When I was writing this post I wanted to link to Facebook founder and CEO Mark Zuckerberg’s op-ed in yesterday’s Washington Post. I had previously signed up for Facebook Connect for the Post so I was taken directly to the article. And I have a small confession: I don’t think I fully understand how Facebook Connect works and, more importantly, what its implications may be for the privacy of my information on Facebook.

Mark Zuckerberg at f8 2010 (Washington Post photo)
In his op-ed Zuckerberg admits only to “mov[ing] too fast” to introduce privacy tools that “were too complex”. Zuckerberg goes on to say that Facebook’s intention was to provide “lots of granular [privacy] controls; but that may not have been what many of you wanted.” The ability to fine-tune privacy settings seems like a good idea given the wide variety of content available on and through Facebook. However, the risk of missing something significant and inadvertently setting a control incorrectly may well outweigh the value of granular controls.
However, Facebook’s recent history of introducing, then modifying, changes to the platform, along with its enormous size and influence in the social media space, has created an environment in which not everyone is willing to take the company’s statements at face value (the comments on almost any post on the allfacebook blog are instructive). We believe that it is in the interest of everyone in the space – users as well as networks – for Facebook to get a better handle on how to develop, introduce, explain and refine significant changes to its platform.
It is axiomatic that users should control the amount of personal information they share, and with whom. I’m not sure there is one best way to ensure this, and granularity versus ease of use for privacy controls seems to me a debate worth having. Zavee is oriented toward the ease of use end of the spectrum. We provide very clear but fairly granular choices about who gets to see what information. Furthermore, all of our privacy settings default to the most limited distribution, which minimizes the downside risk for the user.
In addition to receiving credible assurances about the privacy of their personal information, users of social networks – especially social shopping networks – need to be completely comfortable that any financial information they provide will be maintained and transmitted with the utmost security. Platforms such as Mint ask for a wide range of personal financial information since Mint’s model is to aggregate that information and make it easier for the member to use. Blippy and some other sites require registration of a credit card, as their model involves sharing purchases over a social network. Zavee also requires registration of a credit card, although unlike Blippy Zavee does not share purchase details over the network.
Zavee has a number of safeguards in place to protect users’ credit card data. First, we use Secure Sockets Layer technology from industry leader Verisign to provide secure access to the platform for every Zavee user. That’s why our URL starts with “https://” and has a distinctive green band in the address window. You can see the Verisign seal in the footer of our site and can click on it to learn more about Secure Sockets Layer technology.
Second, we only collect the minimum card data necessary for the Zavee platform to function. Anyone who has ever made a purchase online, or even over the phone, knows that the merchant is required to collect not just the the card number, but also its expiration date and security code, and sometimes the zip code for the billing address. Zavee only needs the card number, so that’s all we ask for. Anyone who improperly obtained that information would still be unable to use the card for an unauthorized transaction.
Third, Zavee itself never collects or stores any credit card information. The card registration page may look the same as other pages on the Zavee site, but it isn’t actually on our site at all. When a user registers a credit card the card number is automatically encrypted and sent directly to our data provider, a company called TSYS. TSYS is one of the largest credit card processors in the world and maintains secure credit card databases for, among others, VISA itself. Once TSYS receives and registers the card number it sends a secure, unique identifier back to Zavee. Our system is set up to use only this identifier when we process shopper transactions, so the actual card number remains within TSYS’s secure environment. Our databases are stored in a secure facility in the US, but if anything happened to the card identifiers we would simply get a copy of the relevant database from TSYS.
The Zavee takeaway:
- Overly complex privacy settings may have the effect of inadvertently decreasing actual privacy. No one should find that acceptable.
- Zavee is a simple platform from a privacy standpoint and has simple, intuitive privacy controls that are designed to minimize user risk.
- No one should ever be in doubt about the security of their financial data. Zavee uses industry best practices to protect the credit card numbers that members provide.






