Privacy Policy

This policy explains how [company legal name] ("we", "us") handles personal information in connection with Zrico. Zrico is a private AI workspace for law firms, accounting firms and insurance brokers.

It covers three places where we handle information:

• The marketing site at zrico.com.
• The dashboard at app.zrico.com, where firms sign up, manage seats and pay.
• Workspaces at {slug}.zrico.app, where a firm's people use AI models.

The short version:

• We do not sell or share personal information, as those terms are defined in US state privacy laws.
• We do not use advertising trackers or analytics cookies.
• Content in a firm's workspace belongs to the firm. We process it only to run the service, under our Data Processing Addendum.

1. The marketing site

No trackers. The marketing site does not use analytics cookies, advertising pixels or third-party tracking scripts.

Security processing. The site is hosted and protected by Cloudflare. Cloudflare processes your IP address, browser details and request data to deliver pages, stop attacks and block bots. Forms may use Cloudflare Turnstile to check that you are a person. Cloudflare may set strictly necessary security cookies.

Contact and demo requests. If you use the contact or demo form, we collect what you enter, such as your name, work email, firm name and message. We use it to reply to you. Form messages are delivered to us by email through Resend.

2. The dashboard

When a firm signs up, we collect:

• Account data: names, work email addresses, roles (owner, admin, member), hashed passwords and two-factor authentication settings.
• Firm data: firm name, workspace address, seat count, logo, sign-in settings and retention settings.
• Billing data: billing contact details and subscription status. Payments are processed by Square. Square collects your card details directly. We do not receive or store full card numbers. We keep only Square's reference IDs for the customer and card.
• Records of activity: an audit log of important account actions, such as invites, seat changes and setting changes.

We use this information to create and run the firm's account, bill for it, secure it and send service emails (for example, invites, payment notices and security notices). Service emails are sent through Resend.

3. Workspaces and customer content

Inside a workspace, people type prompts, upload files and receive AI responses. We call this customer content. Customer content can include personal information about the firm's clients and others.

For customer content:

• The firm is in control. The firm decides what goes into its workspace and how long it stays there. We act as the firm's processor (or "service provider" under US state privacy laws).
• We use it only to provide the service. That means storing it, searching it, sending it to the AI model the user chose, and backing it up. We do not use it to train AI models, and we do not use it for advertising.
• Our Data Processing Addendum governs it. See /legal/dpa.
• Each firm is isolated. Each firm has its own workspace, databases and networks. Firms cannot reach each other's data.

If you are a client of a firm that uses Zrico and you have a question about your information, please contact the firm directly. We will help the firm respond.

We also keep workspace account data (names, email addresses, sign-in records) so people can sign in. For workspaces using email sign-in, invites and password resets are sent through Resend.

4. AI providers

When a user sends a message, the workspace sends the prompt and the related context to the AI provider for the model the user picked: Anthropic, Amazon Web Services (Bedrock) or OpenAI. Our AI gateway does not store prompts or responses. It stores only usage metadata: the user's email, the model, token counts and cost.

The providers do not train on this data under their API terms. Each provider keeps data for a limited time for abuse monitoring. See How AI providers handle your data for details and links.

5. Subprocessors

We use a small number of service providers to run Zrico. They are listed, with what they do and where, at /legal/subprocessors.

6. How long we keep information

• Chat history in a workspace: as long as the firm chooses. The firm can keep it, or have it deleted automatically after 30, 90 or 365 days.
• After cancellation: the workspace keeps working until the cancellation takes effect (the end of the free trial if the firm cancels during it, otherwise the end of the paid month). It is then suspended and deleted 30 days later. During those 30 days we offer the firm an export by email.
• Backups: we take encrypted backups every night. We keep 7 daily, 4 weekly and 12 monthly backups. This means deleted data can remain in encrypted backups for up to about 12 months before it ages out. We do not restore deleted data from backups except to recover the service or when the firm asks us to.
• AI usage records: usage metadata in our AI gateway (user email, model, tokens and cost) is kept for 400 days for billing and support.
• Dashboard and billing records: kept while the firm's account is active and afterward as long as needed for tax, accounting, legal and dispute purposes.
• Contact form messages: kept as long as needed to respond and follow up, then deleted.

7. Security

We use measures designed to protect information, including:

• Encryption in transit (TLS) and encrypted backups.
• A separate, isolated stack for each firm.
• A web application firewall and intrusion blocking at the edge. Our servers accept traffic only through Cloudflare.
• Two-factor authentication required for dashboard owners and admins, and offered to every workspace user.
• Logs that do not contain secrets, prompts, responses or file contents.

No system is perfectly secure. We do not hold SOC 2, ISO or other certifications. If you find a security problem, email security@zrico.com.

8. Your rights

US state privacy laws. Depending on where you live (for example, California under the CCPA), you may have the right to:

• know what personal information we hold about you and how we use it;
• get a copy of it;
• correct it;
• delete it;
• opt out of sale, sharing for targeted advertising, and certain profiling. We do not do any of these.

We will not treat you differently for using these rights. You can use an authorized agent. We may need to verify your identity before acting on a request.

EEA and UK individuals. If GDPR or UK GDPR applies to you, you also have the rights to access, correct, delete, restrict or object to processing, and to data portability. You may complain to your local data protection authority. Where we are the controller (for example, for marketing site enquiries and dashboard accounts), we rely on these legal bases: performing our contract with the firm, our legitimate interests in running and securing the service, and legal obligations.

Customer content. For information inside a firm's workspace, the firm is the controller. We will pass your request to the firm or help the firm answer it.

How to ask. Email support@zrico.com. We aim to respond within the time the law requires (generally 45 days under US state laws, one month under GDPR).

9. Children

Zrico is a business service for professional firms. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

10. International transfers

We process and store information in the United States. Our workspace servers are in a US data center, and we route AI requests only to US processing. Cloudflare's network processes traffic at the edge location nearest the visitor, which may be outside the US. If you are outside the US, your information will be transferred to the US. Where the law requires it, we use appropriate safeguards for those transfers, such as standard contractual clauses.

11. Changes to this policy

We may update this policy. We will change the "Last updated" date above. If a change is material, we will email firm owners before it takes effect.

12. Contact

• Company: [company legal name]
• Postal address: [company address]
• Email: support@zrico.com
• Security issues: security@zrico.com