Zairo Privacy Policy

The Short Version

Zairo ingests a restaurant's daily operating reports, reads them with AI, and turns them into briefs, coaching, schedules, and HR records for that restaurant's own team. Everything below is the long form of five plain statements:

• We are a business tool, not a consumer app. Accounts are created for you by the restaurant business you work for, or by us on that business's instruction. There is no public sign-up inside the mobile app, and nothing is sold inside it.
• Your restaurant's data belongs to your restaurant. Zairo holds and processes it on that business's instructions. One operator can never see another operator's stores, staff, or numbers.
• We do not sell personal information, run ads, or track you across apps and websites. There are no advertising SDKs, no analytics trackers, and no third-party cookies anywhere in the product or on this website.
• Our AI provider processes content on our behalf. Report text, uploaded documents, receipt photos, and chat messages are sent to Anthropic to be analyzed or read. It acts as our service provider, not as an independent user of the data.
• You can delete your account from inside the product — the Privacy button in the operator portal's top navigation bar, on the web and in the iOS app. A business owner can delete their entire operator account and everything under it. Section 11 walks through it step by step.

Who Does What With Your Data

Zairo is sold to a restaurant business — the "operator." The operator decides who gets an account, what stores they see, what employee records exist, and what happens to that data. In data-protection language the operator is the controller and Zairo is the processor (a "service provider"): we handle the information to run the service the operator bought, and we follow the operator's instructions about it.

That distinction matters most for employee data. If you are a general manager, shift manager, or crew member with a Zairo login, the records about you — your schedule, availability, pay rate, time-clock punches, corrective-action documents — exist because your employer put them there. Zairo does not decide what goes in your employee file.

Zairo acts as the controller for a narrow slice: the account we hold for the operator itself, our billing records, our security and audit logs, the emails you send us directly, and demo requests submitted through the contact form on this website — those come from people who are not customers yet, so there is no operator standing behind them and the decisions about that data are ours. Section 3 describes exactly what that form collects.

What We Collect

Account and contact information

• Name, work email address, work phone number
• Role (owner, area director, area leader, general manager, manager, employee) and which stores you are assigned to
• Your portal PIN or password. Every credential set or reset today is stored as a salted one-way hash, never in readable form. Accounts created before we moved to that scheme are being migrated onto it, and any reset moves an account over immediately. We never display a credential back to you, and we will never ask you for one.
• Security-question answers, stored only as one-way hashes
• Language preference and alert preferences (which SMS or push categories you want)

Employee and workforce records

• Position, sub-position, trained stations, pay rate, maximum weekly hours
• A yes/no minor flag used to enforce hour and shift rules for workers under 18. Zairo does not store dates of birth or Social Security numbers.
• Availability windows, time-off requests, published and draft schedules, shift swaps
• Time-clock punches and the timesheets built from them
• An optional employee photo, if your employer uploads one

Pay and wages, specifically. A pay rate is part of an employee record, and Zairo also computes figures from it: the cost of a scheduled or worked shift, a store's labor cost and labor percentage, and — from the weekly payroll registers an operator uploads — sales per labor hour and an average hourly rate for the period. Who may see a rate is enforced on the server, not merely hidden in the interface: every person can see their own, and only sessions at or above the wage tier (area leader and up, or an operating partner or general manager) see anyone else's; below that cutoff the rate is stripped from the response entirely. Printed schedules show an aggregate labor cost only, never a named person's pay. This is workforce compensation data — it is not a payment method, and Zairo never holds a card or bank account number for you (Section 8).

HR records

• Performance and corrective-action documents, including the situation described, the manager's write-up, and signatures captured on-screen or photographed from a signed paper original
• Photographed paper documents kept as evidence of the original signed record
• HR chat conversations with the AI assistant, and any files attached to them

Store operating data

• Daily sales, transaction counts, average ticket, sales versus forecast and versus prior periods
• Speed-of-service percentages and drive-thru times, labor percentage and labor hours, food cost, waste, upsell rate, day-part breakdowns
• Profit-and-loss records, invoices and their line items, vendor names, and cost-of-goods data
• Rolling store history used to compute baselines, records, recurring issues, and wins

Content you upload or capture

• Daily report files (XLS, PDF, CSV) and payroll or sales exports you upload
• Photos of invoices, receipts, and paper documents taken with your device camera or picked from your photo library
• Documents you attach to an HR chat

