Privacy Policy

ZoeAtlas ("we", "us") operates the ZoeAtlas directory. For privacy questions email privacy@zoeatlas.ai. Our Privacy Officer / Person in Charge of Personal Information Protection (for the purposes of Quebec Law 25) can be reached at the same address.

2.1 Information you provide

• Account details: email, name, language preference, password (hashed).
• Business listings: name, address, category, description, hours, photos, contact info.
• Pro applications: legal name, date of birth, residential address, ID documents, credentials.
• Reviews, replies, support tickets, and messages you send through the Service.
• Payment metadata via Stripe (we never see your full card number).

2.2 Information collected automatically

• Device and browser info, IP address, approximate location.
• Pages viewed, searches run, and interactions on the Service.
• Cookies and similar technologies (see §9).

2.3 Information from third parties

• Profile info if you sign in with Google (name, email, avatar).
• Payment and subscription status from Stripe.
• Identity verification result from Stripe Identity (verified / not verified — we do not store the underlying ID images on our servers).

2.4 Information collected from public sources (seeded listings)

To make the directory useful before owners arrive, we may create unclaimed business listings from publicly available sources, including: business websites, public Google Business Profile data, public Facebook and Instagram business pages, government business registries, and partner data feeds.

We collect only public business facts: business name, category, address, public phone, public hours, public URL, and a short factual description. We do not seed individual professionals listed in our "Pros" section — Pros are only added through their own application.

Our lawful basis is legitimate interest in operating a community business directory (PIPEDA s. 7(1)(d) for publicly available information; Quebec Law 25 art. 12; the CCPA's "publicly available information" exclusion for business contact data). Images displayed on unclaimed listings are drawn from the business's own public web presence; we do not independently verify copyright and do not claim a license — rights holders can request takedown at any time via the removal flow on the listing, by emailing removals@zoeatlas.ai, or via our DMCA notice. AI-assisted summaries are clearly labeled.

You can claim, correct, or remove a seeded listing free of charge at any time — from the listing page, by emailing removals@zoeatlas.ai, or via the "Remove or correct this listing" link on any listing. Verified removal requests are actioned within 7 business days.

In the past 12 months we have collected the following categories of personal information and disclosed each to the service-provider categories noted, solely to operate the Service:

Sensitive personal information: the only sensitive categories we handle are government ID information (Pros only), which is processed by Stripe Identity for verification and not used for any other purpose.

• Provide, maintain, and improve the Service.
• Process payments and manage subscriptions.
• Verify identities and fight fraud, abuse, and spam.
• Send transactional emails and SMS (receipts, security, verification codes, support).
• Send service notifications you opted into (review invites, lead alerts, reminders).
• Send marketing emails only if you opt in — you can unsubscribe at any time. See the communications policy in our Terms.
• Power AI features (description help, smart search, reply drafting, flyer generation) via the Lovable AI Gateway.
• Understand product usage with privacy-respecting analytics.

We share data only with trusted third-party service providers as needed to deliver the Service — including hosting, payments (e.g. Stripe), SMS delivery (e.g. Twilio), email, AI, analytics, and security. We also disclose information in response to legal requests where required, and to successors in a merger, acquisition, or sale of assets — with notice to you. Each provider's use of your data is governed by its own privacy policy and our service-provider agreements.

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA).

We honor the Global Privacy Control (GPC) signal sent by your browser as a valid opt-out of any future "sale" or "sharing." You can also email privacy@zoeatlas.ai with the subject "Do Not Sell or Share."

We do not use solely automated processing (without human involvement) to make decisions that produce legal or similarly significant effects about you. AI features that suggest descriptions, replies, or categories are advisory; a human always reviews moderation, verification, and account-status decisions before they take effect.

When you use AI-assisted features (description generator, smart search, review/support reply drafting), the relevant prompts and content are sent to AI providers via the Lovable AI Gateway for processing. We do not send payment information or government ID documents to AI providers. AI outputs may be inaccurate — review before publishing.

We use three categories of cookies and similar technologies. Essential cookies keep you signed in and the site functional — they are always on. Analytics cookies (Google Analytics) help us understand how the site is used. Marketing cookies (Meta Pixel) measure advertising performance. Analytics and marketing are off by default and load only after you opt in. You can change or withdraw your choices at any time from the cookie banner or the "Cookie settings" link in our footer.

