How we collect, use, and protect your data.

1Introduction

ZARAS AI LLC ("Company", "we", "us"), a Florida limited liability company, operates Zaras (the "Service"): the Zaras web application at app.zaras.ai, the Zaras mobile app for iOS and Android, and this website, zaras.ai. This Privacy Policy explains how we collect, use, keep, share, and delete your information when you use the Service.

Two roles. For your own account (your login, profile, and how you use the Service) and for visitors to this website, we decide how the information is used. For the records a business keeps about its own customers in Zaras (contacts, addresses, jobs, photos, estimates, invoices, and messages), the business decides, and we process that information on its behalf. Section 7 explains that second role.

The Service is offered in the United States only.

2Information we collect

Account information. When you create an account, we collect your name, email address, business name, and phone number, and the profile details you choose to add.

Sign in with Apple or Google. If you sign in with Apple or Google, we receive your name, your email address (or an Apple private-relay address if you choose to hide yours), and an account identifier from that provider. We never receive your Apple or Google password. You can remove Zaras's access at any time in your Apple Account or Google Account settings.

Account security. If you turn on two-factor authentication, we store the secret your authenticator app uses. When you set a password, we check it against known data breaches without your password ever leaving our systems. We record sign-in activity (time, IP address, device and browser) to protect your account, and we show the approximate location of each signed-in session so you can review your active sessions.

Business data. Data you enter into the Service, including customer records, job details, estimates, invoices, notes, file attachments, team messages, time entries, and communication logs.

Photos & attachments. Photos and files you capture or upload as attachments, such as job-site photos taken in the Zaras mobile app, together with the time and place the photo was taken (see Location in section 3).

Technical data. When you use the Service, our servers and hosting providers record technical information such as your IP address, browser type, device and operating system, and the requests your device makes. We use it to run, secure, and fix the Service. We do not use third-party analytics or advertising tools.

Crash & diagnostic data. If the web or mobile app crashes or hits an error, we collect diagnostic data (device or browser model, operating system version, the error and where it happened, and your user ID) through our error-reporting provider, so we can find and fix the problem.

Payment information. Plans are bought only in the web app at app.zaras.ai, after a 14-day trial that needs no card. When you choose a plan, you enter your card on a checkout page run by our payment processor, Stripe. Stripe receives your name, email address, business name, card and plan; we never receive or store your full card number. Stripe tells us your plan, whether each payment succeeded, failed or was refunded, and the last four digits and brand of your card. If your business accepts payments through Zaras, you give your identity and bank details to Stripe directly, and Stripe shares with us the account status and payment records we need to show you your payments and payouts.

Referrals. If you sign up through a link or code from a Zaras partner or another Zaras business, we record which link or code you used and when. Section 9 says what the person who referred you can see.

SMS & phone number data. We collect phone numbers provided directly by customers or entered by businesses into the Service. When text messages are sent through the Service, we store SMS message logs, including timestamps and delivery status, for the purposes of service delivery and troubleshooting. We do not sell or share phone numbers with third parties for marketing purposes. Text messages are sent through our messaging provider.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

3Mobile app

The Zaras mobile app for iOS and Android is covered by this same Privacy Policy.

Camera & photo library. The app may access your device's camera and photo library solely so you can capture and attach job photos, and only with your permission through the operating system's permission prompt.

Location. When you take a job photo with the camera in the app, the app records your device's precise location (GPS coordinates) at that moment and saves it with the photo, so the business has a verifiable record of where the work was done. When you attach a photo from your library instead, we read the location and time stored in that photo's own metadata, if it has any. The app asks for location permission through your operating system's prompt, uses location only while the app is open, and never collects it in the background. If you decline, photos you take in the app upload without a location; photos you choose from your library keep any location already stored in them, whether or not you allow location access. Photo locations are stored in the business's workspace with the job. We do not use location for advertising, we do not sell it, and we do not use it to track where you go.

Push notifications. If you allow notifications, we store a push token that identifies your device to Apple's or Google's notification service, which delivers the notification. You can turn notifications off in the app's notification settings or in your device settings.

App updates. The app downloads updates from our update service, which receives your device's IP address and app version when it checks for an update.