Demo requests (people who are not customers yet)

Most of this policy is about people who already have a Zairo account. The Request a Demo form on zairoai.com is the one place we collect information about someone who does not. If you submit it, we receive:

• What you type — your name, your work email address, your company, how many locations you run, and, if you choose to fill them in, a phone number and a free-text message. The message box is yours to write, so please keep employee names, personal details, and anything confidential out of it.
• Your country, as Cloudflare resolves it from the network you submitted from. It is included in the email we receive so we know roughly where an inquiry came from.
• Your IP address, which reaches the form only to rate-limit repeat submissions from one network. It is held in memory for about ten minutes and then gone — it is never stored in a database and never included in the email we receive.

What we do with it: reply to you, prepare a written quote for your store count, and keep the thread as the record of that conversation. Nothing more. What we do not do with it: we do not create an account from it, charge anything, add you to a marketing list or drip sequence, enrich it against outside data, sell it, or share it with anyone other than the email provider that delivers the message (Resend, in Section 7). If you write to us at support@zairoai.com instead of using the form, the same applies to your email.

How long we keep it: if the conversation leads to an account, your details become part of that operator's account record and follow Section 9. If it does not, we keep the thread for up to 24 months as the record of a business inquiry, and then delete it. You can ask us to delete it sooner, at any time and for any reason, by emailing support@zairoai.com — you do not need a Zairo account to make that request, and we will not ask you why.

Technical and security information

• The IP address a session is created from, and session records with their expiry
• An audit log of security-relevant actions — sign-ins, PIN changes, employee edits, schedule publishes, deletions — recorded with who did it, when, and from what IP
• On mobile, a push notification device token for the app installation — issued by Apple on iPhone and iPad, and by Google's Firebase Cloud Messaging on Android — used only to deliver alerts to that device

Where the Information Comes From

• Directly from you — what you type into the portal or the app, and what you upload or photograph.
• From a demo request you submit. If you fill in the Request a Demo form on this website, we receive what you typed, plus the country Cloudflare resolves from your connection. This is the only place we collect information about someone who is not already a Zairo user. See Section 3.
• From your employer or account administrator — the account they create for you and the employee record they maintain.
• From a reporting mailbox you configure. If your operator sets up email ingestion, Zairo connects to that mailbox over IMAP and reads the daily report emails and their attachments. It filters to the report subjects defined in the operator profile and marks what it processes as read. That mailbox is chosen and controlled by the operator.
• From Square, where it is connected. Zairo staff make the Square connection with the operator during onboarding, using the operator's own authorization — there is no self-serve connect button in the portal or the app. Once it is in place, Zairo calls Square's Payments, Locations, and Team APIs to pull daily sales totals and, optionally, the team roster.
• From public context sources. To explain why a day went the way it did, Zairo looks up local weather and public local events (for example, a stadium schedule near a store). These lookups send a store's location — never a person's. For events, that means the store's city and state, plus the store's street address sent once to a geocoding lookup that converts it into map coordinates; those coordinates are then reused to search for events within a radius of the store. For weather, it means the store's city and state, and the two backup weather sources are wired to a single fixed Kansas City coordinate rather than the store's own. No name, email address, phone number, employee record, or sales figure is ever sent to any of them, and what comes back is public information about a place, not about a person. The specific services, and exactly what each one receives, are listed in Section 7.

How We Use It

• To produce the product you bought — extract metrics from reports, analyze them, and write role-specific daily briefs, coaching, and forecasts.
• To deliver those results by email, SMS, push notification, and the web portal.
• To run scheduling — build schedules against your labor target and forecast, honor availability, time-off, hour caps, and minor work rules, and notify staff whose shifts changed.
• To run the HR features your operator enables — corrective-action documents, records, and the HR assistant.
• To send operational alerts you or your employer configured, such as a speed-of-service alert or a labor spike.
• To bill the operator and manage the subscription.
• To keep the service secure — authenticate sessions, rate-limit sign-in attempts, detect abuse, and keep the audit trail.
• To support you when you email us, and to fix bugs you report.
• To answer a demo request — reply to you, prepare a written quote for your store count, and keep the record of that conversation. We do not use it for marketing sequences or advertising.

