompts, rewards and offers. | Both apps |
| Camera | Take a profile photo, capture a KYC document, or photograph your venue, team and work. | Both apps |
| Photos / media / storage | Choose an existing image or document to upload for your profile, your listing or KYC. | Both apps |
| Contacts | Only if you choose "Import from contacts" when adding a client to your business — we import the entries you select and nothing else. | Business app |
| Biometric (Face / fingerprint) | Optional biometric unlock or two-factor authentication, handled entirely by your device's operating system. Biometric data is never transmitted to or stored on Gizie's servers. | Both apps |
How we use your information
- To create and manage your account and verify who you are.
- To show you venues, services, availability and prices that are relevant to where you are and what you are looking for.
- To take a booking, charge the payment, issue your confirmation, and pass the appointment to the venue's calendar.
- To manage group bookings and membership subscriptions, including recurring billing where you subscribe.
- To run the rewards programme — awarding points, tracking tier progress and applying offers or promo codes.
- To send booking confirmations, reminders, reschedule and cancellation notices, and other service messages.
- To verify a business's identity, licensing and eligibility, and to pay out its earnings.
- To provide customer support, investigate disputes over a booking, no-show or refund, and act on safety reports.
- To detect, prevent and investigate fraud, abuse, payment risk and breaches of our Terms.
- To analyse how the Platform is used and improve it, using aggregated or de-identified data wherever that is enough.
- To meet legal, tax, accounting and regulatory obligations.
- To send administrative and security notices, and — where you have opted in — offers and marketing.
We do not use your personal data to make automated decisions with legal or similarly significant effects. Ranking and recommendations are automated, but a human reviews any decision to suspend an account or reject a KYC submission.
Legal bases for processing
Where the GDPR or comparable legislation applies to our processing, we rely on the following legal bases:
- Performance of a contract — creating your account, taking and managing bookings, collecting payment, paying out businesses, and delivering the core features of the apps.
- Legal obligation — KYC and record-keeping, tax and accounting requirements, and responding to lawful requests.
- Legitimate interests — keeping the Platform safe and trustworthy, preventing fraud and no-show abuse, moderating reviews and content, securing our systems, and improving the product. We balance these interests against your rights and privacy in each case.
- Consent — location access, notifications, optional marketing, non-essential analytics and biometric unlock. You can withdraw consent at any time in your device or app settings, without affecting anything we did before you withdrew it.
Messages, reminders and notes on the Platform
Messages, reminders and appointment notes exchanged through the Platform between a client and a venue are stored on our systems and are not end-to-end encrypted.
We may access and review this content where it is necessary to investigate a dispute over a booking, no-show or refund, to look into a safety or abuse report, to prevent fraud or attempts to take bookings and payments off-Platform, for quality assurance, or to comply with a legal obligation. Access is limited to authorised staff on a need-to-know basis and is logged.
Please do not share payment credentials, PINs or unnecessary sensitive information in messages or notes.
Businesses as independent controllers
A business on Gizie decides for itself what client records it keeps, what notes it records and how long it needs them for its own bookkeeping and duty of care. For those purposes the business is an independent controller and is responsible for handling that data lawfully, including responding to requests from its own clients.
Gizie remains the controller for the Platform itself: accounts, bookings, payments, safety, fraud prevention and the rankings we produce. If you contact us about data a business holds about you and we cannot resolve it ourselves, we will pass your request to that business and tell you we have done so.
Google Play services and app stores
The apps use platform services from Google and Apple — for example sign-in, push messaging, crash reporting and analytics. Data those services collect is governed by their own privacy policies: policies.google.com/privacy and apple.com/legal/privacy.
International data transfers
Gizie is operated from Ethiopia, but some of our service providers store or process data outside Ethiopia — for example cloud hosting and analytics providers in the European Union or the United States. Where we transfer personal data across borders we use appropriate safeguards, such as contractual protections equivalent to the European Commission's Standard Contractual Clauses, and we assess whether the destination provides adequate protection.