No advertising or tracking. The Zaras mobile app contains no advertising and does not track you across other apps or websites.

4Zaras Assistant and AI features

What is sent. When you ask the Zaras Assistant a question, we send your question, together with the workspace records the Zaras Assistant looks up to answer it (for example jobs, customers, schedules, or invoices), to Anthropic, our AI provider, which generates the answer. Other AI features, such as drafting an estimate description or explaining an exception, send the records involved in the same way.

Withdrawing your consent. The Zaras mobile app asks for your consent before it uses AI features. You can withdraw that consent at any time in the app, at Settings → Preferences → AI features, or by emailing support@zaras.ai. Once AI features are off, the mobile app sends nothing to our AI provider and asks for your consent again before any AI use. In the web app, AI features run only when you use them, for example when you ask the Zaras Assistant a question.

AI output can be wrong. Check it before you rely on it or send it to a customer.

5Website, chat, and phone support

Website chat. The chat on zaras.ai is answered by our virtual guide, which is automated. We keep chat transcripts on our servers only as long as we need them, then delete them. Your browser also keeps a copy for a short time so the conversation survives a page reload.

Forms. When you apply for a job, ask for a callback, or ask to join Zaras Partners, we store what you submit so someone on our team can respond. We delete job applications and callback requests once we no longer need them, and declined requests to join Zaras Partners 180 days after we decide on them; an approved partner's request becomes part of their partner record (section 12).

Help article notes. When you tell us what a help article was missing, we keep what you type to improve our articles, and delete it once we no longer need it.

Clicks and visits. We count clicks on our own buttons and links, and which site, app or referral link sent a visit. If you arrive through a referral link, our server sets a cookie on zaras.ai that holds only that link's identifier and lasts 60 days, so we can credit the person who referred you if you sign up (see section 15). Apart from that one cookie, we count visits without cookies and without anything that identifies you.

Abuse protection. Our website forms and chat, and the sign-in, sign-up, and password reset screens of our apps, use Cloudflare Turnstile to tell people from bots. Turnstile receives your IP address and browser signals and is covered by the Turnstile Privacy Addendum.

Recorded lines. Calls to our support line are answered by our virtual guide, which is automated, and take place on a recorded line.

Callback consent. We place an outbound callback only with your consent, given when you ask for the call.

What we keep. We keep call transcripts, outcomes and recordings only as long as we need them, and consent and opt-out records as long as we need them to show your choice.

How to revoke consent. Say so on any call, or email support@zaras.ai.

Phone numbers collected for support calls and callback requests are used only for the conversation requested. We do not sell them or add them to marketing lists.

6How we use your information

We use your information to:

• Provide and maintain the Service
• Process transactions and send billing-related communications
• Bill your plan through Stripe and send billing emails
• Send service-related SMS notifications such as appointment reminders, job updates, estimate and invoice alerts
• Send push notifications you have allowed
• Answer questions you ask the Zaras Assistant
• Respond to your requests and provide customer support
• Send important updates about the Service
• Email you about your account, getting set up and what's new
• Keep accounts secure and prevent fraud and abuse
• Find and fix errors, and improve and develop new features
• Run Zaras Partners and Zaras Circle: credit referrals to the right person, pay partners and apply member credit
• Comply with legal obligations, including tax reporting on partner payments

Every email about getting set up or what's new has an unsubscribe link.

We do not use your information to show you ads on other sites or apps, and we do not sell it.

7Data we process for businesses

A business that uses Zaras controls the records it keeps about its own customers, such as their names, phone numbers, addresses, job photos, estimates, invoices, and messages. For that information the business is the "business" or "controller" under US privacy laws, and we are its "service provider" or "processor": we process it only to provide the Service to that business and as the business instructs, and we do not sell it or use it for our own purposes.

If you are a customer of a business that uses Zaras. Please send requests to access, correct, or delete your information to that business. If you contact us instead, we will pass your request to the business and help it respond. The same applies to estimates and invoices a business sends you through Zaras: when you open one of those links or pay through it, the business receives the details, and your payment is processed by Stripe.