We rely on these grounds, depending on the data and where you are: performing the contract with the operator (and, for employees, the operator's own legitimate interest in running its restaurants and meeting its employment obligations); our legitimate interest in keeping the service secure and working; our legitimate interest in responding to someone who asks us for a quote, which is the ground for demo requests; and your consent where consent is what applies — for example, allowing camera access, turning on push notifications, or opting into SMS alerts. Where consent is the basis, you can withdraw it at any time without losing access to the rest of the product — camera, photo library, and notification permissions are revoked in iOS Settings, and SMS categories are changed by asking your administrator or us (see Section 11).

AI Processing

Zairo is built on large language models. This is the part of the policy most people want in plain terms, so here is exactly what goes where.

• Anthropic (Claude) receives store metrics, the store's recent history and baselines, the operator profile, your role, and the text of chat messages you send. It produces the analysis, the coaching language, the schedule optimization, and the answers in the chat and HR assistant. HR attachments — images and PDFs — are sent to Anthropic as native content blocks and read directly by the model.
• Anthropic (Claude) also receives the raw text of report files and the images of invoices, receipts, and documents you photograph. It turns them into structured data — sales figures, line items, vendors, totals. This is the extraction step, and it is why a photo of a receipt becomes an expense record.

Anthropic acts as our service provider and processes this content to return a result to us. We use its business API; Anthropic publishes that content submitted through that API is not used to train its models. We do not send it your PIN, password, or payment details, and there is no reason for it to receive a Social Security number or date of birth because Zairo does not hold those.

Who We Share It With

Inside your company, data flows the way your operator set it up: an owner sees their whole market, an area leader sees their area, a general manager sees their store, and an employee sees their own schedule and records. Access is scoped by operator and by store, and one operator's data is never exposed to another.

Outside the company, we use these service providers. Each one receives only what it needs to do its job:

• Anthropic — AI analysis, coaching, chat, scheduling, HR assistant, and document, report, and receipt extraction. Receives operating data, history, chat content, uploaded file text, and document images.
• Resend — transactional email delivery (daily reports, invites, PIN resets, schedule notifications, security notices, and the notification email a demo request generates). Receives recipient email addresses and message content. For a demo request that means Resend carries the details you typed into the contact form, plus your email address as the reply-to.
• SendGrid — standby email delivery. The same messages fail over to SendGrid when the primary provider does not accept them, so it can receive the same recipient addresses and content.
• Twilio — SMS alerts. Receives phone numbers and message text.
• Stripe — subscription billing for operators. Receives billing contact details and handles payment card data directly; card numbers never reach Zairo's servers.
• Square — POS integration, where it is connected. We set the connection up with the operator during onboarding and exchange sales, location, and team-roster data using tokens the operator authorized.
• Google (Sheets) — where an operator uses the Sheets workbook output, report data is written to the workbook in the operator's own Google account via a service account.
• Google (Fonts) — every Zairo page loads its typefaces from Google's font service: this website, all three web portals, and all four screens bundled inside the iOS app, including the app's sign-in screen before you have signed in. That request is made by your browser or by the app on your device, so Google receives your device's IP address and standard request headers every time a Zairo page opens. It carries no account data, no cookie we set, and nothing about your restaurant — but it is a real third-party request from inside the product, not just from the marketing site, and we would rather say so than let the phrase "no third-party requests" imply otherwise. Self-hosting these fonts would remove the request entirely and is on our list.
• Apple — push notification delivery to iPhones and iPads, through the Apple Push Notification service. Receives the device token and each alert's title, short text, and routing details.
• Google (Firebase Cloud Messaging) — push notification delivery to Android devices. Receives the device's registration token and each alert's title, short text, and routing details. Google's messaging library inside the Android app also creates an installation identifier and reports the app version and the device's operating-system and library versions to Google, so that messages can be delivered. Google processes this on our behalf as a service provider. The Android app does not include Google Analytics, Firebase Analytics, or any advertising code.
• DigitalOcean — hosting. The application servers and database run on DigitalOcean infrastructure.
• Cloudflare — DNS and delivery for this website, encrypted off-site storage of database backups, and the hosting of the contact form itself. As the network this site is served through, Cloudflare handles the connection your browser makes and therefore sees your IP address; it is what tells the form your country and what lets it rate-limit repeat submissions. See Section 13.
• Public weather and event lookups — to explain why a day went the way it did, Zairo asks outside services what was happening near a store. Each receives a store location and nothing else — no names, no account details, no employee or sales data:
  • SerpAPI runs the Google Events query. It receives the store's city and state to search for events, and separately the store's street address to geocode it into map coordinates. The coordinates are cached so a given address is sent once, not on every run.
  • Ticketmaster (Discovery API) receives those geocoded coordinates and a search radius in miles; where no coordinates are available it receives the store's city and state instead.
  • wttr.in — the primary weather source — receives the store's city and state.
  • Open-Meteo and the US National Weather Service are the two weather fallbacks. Both are currently wired to one fixed Kansas City coordinate for every store, so they receive that coordinate and learn nothing about where any individual store is.

