Privacy Policy

This Privacy Policy explains how Zarlo ([ZARLO LLC — LEGAL NAME PENDING FORMATION], “Zarlo,” “we,” “us,” or “our”) collects, uses, and shares information when you use the Zarlo platform (the “Platform”). It applies to all users regardless of location, and includes additional disclosures for users in the European Economic Area, UK, and Switzerland (“EEA”) and for California residents, as described below.

1. Information We Collect

Information you provide directly

• Account information: name, email address, password, and account role (Consumer or Business Owner).
• Business listing information, if you are a Business Owner: business name, website, category, description, and pricing details.
• Reviews and other content you submit to the Platform.
• Billing information, which is collected and processed directly by Stripe, our payment processor. Zarlo does not directly store your full payment card number.

Information collected automatically

• Usage data such as pages viewed, saved listings, and general interaction with the Platform.
• Authentication and session cookies, described further in our Cookie Policy.

2. How We Use Information

We use the information described above to:

• Create and maintain your account;
• Process subscription payments and renewals;
• Operate the directory and editorial features of the Platform, including displaying listings and reviews;
• Send transactional emails, such as sign-up confirmation codes, billing receipts, and account notices;
• Maintain the security and integrity of the Platform, including detecting fraud and abuse; and
• Comply with legal obligations.

3. Legal Basis for Processing (EEA Users)

If you are located in the EEA, we rely on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract — processing necessary to provide the Platform and fulfil your subscription;
• Legitimate interests — such as maintaining security, preventing fraud, and improving the Platform, balanced against your rights;
• Consent — where required, such as certain optional communications; and
• Legal obligation — where we must retain or disclose information to comply with law.

4. How We Share Information

Zarlo does not sell your personal information. We share information only with the following categories of service providers, each of whom processes data on our behalf and under contractual confidentiality and data-protection obligations:

• Supabase — database hosting and authentication.
• Stripe — subscription billing and payment processing.
• Resend — delivery of transactional emails (e.g. sign-up confirmation codes, receipts).
• Vercel — application hosting.

We may also disclose information if required by law, subpoena, or legal process, or to protect the rights, property, or safety of Zarlo, our users, or the public.

5. International Data Transfers

Zarlo is based in the United States, and the service providers listed above may process data in the United States or other countries. Where we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as Standard Contractual Clauses, as provided by the relevant service provider.

6. Data Retention

We retain account information for as long as your account is active, and for a limited period afterward as needed to comply with legal, tax, or accounting obligations, resolve disputes, and enforce our agreements. Reviews and listing content may persist after account deletion where they do not, on their own, identify you personally.

7. Your Rights — EEA, UK & Switzerland

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data;
• Request restriction of, or object to, certain processing;
• Request a portable copy of your data; and
• Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at support@zarlo.io.

8. Your Rights — California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to:

• Know what personal information we collect, use, and disclose;
• Request deletion of your personal information;
• Request correction of inaccurate information;
• Opt out of the sale or sharing of personal information — Zarlo does not sell or share personal information for cross-context behavioral advertising; and
• Not receive discriminatory treatment for exercising these rights.

To submit a request, contact support@zarlo.io. We may need to verify your identity before completing a request.

9. Other US State Privacy Rights

Residents of other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, and others as they take effect) have similar rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of certain processing. You can exercise these rights using the same contact method above; we will honor applicable state-specific requirements when responding.

10. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and role-based access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Platform is not directed to, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last updated” date on this page and, where required by law, additional notice.

Contact