ZeroFi ("ZeroFi", "we", "us") is operated by Nirvana Consulting Company. This Privacy Policy explains what information we collect through our marketplace and software at zerofi.ai and app.zerofi.ai (the "Services"), how we use it, and the choices you have. By using the Services you agree to this Policy.
1. Information we collect
Information you provide
- Homeowners / customers: the job description you enter, your city or ZIP, optional photos, and the name, email, and phone you provide when you request an estimate.
- Professionals / businesses: account details (name, email, password), business profile information (company name, address, phone, website, trade, services), and content you create in the software (quotes, jobs, invoices, customer records).
- Listing requests: details you submit to be added to our directory.
- Communications: messages you send us and email interactions.
Information collected automatically
- Usage and device data (pages viewed, actions, approximate location from IP, browser type) via cookies and analytics.
- Email engagement (opens and clicks) in messages we send, using standard tracking pixels and links.
Information from public sources
- We compile business listings (name, address, phone, website, ratings) from publicly available sources to power our directory and matching. A business may claim, correct, or request removal of its listing at any time.
2. How we use information
- Provide the Services — match homeowners with pros, generate AI estimates and DIY guidance, and run the business software.
- Send transactional messages (verification codes, receipts, lead notifications) and, where permitted, outreach we believe is relevant to your business.
- Improve, secure, and troubleshoot the Services and prevent abuse or fraud.
- Comply with legal obligations.
3. How we share information
- Between marketplace participants: when you request an estimate, we share your request and contact details with the pro(s) you select so they can respond.
- Service providers (processors / sub-processors) who help us operate — each under a data-processing agreement and processing only on our instructions — in categories such as cloud hosting & infrastructure, content delivery, email delivery, AI processing, mapping & geolocation (which may receive your IP address to resolve approximate region), analytics, and payment processing. A current list of our sub-processors is available on request at our contact form.
- Legal and safety: to comply with law, enforce our terms, or protect rights and safety.
- Business transfers: in connection with a merger, acquisition, or sale of assets.
- We do not sell your personal information.
4. Cookies & analytics (consent)
We use strictly-necessary cookies to run the site, and — only with your consent — analytics cookies (Google Analytics 4) to understand usage. We apply Google Consent Mode v2: analytics and advertising storage are denied by default, and no analytics cookies are set or usage measured until you choose "Accept all" in our cookie banner. Choosing "Reject non-essential" keeps them off with no loss of functionality. You can change or withdraw your choice at any time via the Cookie settings link in the footer.
5. Legal bases for processing (EEA / UK / Switzerland)
Where the GDPR or UK GDPR applies, we process personal data on these bases:
- Contract — to provide the Services you request (matching, estimates, the business software).
- Consent — for analytics cookies and, where required, marketing email; you may withdraw consent at any time.
- Legitimate interests — to operate, secure, and improve the Services, run our directory of publicly-listed businesses, and (where permitted) B2B outreach to businesses; balanced against your rights.
- Legal obligation — to comply with applicable law.
6. Your privacy rights
Depending on where you live, you have some or all of the following rights. We honor them regardless of location where practicable:
- EEA / UK / Switzerland (GDPR, UK GDPR): access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing and direct marketing), withdrawal of consent, and the right to lodge a complaint with your supervisory authority (e.g. your national DPA, the UK ICO, or the Irish DPC).
- United States (CCPA/CPRA and similar): to know, access, correct, delete, and to opt out of "sale"/"sharing" of personal information. We do not sell your personal information.
- Canada (PIPEDA): access and correction; complaints to the Office of the Privacy Commissioner.
- India (DPDP Act, 2023): access, correction, erasure, grievance redressal, and to nominate a representative.
- Australia (Privacy Act / APPs): access, correction, and complaints to the OAIC.
- UAE: access, correction, and deletion under applicable data-protection law.
- Marketing email: unsubscribe any time via the link in every message; we honor opt-outs across all campaigns.
- Listing removal: a business may claim, correct, or request removal of its directory listing at any time.
How to exercise a right (DSAR): email our contact form describing your request. We verify your identity and respond within the timeframe required by your law (generally 30 days for GDPR/UK GDPR, extendable by two months for complex requests). We will not discriminate against you for exercising your rights.
6b. Data retention
We keep personal data only as long as needed for the purpose it was collected, then delete or de-identify it. Indicative periods:
- Consumer leads / estimate requests: up to 24 months from last activity, then deleted or de-identified.
- Pro / business accounts and their records (quotes, jobs, invoices): for the life of the account plus up to 7 years where needed for tax, accounting, or legal purposes.
- Directory listings from public sources: retained while the listing is active; removed on request.
- Outreach contacts: until opt-out or up to 24 months of no engagement, whichever is first; opt-outs are retained on a suppression list to honor them.
- Analytics data: per Google Analytics retention settings (max 14 months).
- Security / audit logs: up to 12 months.
7. Security
We use administrative, technical, and organizational safeguards including encryption in transit, access controls, and row-level data isolation. See our Security page. No method of transmission or storage is 100% secure.
7b. Calls and SMS messaging
Calls. If you are listed in our directory we may call the business phone number on your listing to tell you the listing exists and how to claim it. These calls may be placed by our AI assistant, “Zoe”, which identifies itself as an AI at the start of the call, and they may be recorded for quality and training. You can ask to be removed at any time, on the call or by emailing us: the number is added to a permanent do-not-contact list that blocks future calls and texts.
SMS. If you ask us to text you — for example, by asking our assistant on a call to send you a link — we will send SMS messages to the number you provide. Message and data rates may apply. Message frequency varies and is limited to messages you request, plus notifications about job requests for a business you have claimed. Reply STOP to opt out at any time, or HELP for help. We do not sell or share mobile opt-in data or consent with third parties for marketing purposes.
Consent to receive calls or texts is never a condition of using ZeroFi, and we do not buy phone lists for messaging.
8. AI-generated content
Estimates, matches, and DIY guidance are generated using AI and provided for general information only. They are not professional advice and may be inaccurate — always confirm with a licensed professional.
9. Children
The Services are not directed to children and we do not knowingly collect their personal information. We treat the minimum age as 16 (EEA/UK) or 18 where local law requires a higher threshold (including India under the DPDP Act). If you believe a child has provided us data, contact our contact form and we will delete it.
10. International data transfers
ZeroFi is operated by Nirvana Consulting Company in the United States, and we now serve users in the United States, Canada, the United Kingdom, Ireland, the United Arab Emirates, India, and Australia. Personal data may be processed in the U.S. and other countries where we or our sub-processors operate. Where we transfer data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards — the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum (IDTA), or an adequacy decision where one applies. You may request a copy of the relevant safeguard by emailing our contact form.
10b. Data breach notification
If a personal-data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected individuals without undue delay — within 72 hours of becoming aware where the GDPR/UK GDPR applies, and within the timeframes required by the India DPDP Act, the UAE PDPL, and other applicable laws.
11. Changes to this Policy
We may update this Policy from time to time. Material changes will be posted here with an updated date.
12. Contact
Questions? Email our contact form. ZeroFi is a product of Nirvana Consulting Company (ainirvana.ai).
This document is provided for general informational purposes and does not constitute legal advice.