Privacy Policy

This policy explains what YorkNine Inc., operating as Zoraveo ("we", "us") collects when you use Zoraveo Reports, why, who handles it, and what you can do about it. We collect little: there are no accounts, no advertising and no third-party analytics.

1. What we collect and why

• Email address. You give it when you start an order. We use it to email the link to a report you paid for, to pre-fill the payment page, and to answer you if you write to us. It is stored when you start an order, even if you do not go on to pay. If you enter it on the My reports page, we use it to find the reports paid for with it and to email you a link to that list.
• Property address and location. The address you ask about, and the map coordinates for it. We use them to produce the report.
• The report. The measurements or storm records we produce for the address, stored so that your link works.
• Order and payment records. Which report you ordered, its number and status, the amount and currency, the dates, and Stripe's reference numbers for the payment, or for a purchase in our apps the App Store or Google Play transaction record (its reference numbers, product, price, store country and whether it was a test). We also keep a short log of what happened to the order (created, previewed, paid, emailed, refunded, and any error). We use these to deliver the report, handle refunds and disputes, and keep tax and accounting records.
• A coded form of your IP address. When you start an order we turn your IP address into a keyed hash and store the hash with the order. We use it to limit how many orders one connection can start in an hour. When you ask for your list on the My reports page, we keep the same kind of hash of your IP address, and of the email address a link was sent to, in our log, to limit how often links can be requested. We do not store the IP address itself in our database.
• What you write to us. If you email us, we keep the message and our reply.

Card details. You enter them on Stripe's payment page, or they are held by Apple or Google when you buy in our apps. They never reach our servers and we cannot see them.

What we do not collect. We do not ask for your name, phone number or a password. We do not collect information about who owns or lives at a property. We do not buy information about you.

2. Cookies, tracking and your browser

• Our website sets no cookies. We use no advertising or tracking tools and no third-party analytics, and we do not track you across other websites. We count how many times our main pages are opened, as daily totals kept on our own servers. The count uses no cookies and no visitor identifiers, stores no IP address or browser details, and cannot be linked to you. Because of that, "Do Not Track" and similar browser signals change nothing. We do not let other parties collect information about your activity over time and across websites through our site.
• Our pages save display choices, such as light or dark theme, or that you closed the "add to home screen" note, in your own browser's local storage. They stay on your device and are not sent to us.
• Our pages load their typefaces from Google Fonts. To deliver them, Google receives your IP address and browser details. Google states that this service sets no cookies and that it does not use the information for profiles or advertising.
• Stripe's payment page is run by Stripe and may use its own cookies and device information, mainly to prevent fraud. Stripe's privacy policy (stripe.com/privacy) applies there.
• Like any website, our host keeps short-lived technical logs of requests. See Cloudflare below.

3. Legal basis and consent

We collect, use and disclose personal information only for the purposes in this policy. You consent to that when you give us an address and an email and start an order. We need the information to provide the report you asked for. We also rely on our legitimate need to prevent abuse and fraud, and on legal duties to keep tax and accounting records. You can withdraw consent by writing to us, subject to legal limits; we may then be unable to keep a report available to you.

We send one email per paid order, with the link to the report. If you ask for your list of reports on the My reports page, we send one email with a link to that list, only to an address that has a paid report. We may also reply to messages you send us. We do not send marketing email.

4. Who handles the information

We do not sell personal information, and we do not share it for advertising. We use these service providers. Each receives only what it needs for its task:

• Cloudflare runs the website. Every request passes through it. It keeps technical request logs for us for a few days, which can include the page address requested and connection details. When our order and My reports forms use Cloudflare Turnstile to check that you are a person, Cloudflare receives your IP address and browser details for that check (Cloudflare's Turnstile privacy addendum applies).
• Supabase hosts the database of orders and reports. Our database is located in the United States (Virginia).
• Stripe takes payment. It receives your email address, the amount, a description that includes the property address and report number, and the card details you give it. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy.
• Apple and Google take payment when you buy a report in our iPhone or Android app. They hold your account and payment details under their own privacy policies. They send us a signed record of the purchase, which we check with them before unlocking the report, and they tell us when a purchase is refunded.
• Google provides address suggestions. The text you type in the address box is sent from our servers to Google's Places service to suggest matching addresses; Google's privacy policy applies to it there. The suggestions are shown to you and not stored.
• Geoapify provides address suggestions when Google offers none, and address location when Geocodio cannot place a house. The text you type in the address box, and the address you submit in that case, is sent from our servers to Geoapify.
• Geocodio provides address location and some address suggestions. The address you type or submit is sent from our servers to Geocodio to find the matching address and its coordinates.
• Mapbox is used only as a fallback for those two tasks, when Geoapify or Geocodio is not in use. It then receives the same text or address from our servers, for the same purpose.
• Resend sends the report email and the My reports email. It receives your email address and the content of the message, which includes the property address and the report link, or the link to your list of reports.
• Google serves the typefaces, as described in section 2.

