What we collect, what we don't, and why.

ZOVA is a commercial real estate deal analysis tool. We collect what we need to run the product, keep your account secure, and improve the underlying analysis — nothing more. We do not sell personal information.

Account data. When you sign in (typically via Google), we receive your name, email address, and profile image from the identity provider. We use these to identify your account and gate paid features.

Analysis inputs. Property addresses, role (buy or sell), and any thesis or notes you submit are stored against your account so you can revisit prior analyses.

Generated artifacts. BOVs, call scripts, IC memos, and other outputs produced for your account are stored so you can return to them and so we can improve future runs.

Billing data.Payments are processed by Stripe. We receive subscription status, plan, and the last four digits of the card — we never see the full card number.

Usage data. We log feature usage, request metadata, and error traces to operate the service and debug issues.

Cookies. We use first-party session cookies to keep you signed in and a small set of analytics cookies to understand which features are used.

We use the data above to:

• Authenticate your session and authorize access to paid features.
• Generate the deal analyses, dossiers, and artifacts you request.
• Bill your subscription and prevent abuse of free trials.
• Diagnose errors, monitor service health, and improve agent output quality.
• Send transactional email (sign-in, billing receipts, important service notices). We do not send marketing email without an explicit opt-in.

ZOVA combines public government datasets (Census, BLS, FEMA, FDIC, HUD, FRED, EIA, and similar) with your inputs to produce analysis. Public data is stored in our warehouse for reuse across the product.

The text of your analysis inputs and intermediate context is sent to a third-party AI inference provider to generate written output. That provider processes the text under commercial terms that prohibit training on it. We do not send your name, email, or billing information to the model.

Analyses you run may contribute aggregated, de-identified signal to a shared comp pool used to improve product quality for all users. We never expose your name, the contents of your notes, or any personally identifying detail through that pool.

We share data only with vendors that operate ZOVA on our behalf:

• Cloud hosting and database providers — to run the application and store your data.
• Authentication providers — to sign you in and keep your session secure.
• AI inference providers — to generate the written portions of your analyses.
• Stripe — billing and subscription management.
• Map and geospatial providers — to render maps and resolve addresses.
• Analytics and error-monitoring providers — to keep the service healthy.

We can share the current list of subprocessors on request — email [email protected]. We may also disclose data when required by law, to enforce our terms, or to protect the rights and safety of users. We will tell you when we can.

Account data is retained while your account is active. Analyses and artifacts are retained until you delete them or request account deletion. Billing records are retained for as long as required by tax and accounting law. Error logs are retained for ninety days.

You can request a copy of your data, correct it, or have it deleted by emailing [email protected]. Account deletion removes your analyses and artifacts; we retain only what we need for tax, legal, and fraud-prevention purposes.

If you are in California, the EU, or the UK, you have additional rights under CCPA and GDPR — the same email reaches the right team.

Data is encrypted in transit and at rest. Access to production systems is limited to a small number of engineers and gated behind SSO and short-lived credentials. No system is perfectly secure; if we discover a breach affecting your data, we will notify you.

ZOVA is built for working commercial real estate professionals. We do not knowingly collect data from anyone under sixteen.

We’ll update this page when our practices change and bump the “last updated” date at the top. For material changes we’ll send an email or in-product notice before the change takes effect.

Questions about this policy: [email protected].