That is the full list of outside services that receive data from Zairo, and it now includes Google Fonts, which every product surface loads — an earlier version of this policy treated that as a marketing-website-only detail, which understated it. One thing genuinely sits outside the list because it receives nothing personal: an external uptime monitor, which polls a public health endpoint that returns only a status word and a timestamp.

We may also disclose information if the law requires it, to respond to a valid legal process, to protect the rights and safety of people or of the service, or in connection with a merger, acquisition, or sale of assets — in which case the information stays subject to a policy at least as protective as this one, and we will say so here first.

What We Never Do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising.
• We do not add people who contact us to a marketing list, a drip sequence, or an advertising audience. Asking us for a quote gets you a reply from a person, not a campaign.
• We do not run advertising in the product or embed advertising SDKs.
• We do not track you across other apps or websites. The iOS app declares no tracking and no tracking domains.
• We do not use third-party analytics, session recording, or marketing pixels — not in the portals, not in the app, and not on this website. We do not capture audio or video anywhere in the product, and the mobile app declares no microphone or camera-recording permission.
• We do not collect device location for tracking. Zairo works from store assignments, not from where your phone is.
• We do not store payment card numbers. Stripe and Square handle those.
• We do not use one customer's data to serve another customer.

How Long We Keep It

• Store memory — the rolling detail history a store's analysis runs on is trimmed to the most recent 90 days. Derived baselines, records, and long-run sales history are kept longer so year-over-year comparisons work.
• Account records — kept for as long as the account is active, and then handled as described in Section 11.
• Employee and HR records — kept for as long as your employer needs them, because they are your employer's employment records. Your employer decides when they go.
• Sessions — every session has an expiry, and expired or revoked sessions are cleaned out after a short grace period.
• Push notification records — a device token is switched off when you sign out, when your account is deleted, or when Apple or Google report it invalid, but the switched-off record is kept, along with a log of which alerts were sent to each device. Neither is currently deleted on a schedule.
• Audit logs — kept as a security record. When an account is deleted, its audit entries are anonymized rather than erased, so the security history stays intact without naming a person.
• Backups — encrypted database backups are taken on a nightly schedule and kept on a short rolling window of roughly two weeks, after which they age out and are deleted. A deletion you request is applied to the live system immediately; backups still holding the old data expire on that rolling schedule.
• Support email — kept as long as needed to resolve the issue and keep a record of it.
• Demo requests — if the conversation becomes an account, the details become part of that operator's account record and follow the rows above. If it does not, we keep the thread for up to 24 months as the record of a business inquiry and then delete it. Ask us sooner and we will delete it sooner. The IP address behind a submission is never retained at all; it lives in memory for about ten minutes for rate-limiting and is not written down.

How We Protect It

• Encryption in transit. All portal and API traffic runs over HTTPS with TLS certificates. The mobile app talks to the same HTTPS endpoints.
• Credentials are hashed. Portal PINs, employee passwords, and security-question answers are hashed with PBKDF2-HMAC-SHA256 at 100,000 iterations with a unique random salt each, and compared in constant time. This is the scheme every credential set or reset today goes into; accounts that predate it are being migrated onto it, and a reset moves an account over at once.
• Session tokens are long random values with a server-side expiry, tied to a user type, and revocable. Changing or resetting a credential immediately kills every live session for that user across both portals.
• Access is scoped at the server. Every request is checked against the requester's operator, role, and store assignments — not hidden in the interface and trusted from the browser.
• Brute-force protection. Sign-in attempts are rate-limited per account and per network.
• Audit logging records security-relevant actions with actor, time, and source IP.
• Backups are encrypted and stored off-site in addition to the primary host.

No system is perfectly secure, and we do not claim certification under any security or privacy standard. What we do claim is the list above, which describes how the product is actually built. If you believe you have found a vulnerability, email support@zairoai.com with the details and we will respond.