Data retention
| Data | How long we keep it |
|---|---|
| Account profile | While your account is active, then deleted or anonymised after closure, subject to the rows below. |
| Bookings and payment records | Ten (10) years, being the longer of the periods required under the Commercial Code of Ethiopia and the Tax Administration Proclamation, counted from the transaction date. |
| Business KYC documents | Ten (10) years, being the statutory record-keeping period for identity and payout records under the Commercial Code of Ethiopia, then deleted. |
| Messages, notes and support tickets | Up to 24 months after the related appointment or ticket closes, or longer where a dispute or investigation is open. |
| Reviews | Published for as long as the venue is listed; your name is removed if you close your account. |
| Device, log and crash data | Up to 12 months. |
| Fraud, abuse and safety records | As long as needed to prevent repeat harm, including a limited record of banned accounts. |
When data is no longer needed we delete it or irreversibly anonymise it.
Data security
We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration — including encryption in transit, encrypted storage of KYC and payout details, role-based access controls that limit what each member of a business's team can see, and logging of administrative access.
No system is completely secure. Use a strong, unique password, keep your device locked, and enable biometric unlock or two-factor authentication where offered. Tell us promptly if you think someone else has access to your account.
Your rights
Subject to applicable law, you may have the right to:
- Access the personal data we hold about you, and receive an explanation of how we use it.
- Correct data that is inaccurate or incomplete — most of it you can edit yourself in the app.
- Delete your data, subject to the retention obligations in Section 13.
- Object to or restrict certain processing, including direct marketing, which you can switch off at any time.
- Portability — receive a copy of the data you provided to us in a machine-readable format.
- Withdraw consent where our processing is based on consent.
- Complain to your data protection authority. In Ethiopia this is the Ethiopian Communications Authority (ECA), the supervisory authority designated under the Personal Data Protection Proclamation No. 1321/2024 (eca.et); in the EEA or UK it is your national supervisory authority.
To exercise any of these rights, contact us using the details in Section 20. We may need to verify your identity first, and we will respond within one month, or sooner where the law requires it. If we need longer for a complex request, we will tell you why.
Account and data deletion
You may request to close your Gizie account and delete your personal data at any time through either of the following methods:
- In the app: navigate to Profile › Help & Support › Delete My Account and follow the on-screen confirmation steps.
- Via email: submit a request by emailing contact@sofloom.com from the email address associated with your registered account.
Impact of account deletion
- Upcoming bookings and refunds: deleting your account automatically cancels any active or upcoming bookings. Cancellations remain subject to the standard cancellation policy, including non-refundable service fees.
- Rewards and loyalty: account deletion results in the immediate forfeiture of all accumulated, unused reward points and promo offers.
- Business accounts: service providers and venue accounts must settle all outstanding payouts, disputes and contractual obligations before an account closure request can be processed.
Data retention limits
Certain personal and transactional data will be retained following account closure where required or permitted by applicable law. This includes financial transaction records for accounting and tax compliance, identity verification (KYC) logs, and documentation necessary for fraud prevention or ongoing dispute resolution. Retained data will be permanently deleted or fully anonymised upon the expiration of the statutory retention periods outlined in Section 13.
Children's privacy
Gizie accounts are for adults. You must be at least 18 to hold an account, book a service or list a business, and we do not knowingly collect personal data from children.
An adult account holder may book an appointment for a minor — for example a child's haircut, or a guest in a group booking — in which case the adult is responsible for that booking and for any information they share about the minor. Please share no more than the venue needs to deliver the service safely.
If we learn that we hold data from a child without appropriate consent, we will delete it.
Third-party links and services
The Platform links to and integrates third-party services — maps, payment providers, sign-in providers and the app stores. This Policy does not cover their processing, and we encourage you to read their privacy policies. Venues listed on Gizie also operate their own websites and social accounts, which are outside our control.
Changes to this Policy
We may update this Policy from time to time. If a change materially affects how we use your personal data, we will notify you in the app or by email before it takes effect and update the effective date at the top of this page. Continuing to use the Platform after a change takes effect means you accept the updated Policy.
Previous versions are available on request.
Contact us
For any question, request or complaint about this Policy or your personal data:
- General support
- contact@sofloom.com
- Address
- PlayStream Interactive PLC, Bole Sub-city, Woreda 03, Addis Ababa, Ethiopia