When you grant marketing consent, we load the Meta (Facebook) Pixel and send a mirrored server-side signal via Meta's Conversions API. Personal identifiers (email, phone, visitor ID) are hashed with SHA-256 before being sent to Meta, and no advertising tracking happens until you opt in. Withdrawing marketing consent stops both the Pixel and the Conversions API mirror immediately.

Our infrastructure is primarily hosted in the United States. If you access the Service from Canada, your personal information will be transferred to and processed in the United States, where data-protection laws differ from those in Canada. We rely on contractual safeguards (including service-provider agreements modeled on standard contractual clauses) with our processors. By using the Service you acknowledge this cross-border transfer.

Backups are rotated on a regular schedule and may extend these periods by up to 90 days.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Opt out of marketing emails at any time.
• Restrict or object to certain processing.
• Withdraw consent (where processing is based on consent).

You can exercise most of these rights from your dashboard, or by emailing privacy@zoeatlas.ai. We will not discriminate against you for exercising your privacy rights.

California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of "sale" or "sharing," and to limit the use of sensitive personal information. As stated in §6, we do not sell or share personal information. To exercise your rights, email privacy@zoeatlas.ai. You may designate an authorized agent to act on your behalf; we will verify the agent's authority and your identity before responding.

We comply with the Personal Information Protection and Electronic Documents Act ("PIPEDA") and, in Quebec, with the Act respecting the protection of personal information in the private sector as amended by Law 25.

Privacy Officer. Our Person in Charge of the Protection of Personal Information is reachable at privacy@zoeatlas.ai.

Cross-border processing. Personal information of Canadian users is transferred to and processed in the United States by our hosting, payments, AI, and analytics providers. We have assessed the privacy risk associated with these transfers and rely on contractual safeguards with our processors. You may contact our Privacy Officer for a summary of this assessment.

Your Quebec rights. You may request access, correction, de-indexing, portability of computerized data, withdrawal of consent, or information about any automated decision-making by contacting our Privacy Officer. You also have the right to file a complaint with the Commission d'accès à l'information du Québec.

Seeded listings (Law 25 art. 8.1 notice). When we create a listing for a Quebec business from publicly available sources (see §2.4), our first outreach to the business — typically the claim invite email — identifies ZoeAtlas, states the purpose (operating a community business directory), describes the categories of information collected, names our Privacy Officer, and explains the right to access, correct, withdraw consent, or request full deletion. Quebec businesses may request full deletion (not just unlisting) by contacting privacy@zoeatlas.ai.

The Service is not intended for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us their information, email us and we will delete it.

We use encryption in transit (TLS), row-level security in our database, access controls, and regular reviews to protect your data. No system is perfectly secure. In the event of a confirmed breach of security of personal information that creates a risk of significant harm, we will notify affected individuals and applicable regulators (including, where required, the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, and state attorneys general) without undue delay and as required by law.

If you choose to connect your Google Business Profile to ZoeAtlas, we access and sync data via Google's Business Profile APIs. This is entirely opt-in and you control what is connected from your dashboard.

Data we access

• Business information (name, address, phone, hours, categories, description, photos).
• Reviews and review replies (read and, with your explicit action, reply).
• Performance insights (views, searches, calls, direction requests).
• Google Posts (read and, with your explicit action, publish or update).

How we store and protect access tokens

When you connect your Google Business Profile, Google issues an OAuth refresh token. We store this token server-side only, encrypted at rest, and use it solely to perform the sync actions you authorize. We never share your token with third parties or use it for any purpose other than the features you explicitly enable.

How we use this data

• Display your Google reviews and average rating on your ZoeAtlas listing.
• Let you draft and send review replies from your dashboard.
• Sync your business info (hours, phone, photos) so your listing stays current.
• Show performance insights and trends in your owner dashboard.
• Publish Google Posts you compose through ZoeAtlas to your Google Business Profile.

Revocation and deletion

You can disconnect your Google Business Profile at any time from your dashboard. Upon disconnect, we immediately delete your refresh token and cease all API calls. Any business data that was already synced to your ZoeAtlas listing (name, address, hours, etc.) remains as part of your listing unless you delete the listing itself. You can also revoke ZoeAtlas's access directly from your Google Account permissions page.

We may update this policy from time to time. Material changes will be announced via the Service or by email. Questions? Email privacy@zoeatlas.ai or visit our help center.