To build a report, our servers also ask public data services for the elevation data, building outlines, aerial photos or weather records around the location. These services are run by or for the U.S. Geological Survey, Natural Resources Canada, the Government of Ontario, Esri (which hosts the building outline data), the US National Weather Service, NOAA and Iowa State University. They receive a location or map area. They do not receive your email address.

We may also disclose information where the law requires it, to enforce our terms or respond to a payment dispute, or to a buyer of the business, who must honour this policy.

5. Processing outside your province or country

We are based in Canada. Our service providers process information in the United States and in other countries where they or their suppliers operate. Information processed in another country is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities. We remain responsible for information handled for us, and we use providers that commit by contract to protect it. Write to us if you have questions about this.

6. How long we keep it

• Paid reports, with the address and location: at least 12 months after purchase, so your link works. After that we may delete the report content.
• Previews that are not paid for, with the email and address given: up to 30 days.
• Order and payment records (email, report number, amount, dates, Stripe references): up to 7 years, for tax and accounting.
• The coded IP address: up to 30 days for unpaid previews. For paid orders it is kept with the order record as evidence if a payment is disputed.
• Emails you send us: up to two years after the last message.
• Host logs: a few days, set by Cloudflare. Resend keeps records of sent emails for about 30 days.

You can ask us to delete a report and your email address sooner. We will, except for records the law requires us to keep.

7. Security

• The website is served only over encrypted connections (HTTPS).
• Only our server can read or write the database. It has no public access.
• Card details are handled only by Stripe.
• IP addresses are stored only as a keyed hash.
• Report links contain a long random code, are not listed anywhere, and are marked so that search engines do not index them. Anyone who has a link can open the report, so share it with care.
• The link to your list of reports is sent only to the email address the reports were bought with. It is signed, and it stops working after 30 minutes.

No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the regulators as the law requires.

8. Property addresses and third parties

The address you enter may be someone else's home. A report is about a building or a location, not about a person. A roof report is computed from elevation data and building outlines that governments and open-data projects publish. A storm report lists public weather records near a location. We do not add names, or any information about owners or occupants, to a report, and a report contains no photograph of the property.

If you own or live at a property and want a stored report about it removed, write to us with the address. We will review the request and answer within 30 days.

9. Your rights

Wherever you live, you can ask us:

• what personal information we hold about you, and for a copy;
• to correct it;
• to delete it, subject to records the law requires us to keep;
• how it has been used and who has received it.

Write to hello@zoraveo.com. Tell us the email address used for the order and, if you have it, the report number. We will confirm the request by replying to that email address. We answer within 30 days, at no charge. We will not treat you differently for making a request.

Canada

These rights are set out in the Personal Information Protection and Electronic Documents Act (PIPEDA) and in provincial laws. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or to your provincial privacy regulator. In Quebec, you also have the right to receive your information in a commonly used format and to ask that its dissemination stop, and you can complain to the Commission d'accès à l'information (cai.gouv.qc.ca). Under Canada's anti-spam law (CASL), the email we send about your order delivers something you bought; we send no promotional email.

United States

We are a small business and are below the size at which the California Consumer Privacy Act (CCPA) and similar state laws apply. We still offer everyone the rights above. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so. The categories we collect are identifiers (email address, coded IP address), commercial information (your orders) and the property address and location you submit. The categories of parties that receive them are the service providers in section 4. If you are not satisfied with our answer, you can contact your state attorney general.

Other countries

The service is offered only to customers in the United States and Canada, for properties there, and is priced in US dollars. It is not directed at people in the European Union, the United Kingdom or elsewhere.

10. Children

The service is for businesses and adults. It is not directed to children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.

11. Changes to this policy

We will post any change on this page with a new date at the top. If a change is significant, we will also say so on the website's home page.

12. Who is responsible and how to reach us

The person responsible for privacy at YorkNine Inc., operating as Zoraveo is the Privacy Officer.

hello@zoraveo.com
YorkNine Inc., operating as Zoraveo
Suite 1003, 2088 James Street, Burlington, Ontario L7R 0H2, Canada