Your Choices, and Deleting Your Account

Access, correction, and deletion

You can ask to see the information Zairo holds about you, have it corrected, or have it deleted. Depending on where you live, you may have these as formal legal rights, along with the right to object to certain processing, to ask for a portable copy, and to be free from discrimination for exercising them. We honor these requests regardless of where you live.

How to exercise them: if you are an employee or manager, ask your employer's Zairo administrator first — they can act on most of it immediately. If you are an operator, or you cannot get your employer to act, email support@zairoai.com from the address on your account. We will confirm who you are before acting, and we aim to respond within 30 days.

If you only submitted a demo request and never became a customer, you have the same rights over what that form collected. Email support@zairoai.com from the address you used and ask us to delete it — there is no account to sign in to, no form to fill in, and we will not ask you to justify the request. We will confirm when it is done.

Deleting your own account, in the product

Sign in to the operator portal — on the web at dashboard.zairoai.com, or in the iOS app, which opens the same portal. The control is the button labelled Privacy in the top navigation bar, immediately to the right of Log Out. There is no separate settings menu; that button is the whole path. It opens a dialog titled Delete my account.

• If you are a general manager, area leader, or area director, the dialog asks you to type DELETE and re-enter your current PIN.
• If you are an owner, the same button opens the operator-wide version, because deleting an owner alone would strand their team. It asks for three things: your operator's name, the phrase I understand this is irreversible, and your current PIN.

When a general manager, area leader, or area director confirms:

• A confirmation email is sent to the address on the account, before anything is erased.
• Every live session for you is revoked immediately.
• Your profile record is overwritten with an anonymized stub — name, email, phone, stored credential, and security questions are cleared, and the account is marked inactive with a deletion date.
• Your entries in the audit log are anonymized, so the security record survives without identifying you.
• Operational records your store still needs to run — published schedules, invoices, sales history — stay in place, no longer linked to you by name.

When an owner confirms, the deletion cascades: every team member's user record, the store memory, the audit history, the Stripe subscription, and any Square connection. Every team member is signed out immediately. There is no undo.

One exception, stated plainly: internal Zairo staff accounts cannot be deleted through this button, because a second administrator has to authorize it. If that applies to you, the dialog says so and points you to email. Everyone else deletes from inside the product.

Communication choices

Push notifications can be turned off at any time in your device's settings — on iPhone under Settings → Notifications → Zairo, and on Android under Settings → Apps → Zairo → Notifications — and signing out of the app tells our servers to stop sending alerts to that device. Which SMS categories you receive, and the language your SMS and push alerts are written in, are set on your profile when your account is created — there is no self-serve control for them yet, so ask your Zairo administrator or email us and we will change it. The schedule portal's Español button changes that portal's display language for you on that device; see Section 13. Report and schedule emails are part of the service your employer subscribes to; ask your administrator to change who receives them.

Minors and Children

Zairo is a workplace tool for restaurant businesses. It is not directed to children, it is not marketed to children, and we do not knowingly collect personal information from a child for their own use. Nobody signs themselves up for Zairo — accounts are created by an employer, or by us on an employer's instruction.

Restaurants employ workers under 18, so employee records in Zairo can relate to a minor. Those are employment records held on the employer's behalf and handled under the employer's obligations as an employer. Zairo stores only what the scheduling rules need: a yes/no minor flag, which the scheduler uses to keep those employees off overnight windows and inside shorter shift limits. We do not store a date of birth, an age, or a Social Security number.

If you believe a child's information has reached Zairo outside of that employment context, email support@zairoai.com and we will delete it.

Cookies, the Contact Form, and the Mobile App

This website

zairoai.com is a set of static pages plus one form: the Request a Demo page at /contact. Nothing on the site sets a cookie, runs analytics, or loads an advertising or tracking script — including that page. Every page does load its typefaces from Google Fonts, which is described in the next subsection and in Section 7.

The contact form, specifically. It is served by a small program running on Cloudflare's network. Submitting it sends us what you typed — described in Section 3 under "Demo requests" — as an email, and nothing else happens: no account is created, no payment is taken, no cookie is set, no profile is built, and no advertising or analytics network is told you were there. The page is served with Cache-Control: no-store, so your browser does not keep a copy of a filled-in form.

