Privacy policy

This policy explains what information Zome collects through zome.io, how we use it, who we share it with and the choices you have. It covers the website, the free AI report and the demo request form. It also explains, in general terms, how we handle information when we provide services to businesses.

In this policy, "Zome", "we", "us" and "our" mean the business that operates zome.io and provides the Zome services. "You" means anyone who visits the site or contacts us.

The short version

The site does not set cookies and does not use analytics, advertising pixels or other tracking tools.
The free AI report is built when you ask for it and is not saved by Zome. To build it, some of what you enter is shared with Google and Anthropic, and our scanner visits the website you give us.
When you request a demo, your details are forwarded to the system we use to manage demo requests so we can contact you. Our website server does not keep a copy.
We do not sell personal information or share it for targeted advertising.
You can contact us about your information at any time through our contact page.

Information we collect and how we use it

When you visit the site

Our site is hosted by Vercel. Like any web host, Vercel receives technical information when your browser requests a page, such as your IP address, your browser and device type, the address of the page requested and the time. Vercel uses this to deliver the site and protect it from abuse, and it may keep this information in logs for a limited time under its own terms.

Some requests carry what you typed in the web address itself. For example, business name suggestions on the report page are fetched with your search text in the address, and the link from a finished report to the demo page carries your report details. That text can appear in the same technical logs.

We do not use this information to build profiles of visitors. The site's fonts, images and videos are served from our own site, and we don't load scripts or media from other companies when you view a page.

When you use the free AI report

The report asks for your business name, your trade and your city or area, and optionally your website address and your average job value. You don't need an account, and the report doesn't ask for your name, email address or phone number.

Here is what happens to what you enter:

Business name suggestions. After you type a few characters, your search text and the city you entered are sent to Google to suggest matching businesses. If you pick a suggestion, we use Google's identifier for that business (a "place ID") to look it up.
Website check. Our server visits the website address you entered or, if you didn't enter one, the website listed on the business's Google profile. Before connecting, it checks that the address points to a public website. It requests only the homepage (following up to five redirects), checks whether the plain http:// address forwards to the secure https:// one, and requests the site's robots.txt file and one sitemap. It does not follow links to other pages. It identifies itself to the website as "ZomeHealthCheck".
Google PageSpeed Insights. We send the website address to Google. Google's servers load the page to measure mobile speed, search basics and accessibility.
Google Places. To find the business's Google profile, we send Google the business name and city (or, if you only gave a website, the first part of its domain name), or the place ID you picked. We also send a search built from your trade and city, such as "plumber in Denver, CO", to see which businesses rank. Google returns public business information such as names, addresses, phone numbers, websites, star ratings, review counts, photo counts, opening hours and business types.
AI summary from Anthropic. To write the summary at the top of your report, we send Anthropic's Claude service a structured list of the findings. That list includes the business name, trade and city; the scores; the issues found, with details and suggested fixes; the titles of the checks that passed; the business's Google rating, review count and ranking position; the public names, ratings and review counts of up to three competing businesses; the notes explaining what was and wasn't checked, which can mention your website's domain name; and, if a missed-revenue estimate was calculated, the estimate, including the average job value you entered. We never send the content of your website's pages. If the AI summary isn't available, the summary is written by fixed rules on our server instead.

If Google or the AI service can't be reached, the report skips the related checks and says so.

We don't save your report. The report is put together in our server's memory, sent to your browser and then discarded. Each report gets a random reference number that starts with "rpt_", but that number isn't linked to any stored record, so we can't retrieve a report later. If you choose "Fix it with Zome" from a report, the reference number and the business name, trade, city and website are carried to the demo page to fill in the form for you. Nothing from the demo form reaches us until you submit it.

The report also shows public Google information about other businesses near you, such as their names, star ratings and review counts. We show this only for comparison.

When you request a demo

The demo form asks for your business name, trade and city, your name, and an email address or mobile number, plus your website if you want to share it. Along with what you type, the form sends the name of the page you used, the report reference number if you came from a report, the time of your request and your browser's user agent (a short description of your browser and device). It does not send your IP address.

Our server checks the details and forwards them over an encrypted connection to the system we use to manage demo requests. Our website server does not keep a copy and does not log what you entered. If forwarding fails, the form tells you that your request couldn't be sent, and nothing is kept.

We use these details to arrange and hold your demo, to answer your questions and to follow up about Zome. We won't add you to marketing emails or texts unless you agree.

When you message us on Instagram

If you contact us through Instagram, Instagram (part of Meta) handles your messages under its own terms and privacy policy. We see your profile details and what you send us, and we use them to reply.