8Data sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We may share your information with:

• Service providers who help us operate the Service, described in section 10, under contracts that limit their use of it to providing their service to us
• The business whose workspace you belong to, which can see the work you record there
• The Zaras partner or Zaras business that referred your business to Zaras, limited to what section 9 describes
• Law enforcement when required by law
• Parties involved in a business transfer (merger, acquisition)

Calendar feed links. If you create a private calendar (iCal) feed link in the app, anyone who has the link, such as the calendar app you add it to, can read the jobs in that feed: their titles, times, addresses, customer names, and assigned team members. Keep the link private. You can replace or turn off the link in the app at any time, and the old link then stops working.

We do not sell, rent, or share end-user phone numbers or SMS consent data with third parties or affiliates for marketing or promotional purposes. No referrer ever receives your phone number.

9Referring partners and members

Who referrers are. A Zaras partner is a member of Zaras Partners, our invite-only program, and earns a share of what the businesses they refer pay us. A Zaras business that refers you takes part in Zaras Circle, our member program, and earns credit on its own Zaras bill. If you sign up through a referrer's link or code, we tell that referrer about your account as described here, so we can pay or credit them correctly. We receive nothing for this information.

What a Zaras partner sees. That a business signed up through their link or code; your trade and state; the date you signed up; where you are in your trial; whether you have finished setting up; your plan, the amount and date of each payment, and any refund, late payment or cancellation. If you signed up on our website, they also see your business name and city; if you signed up in our mobile app, they see them only if you type them at app.zaras.ai. A partner never has access to your account and cannot message you through Zaras.

What a Zaras business that referred you sees. That a business used their link or code, the date you signed up, whether you are on a trial or a paid plan, and whether their credit was reversed. They never see your business name.

What no referrer ever sees. Your street address, phone number, card or bank details, customers, jobs, estimates, invoices, what your business earns, or why you cancelled. Referrers must keep what they see confidential and use it only to follow their referrals; they may not sell it, export it, add you to a mailing list, or use it to contact you outside Zaras.

Invites between Zaras businesses. When a Zaras business enters someone's email address in its Zaras Circle invite box, we send that person one email with the business's name, its referral link, our postal address and a way to opt out, and no follow-up. We keep the address only to credit the referral if the person signs up and to honor an opt-out.

If you are a Zaras partner. We keep your name, email address, state, your links and codes, the businesses that signed up through them and what you earned on each, your payout choice and your payout history, and we show your name to the businesses that sign up through you. If you choose bank transfer, you give your identity, bank account and tax details to Stripe in Stripe's own onboarding, and we never hold your bank account number. If you choose Zelle or Cash App, we keep the email address, phone number or $cashtag you give us with your payout records and pass it, with the amount, to our bank or to Cash App to make each payment. Where the law requires a tax form, we keep it only in encrypted storage our servers alone can read and show only the last four digits of your taxpayer number on any screen.

10Service providers

We use these kinds of providers to run the Service. Each receives only what it needs for the purpose shown. Every provider we share data with is bound by contract to give it the same or equal protection as this Privacy Policy.

11Data storage, location & security

We store and process your data in the United States. Your data is stored securely using industry-standard infrastructure. We use encryption in transit (TLS/SSL) and implement access controls to protect your information. While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. Our security page explains how to protect your account and get a copy of your data.

12Data retention

We keep your data while your account or your business's workspace is active. After that:

• Deleted account: your login, profile, device push tokens, and the approximate locations of your sign-in sessions are erased (see section 13). The work you recorded for a business stays with that business, including the location saved with photos you took. If you are your workspace's only member and its owner, this happens after a 30-day restore period (see section 13).
• Deleted workspace: locked at once, can be restored for 30 days, then permanently purged.
• Locked workspace: a workspace is locked when its trial ends without a plan, when a cancelled plan's paid month ends, or eight days after a failed payment that is not fixed. Nothing is deleted while it is locked; you can still sign in, and the workspace owner can export its data and choose a plan. If no plan is chosen, the workspace and its data are permanently deleted 180 days after the lock. We email the owner before that happens.
• Zaras billing records: 7 years, for tax and accounting.
• Stripe identifiers: the account and payment IDs needed for tax reporting and payment disputes, kept for the same 7 years.
• Partner payout records and tax forms: 7 years after the year of the payout, including after a partner leaves.
• Security logs: only as long as we need them to keep accounts and the Service secure.
• SMS and phone consent and opt-out records: as long as we need them to show your choice.
• Website chat transcripts, support calls and job applications: only as long as we need them, then deleted.
• Help article notes: only as long as we need them, then deleted.
• Referral cookie: 60 days in your browser, or until you clear it.
• Requests to join Zaras Partners: a declined request is deleted 180 days after we decide on it. An approved partner's request becomes part of their partner record and is kept with their payout records.
• Backups: deleted data ages out of our backups on a short schedule.