Two things reach that program because of how Cloudflare works, rather than because you typed them. Your IP address is used only to rate-limit submissions from the same network — it is held in memory for about ten minutes, is never written to a database and never included in the email we receive. Your country, as Cloudflare resolves it from that IP, is included in the notification email so we know roughly where an inquiry came from. The form also carries one hidden field that a person never sees or fills in; if it comes back filled in, the submission is treated as a bot and discarded.

If you would rather not use the form at all, email support@zairoai.com directly — it reaches the same place.

Web fonts — every surface, including the app

Zairo's typefaces are served by Google Fonts, and this is not limited to the marketing website. The same font request is made by this site, by all three web portals, and by all four screens bundled inside the iOS app — including the app's sign-in screen, which loads them before you have signed in. Practically, that means Google's servers receive your device's IP address and the standard headers any web request carries, each time a Zairo page opens.

What that request does not carry: no cookie set by us, no account identifier, no session token, and nothing about your restaurant, your team, or your numbers. We do not receive anything back from Google about you, and no font request is used for analytics or advertising. We are naming it here because it is a genuine third-party connection from inside the product; self-hosting the font files would remove it, and we intend to.

The web portals

The portals do not use tracking cookies. Your session token is kept in your browser's localStorage, along with a few preference and offline-convenience keys — the signed-in user, your language choice on the schedule portal, whether you dismissed the install prompt, and a cached copy of roster and schedule data so the app still shows something when the connection drops. Signing out clears the session token and the signed-in user; the small display preferences stay so the portal looks the same next time you sign in, and clearing site data in your browser removes everything. The portals are installable as progressive web apps, and their service worker caches static files and API responses on your device for offline use; uninstalling the app or clearing site data removes that cache.

Language

The schedule portal — the team-facing surface, in the browser and in the iOS app — has an Español toggle on its sign-in screen and its main screen. Your choice is stored on that device and changes only what that portal displays to you. SMS and push alerts are written in the language recorded on your profile. The operator dashboard, the HR admin area, and emailed reports are English only today.

Camera and photo library

The iOS app asks for camera access to capture invoices, receipts, and paper documents, and for photo library access so you can attach an existing photo. Both prompts appear only when you take that action, and both can be denied or revoked in iOS Settings — the rest of the app keeps working. Images you capture are uploaded so they can be read and turned into records, as described in Section 6.

Face ID

After a successful sign-in the app may offer to enable Face ID (or Touch ID) so you can unlock a saved sign-in instead of retyping it. The offer is only ever made after your credentials have been accepted — the app never asks for a biometric before you have signed in. Declining is fine and changes nothing else; the app asks at most a few times and then stops, and an Enable Face ID button appears on the sign-in screen if you skipped it and later change your mind.

Your biometric never reaches us. The check is performed entirely on your device by iOS. Your face or fingerprint data never leaves your iPhone, is never accessible to Zairo, and is never transmitted to our servers — iOS only tells the app whether the check passed.

What is stored, and what happens to it. If you enable the feature, your email address and your PIN or password are written to the iOS Keychain in an item that iOS will only unlock after a successful biometric check. On the next launch the app reads that item and signs you in with it, which means the saved credential itself is sent to our servers over HTTPS at that moment — exactly as it would be if you had typed it. It is the biometric, not the credential, that stays on the device.

Removing it. The off switch is a “Turn off Face ID” button on the sign-in screen, shown whenever the feature is enabled. Signing out no longer clears the saved sign-in: signing out ends a session, and erasing the enrolment every time made the feature unusable in practice. What signing out does do is stop the app offering to unlock automatically on the next launch, so whoever just signed out is not signed straight back in — the button is still there if you want it. On a phone more than one person uses, tap “Turn off Face ID” before handing it over: iOS unlocks the saved item for any face or fingerprint enrolled on that device, not only yours. Deleting your account clears it too, once the deletion is accepted. A session simply expiring does not clear it, because that is exactly the case Face ID is for — you unlock and carry on. The credential is also dropped automatically whenever it stops working: if your PIN or password is changed or reset, the saved copy is rejected on the next attempt and the app deletes it and asks you to sign in normally. Deleting the app removes it as well, along with everything else the app stored on your device.

Push notifications

On iPhone the app gets a device token from Apple's Push Notification service; on Android it gets one from Google's Firebase Cloud Messaging. After you sign in, the app asks for permission to show notifications (on Android this system prompt appears on Android 13 and later), and it sends the token to Zairo so alerts about your schedule, your requests, announcements, and messages can reach your phone. The token identifies an installation of the app on a device, not you personally. To deliver an alert, we send Apple or Google the token together with the alert's title, a short line of text, and a few routing details, such as which screen to open. Alert text is kept short and can include a coworker's name, dates, a store number, or an announcement's title and text; it never includes the content of a message you send or receive. Apple and Google handle this as our service providers.

