Privacy Policy

Information we collect

We collect only what the product needs to work, and we collect it either directly from you or automatically as you use the service.

• Account information: your name, email address, password hash and language preference.
• Profile information: optional details you add about yourself, such as your goals as a homeowner.
• Property information: address, size, bedrooms and bathrooms, year built, improvements, mortgage details and any document you upload.
• AI conversations: the messages you send, the answers ZASS AI returns and the workspace they belong to.
• Usage analytics: pages viewed, features used, device type, browser and approximate region derived from your IP address.
• Billing information: plan, subscription status and invoice history. Card numbers are handled by Stripe and never reach our servers.
• Cookies and similar technologies: described in our Cookie Policy.

How we use your information

• To create and secure your account and authenticate you.
• To give the AI persistent memory of your property so you never repeat basic information.
• To generate valuations, opportunities, maintenance plans and reports.
• To process subscriptions, payments, renewals and refunds.
• To send transactional email such as verification, password resets and receipts.
• To detect abuse, fraud and security incidents.
• To improve reliability and performance using aggregated, non-identifying analytics.

How your data is stored and protected

• Data is encrypted in transit with TLS and encrypted at rest with AES-256 by our infrastructure providers.
• Passwords are never stored in readable form and are never visible to our team.
• Database access is restricted by row-level security so each account can only reach its own records.
• Administrative access is limited to the smallest number of people needed to operate the service.
• Uploaded documents are stored in private buckets that require a signed, expiring link to open.

Third-party providers

We share the minimum data required with the following processors. Each is bound by its own agreement and may not use your information for its own purposes.

• Stripe — payments, subscriptions and invoices.
• Supabase — authentication, database and encrypted file storage.
• HubSpot — customer relationship records and account lifecycle.
• Resend — transactional email delivery and delivery status.
• Google — optional sign-in and platform services.
• Apple — optional sign-in and App Store distribution.
• AI model providers (including OpenAI and Google) — processing of conversation content to generate answers. Conversations are not used to train third-party foundation models.

Data retention

• Account, property and conversation data is kept while your account is active.
• After you delete your account we remove personal data within 30 days, except where law requires us to keep it.
• Billing and tax records are retained for up to seven years as required by law.
• Security logs are retained for up to 12 months.

Exporting and deleting your data

You can request a machine-readable export of your account, properties, documents and conversations, or ask us to delete your account entirely, by writing to privacy@zassai.com. We verify the request against the email on the account and respond within 30 days. Deletion is permanent and cannot be reversed.

GDPR readiness

Where the GDPR applies, our lawful bases are contract (to provide the service you signed up for), legitimate interest (security and product improvement) and consent (optional analytics and marketing). You have the right to access, rectify, erase, restrict, port and object, and to complain to your supervisory authority.

Children

ZASS AI is not directed to children. You must be at least 18 years old to create an account, and we do not knowingly collect information from minors.