We may keep specific records longer only where the law requires it, for example under a legal hold.

13Deleting your account or workspace

Delete your account. Any user can delete their own account, in the web app or the mobile app, at Settings → Account → Delete account. You can also delete it at app.zaras.ai/delete-account; if you are signed out, we confirm the request with a one-time code sent to your account's email address. If you cannot use either path, email support@zaras.ai.

What happens. If you are a member of a workspace someone else owns, or you have no workspace, your account is deleted at once. You are signed out on every device immediately. Your login, profile, device push tokens, and the approximate locations of your sign-in sessions are erased; photos you took keep their location as part of the business's records. If you used Sign in with Apple, we revoke Zaras's authorization with Apple; if we cannot, we show you how to remove it in your Apple Account settings. This deletion cannot be undone.

If you are your workspace's only member and its owner. Deleting your account also deletes the workspace. Your account and the workspace are locked together for 30 days. Your login is kept during that time, so you can sign in and restore both. After 30 days, your account is erased as described above and the workspace is permanently purged.

What stays with the business. Jobs, notes, photos, and time entries you recorded for a business are that business's records. They stay in its workspace and keep showing your name, marked "(Former)".

Workspace owners. If you own a workspace that has other members, transfer ownership or delete the workspace before deleting your account; the app offers both.

Delete a workspace. An owner can delete the whole workspace. It is locked immediately: members lose access, and links sent to customers stop working. The owner can restore it for 30 days; after that it is permanently purged. A connected Stripe account belongs to the business and is not closed by Zaras; you can close it in Stripe.

What we keep after deletion. Only the records listed in section 12: billing records, Stripe identifiers, partner payout and tax records, security logs, and consent records, for the periods shown there, and backups until they age out.

14Your rights

You have the right to:

• Access your data at any time through the Service, and ask us for a copy of it (see section 18)
• Request correction of inaccurate information
• Delete your account and associated data (see section 13)
• Opt out of non-essential communications

These rights cover all data associated with your account, whether created through the web application or the Zaras mobile app, including photos and attachments.

US state privacy rights. Depending on where you live, including California, you may have the right to know what personal information we collect and how we use and disclose it; to get a copy of it; to correct it; to delete it; and to opt out of its sale, its sharing for cross-context behavioral advertising, or targeted advertising. We do none of those three things. Precise location from job photos is used only to provide the Service. We will not discriminate against you for using these rights.

How to make a request. Email support@zaras.ai. If you are a customer of a business that uses Zaras, see section 7.

15Cookies and device storage

We use only the cookies and device storage the Service needs to work: keeping you signed in, remembering your preferences, keeping a copy of your data on your device so the apps load quickly, the website chat's saved conversation, and the bot check. The only other cookie is the 60-day referral cookie in section 5, set only when you arrive through a referral link and read only by us. We do not use analytics or advertising cookies. You can clear cookies and site data in your browser; the Service may not work without the essential ones, and clearing the referral cookie only means the referral may not be credited.

16Children's privacy

The Service is not directed to individuals under 18, and you must be 18 or older to create an account. We do not knowingly collect information from children. If we learn that we have collected information from a child, we will delete it promptly.

17Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification.

18Contact

Questions about this Privacy Policy, or a privacy request? Contact ZARAS AI LLC at support@zaras.ai, or by mail at 14 E Washington St, Suite 500, Orlando, FL 32801, United States.