Privacy Policy

This is Zorva Labs’ privacy policy for zorvalabs.com. It says what the site keeps when you visit it, run one of the free tools, ask for a proposal, talk to our assistant or pay for a service, and who else sees it. Our Terms of Service cover the work itself.

The proposal and contact forms ask for your name, email, phone, company or website, what you’re interested in and a message, and some ask where you work and whether you run ads. Along with your answers we keep the page you sent them from, how you arrived (the referring site and any campaign tags), your browser’s user-agent line and a salted, one-way hash of your IP address. It all goes into our database, and an email lets us know it came in.

To know which search, ad or link a request came from, the first page of your visit sets one cookie that lasts until you close the browser. It holds the referring site, any campaign tags on the link, the first page you landed on, your device type and the time you arrived, and it carries no identifier. When you send a form, that cookie and the city, network and time zone your connection reports are saved with the request and shown in the email that lets us know it came in. Blocking cookies in your browser leaves the form working and the source marked unknown.

To keep out automated submissions, each form also notes how long it was open before you pressed send and carries a hidden field that people never see. A request that looks automated goes into a separate log instead, with the same details and no email, so we can still find it if a real person was caught by mistake.

Requests we mark as spam, or as leads that went nowhere, are deleted automatically after 90 days.

• The website scan reads the site you name the way a search engine would, from its pages to how it answers AI crawlers, and asks Google’s PageSpeed service to time it. Its report is saved at a link of its own, which search engines are told not to index, and a scored report can appear on our leaderboard. To stop abuse we count scans per network, using a hash of your IP address rather than the address itself.
• The AI answer check and the backlink check keep the business name or domain you enter with its result, and answer a repeat within 30 days from that copy. The backlink check gets the links from DataForSEO.
• None of the tools needs your contact details. If you ask for the follow-up under a result, what you enter is saved with the result, the same way as a proposal request.

What you ask Zorva is sent to the AI service that writes its replies. We keep each question and answer with the page you asked from, a session id and a hash of your IP address that changes every day, which is how we cap the assistant at 30 questions a day per visitor. Please leave personal or sensitive details out of it.

Checkout asks for your name, email and phone. Your card goes into Stripe’s own payment form and straight to Stripe, never to us. From Stripe we keep a record of the subscription: your name, email and phone, the website it’s for, the plan and whether the invoices are paid.

A proposal we send you opens at a private link. We record when you first open it, and when you accept it we keep the name you type, the time and a hash of your IP address as the record of your acceptance, then the time you finish paying in Stripe’s checkout.

Files a client sends through our upload page are stored in our cloud storage with their project.

The server writes down each page it sends you: the address, the site or search that sent you, the kind of device and browser, and the city, region and network Cloudflare reports for your connection. Your IP address isn’t kept. While a page is open, it reports how many seconds you spent on it, and when you tap a phone number or an email address or send a form, it reports that too, with where your visit began (from the visit cookie above). The log sits in our own database at Cloudflare and holds no name or contact details.

The site runs Google Analytics, the Google Ads tag and the Meta Pixel. They see the pages you view, and they’re told when a request or a purchase goes through. Google Analytics also hears when a scan finishes, with its score, and when you ask for a scan’s follow-up, with the domain. Each sets cookies of its own. Google handles its data under its privacy policy and Meta under its own. Google’s opt-out add-on turns off Google Analytics, and blocking this site’s cookies in your browser limits all three.

Cloudflare hosts the site and, like any host, sees your IP address when it sends you a page. Proposal requests, proposals and billing records are kept in Cloudflare’s database, and the note that tells us about a new request goes out through Cloudflare’s email service. Scan results, the assistant’s log and our sign-in run on Supabase, the rest of the email the site sends goes out through Purelymail, and uploaded files sit in Cloudflare’s storage. The typefaces are served from this site. Visitors outside the United States, Canada and the United Kingdom are turned away, going by the country Cloudflare reports for the connection.

To ask what we hold about you, or to have it corrected or deleted, email michael@zorvalabs.com or call or text (629) 298-8241.