When your business becomes a Zome customer

If your business subscribes to Zome, we collect the information we need to set up, provide, support and bill the services. That includes your business details, the contact details of your team, the account access you give us and the content you provide. Your customer service agreement also covers how we handle this information.

Information we handle for businesses that use Zome

Zome's services help businesses take booking requests, reply to messages, send review requests and follow up with their customers. These features roll out in stages. When a business uses them, we handle information about that business's customers on the business's behalf and follow its instructions. The business decides what information is collected and how it's used. It is responsible for its own privacy notice and for getting any consent the law requires.

If you're a customer of a business that uses Zome, please contact that business first about your information. You can also reach us through our contact page. We'll pass your request to the business and help it respond.

Keeping the site secure

To prevent abuse, our servers limit how many reports, business searches and demo requests can come from one connection in a short time. To do this, they hold your IP address temporarily in memory. It isn't written to a database. Our code is written so that error records contain only a short error code or message, not the contents of the report or demo forms.

Why we can use your information

Where the law requires a legal basis for using personal information, for example in the European Economic Area and the United Kingdom, we rely on:

Our legitimate interests in building the report you asked for, responding to you and keeping the site secure
Steps you ask us to take before a contract, such as arranging a demo
Performing a contract when your business subscribes
Legal obligations, such as keeping business and tax records
Your consent where the law requires it, such as for marketing messages. You can withdraw consent at any time.

We share information only with the service providers that help us run the site and our services, and only as this policy describes:

Vercel hosts the site and runs the server code for the report and the demo form.
Google provides business search, business and ranking information (the Places API) and mobile speed testing (PageSpeed Insights) for the report.
Anthropic writes the AI summary for the report.
Our demo request system receives demo requests so we can reply to them.
Instagram (Meta) handles messages if you choose to contact us there.

Each provider handles information under its own terms.

We may also disclose information when the law requires it, to protect our rights, the safety of others or the security of the site, and to our professional advisers. If Zome is involved in a merger, acquisition or sale of assets, information may pass to the new owner, who may use it only as this policy describes unless it tells you otherwise.

We don't sell personal information, and we don't share it for targeted advertising.

Cookies and tracking

The site does not set cookies, and it doesn't use analytics tools, advertising pixels, social media plugins or session recording.

The site stores one small setting in your browser's local storage. If you close the announcement bar at the top of the page, your browser remembers that choice (under the name "zome-annc") so the bar stays hidden on later visits. This setting stays on your device and isn't sent to us. You can clear it at any time in your browser settings.

If we add cookies, analytics or similar tools, we'll update this policy first and ask for your consent where the law requires it.

How long we keep information

Reports: not stored. They're discarded as soon as they're sent to your browser.
Business search text: not stored by our code. It may appear in our host's technical logs for a limited time.
IP addresses used for rate limiting: held only in server memory, for a short time.
Hosting logs: kept by Vercel for a limited period under its own terms.
Demo requests and messages: kept only as long as we need them to reply, arrange your demo and follow up. If your business becomes a customer, we keep them for the length of the relationship and any period the law requires after it. You can ask us to delete them sooner.

How we protect information

The site and all form submissions use encrypted (https) connections.
Responses from our report and demo request servers are marked so that browsers and networks don't store copies.
Demo requests are forwarded only over encrypted connections.
The keys we use to access Google and Anthropic stay on our servers and are never sent to your browser.
Our scanner refuses to connect to private or internal network addresses.

No way of sending or storing information is completely secure, but we work to protect the information we handle.

International transfers

Our providers operate in the United States and other countries, so your information may be processed outside the country where you live. Where the law requires it, we rely on the safeguards our providers offer, such as standard contractual clauses.

Your rights and choices

You choose what to enter in the report. The website and average job value are optional.
You can ask us to access, correct or delete personal information we hold about you.
Depending on where you live, you may also have the right to object to or restrict certain uses, to receive your information in a portable format, to withdraw consent, and to appeal if we decline your request.
We won't treat you differently for exercising your rights.
You can complain to the data protection authority where you live.

To make a request, contact us through our contact page. We may need to confirm your identity before acting on it, and you can use an authorized agent where the law allows. Because we don't store reports, we won't hold any report data to return or delete.

Children

The site and our services are meant for business owners and their teams. They're not directed at children, and we don't knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we'll delete it.

Changes to this policy

Zome is onboarding founding partners, and features roll out in stages. We'll update this policy when what we collect or how we use it changes, and we'll change the date at the top. If a change is significant, we'll make it prominent on the site or tell customers directly.

Contact us

If you have a question about this policy or want to make a request about your information, please use our contact page.

Questions about this page? Contact us.