Signing out tells our servers to stop sending to that device, deleting your account in the product does the same for every device you signed in on, and tokens that Apple or Google report as no longer valid are switched off. We keep a record of switched-off tokens, and a log of which alerts were sent to which device and whether Apple or Google accepted them (the log keeps a fingerprint of the alert text, not the text itself); neither is currently deleted on a schedule. Turning notifications off in your device settings stops alerts from being shown.

Tracking

The app's privacy manifest declares no tracking and no tracking domains, and the app never asks for permission to track you, because it does not. Nothing in the app is collected for advertising, analytics, or personalization.

What the App Store privacy labels say

Apple asks every app to declare the categories of data it collects. Zairo declares nine, listed below. Every entry is marked linked to your account, used for app functionality, and not used for tracking — there are no other purposes and no other categories:

• Contact Info — email address: your sign-in identity, and where reports and alerts are sent.
• Contact Info — name: your display name, and the names on employee records your managers create.
• Contact Info — phone number: SMS alerts, and the phone numbers on employee records so a manager can call a shift.
• Financial Info — other financial info: employee pay and wages. Apple counts salary in this category, and the app puts a wage figure on screen in four places — every person can see their own pay rate; managers cleared for it see the rates on their roster; the profit-and-loss labor line is computed from payroll hours and those rates; and an average hourly rate is reported from the weekly payroll registers an operator uploads. It is workforce pay data, not a payment method — the app takes no payment of any kind, and card numbers never reach Zairo's servers at all (Section 8).
• User Content — photos or videos: the invoice, receipt, and document images you capture or attach.
• User Content — other content: assistant chat messages, store operating data, schedules, and HR and performance records.
• Identifiers — user ID: your account and session identity, used to route alerts to the right person.
• Identifiers — device ID: the Apple push notification token for this installation, if you allow notifications.
• Usage Data — product interaction: the security audit trail described in Section 3 — sign-ins, credential changes, record edits, deletions — kept with the actor, the time, and the source IP address, for security and fraud investigation only.

These same nine types appear in three places, deliberately worded to match: the labels on the App Store product page, the privacy manifest compiled into the app, and this list. It is meant to be read alongside Section 3, which describes the same information in more detail and in plain language. If the two ever disagree, Section 3 is the fuller description and this list is the Apple-category summary of it; tell us and we will correct whichever is wrong.

One clarification, because Section 3 is broader than this list. The demo-request form described in Section 3 is on the website only. It is not in the iOS app, it is not linked from the iOS app, and the app collects nothing through it — so it is deliberately absent from the App Store labels above. Consistent with that, the app contains no sign-up, no plan selection, and no purchase of any kind.

On Android, the Google Play listing's Data safety section describes the same information in Google's categories. The one difference in the app itself is the push identifier: under Device or other IDs, the Android app declares the Firebase Cloud Messaging registration token and the Firebase installation identifier that Google's messaging library creates, alongside the identifier used for over-the-air app updates — all used for app functionality, none for advertising or analytics.

Changes, Transfers, and Contact

Where your data is processed

Zairo is operated from the United States, and the service providers listed in Section 7 process data in the United States. If you use Zairo from outside the United States, your information will be transferred to and processed there.

Changes to this policy

When this policy changes, we update the page and change the "Last updated" date at the top. If a change materially affects how we handle personal information, we will email the account administrators at each operator before it takes effect. Continuing to use Zairo after a change means the updated policy applies.

Contact us

Questions about this policy, or a request about your information:

• Email: support@zairoai.com — response within 24 hours
• Zairo LLC · Kansas City, KS

One address you may also see, and what it is for. Inside the product, and on parts of this website, you will find reports@zairoai.com. That is Zairo's report-intake mailbox: it is the address operators forward their daily and weekly store reports to, and it is polled automatically by the ingestion pipeline. A few screens in the product also point at it for help. For anything that needs a person — a privacy request, a deletion request, a support question, or a security report — write to support@zairoai.com, which is the address on this page and on the Support page and the one that is monitored for replies. Mail sent to the intake address is not lost, but it goes to the queue that reads reports first.

For help using the product, see the Support page.