Privacy Policy

Zora REI, Inc. · Effective October 2, 2026 · version privacy-v11

Zagent is an AI home-buying assistant operated by Zora REI, Inc., a licensed New York real estate brokerage (“we,” “us”). This policy describes what we collect when you use Zagent and what we do with it.

What we collect

Your account details (name, email address, and phone number if you provide one), your conversations with Zagent, the home-search preferences those conversations express, the documents you send us, and your consent and disclosure acknowledgments. When you sign up, we also record your network address and your browser’s name with the documents you accept, as a record of the agreement, and we do the same for some choices you make later on your account page. To stop abuse, we also count some requests by network address, such as attempts to sign in. Apart from these and the records of calls and purchases below, we collect what you tell us. We do not buy data about you or track you across other websites.

Calls with a licensed Zora agent take place on Google Meet, by video or voice. If you book one, we keep a record of it: the times you suggested, the time agreed and the Meet link, who took the call, how it went, and the agent’s notes on it. When our Google connection is switched on and Zagent made the call’s Meet link, the record may also hold Google Meet’s attendance for the call: the name shown for each person who joined, whether they were signed in to a Google account, when they joined, and for how long. We use it to confirm whether the call took place and, if it did not, who missed it. We never record calls as audio or video. Calls may be transcribed only if you opt in separately and the agent has agreed. You can turn your choice off anytime in account settings. Transcripts are used to improve Zagent’s recommendations and are protected under Zora’s data policies. With permission, Google Meet transcribes the call and Zagent imports the text into your call record. Google also keeps its copy in the organizer’s Workspace Drive. Turning your choice off stops further imports; it does not erase transcripts already kept with your file. If you buy a home through us, we also record the day it closed and the commission we received. We keep these records with the rest of your file: while your account is open, and for three years after it closes.

Using Zagent without an account

On our public pages you can ask the assistant a few questions without signing up. To limit how many each connection gets, we keep your network address and a count of the questions and searches asked from it. We note the place you asked about, but not the words of your question. Your question is sent to our AI provider so an answer can be written, and a search built from it may go to that provider’s web search. We keep the address and the count for three years after your last question, then delete them.

Drives from your current location

When you choose “Use my location” on a listing, your browser asks for location permission. We send the location your device supplies to Google to measure the drive to that home. Zagent uses it for that request and does not save it in your account, location history or route cache. Google handles the location under its own privacy policy. We do not track your movement. This does not change your saved commute destination.

Your commute

If you tell us where you commute to — in the chat or on your account page — we keep that address and its map coordinates. We use them to measure the drive from each home on your list, for a typical weekday morning.

Measuring a drive means telling a mapping company where you are going. We send the address you typed to Google, which turns it into a point on the map. We then send that point, together with each home’s point, to Google to ask how long the drive takes. We do this using our own Google account, so Google can see the request came from Zora REI. Google handles what we send under its own privacy policy, and we cannot promise what it keeps or for how long. If you tell Zagent in the chat rather than on your account page, that message also reaches our AI provider, like the rest of your conversation.

Beyond measuring that drive, we do not use it for anything. We do not use it to decide anything about you. We never give it to a seller, a listing agent, or anyone else on the other side of your deal. We do not advertise to you with it, with one exception you choose yourself: if you switch on new home alerts and your search has a commute limit, the alerts take the drive into account the same way your search does.

You can see it and remove it on your account page at any time, and it is removed when you close your account. Removing it stops any further lookups and removes the drive times we measured to it. Changing it to a different place does the same to the old one. If you told Zagent in the chat rather than on your account page, that message stays in your conversation record like your other messages, and anything already sent to Google is with Google.

If you would rather we did not, leave it blank. Nothing else about your search changes: homes simply show no drive time, and a commute limit you ask for has nothing to be measured against.

Your location, only when you ask

If you use “Homes near me”, your browser asks your permission and then gives us an approximate location. We round it to roughly a kilometre before it leaves your browser, use it to order that one search, and keep it in a temporary cookie that expires after half an hour or when you press “Stop using my location”. It is never written to our records, never attached to your account, never used to decide which homes to recommend to you beyond the distance you asked for, and never shared. We never ask for your location unless you press that button, and declining costs you nothing — searching by town or ZIP gives you the whole catalogue either way.

How we use it

To run your home search: finding and discussing properties, contacting listing agents and other transaction parties at your direction, and keeping you updated. Because we are a licensed brokerage, our staff review Zagent’s communications as part of required supervision.

If you switch on new home alerts on your account page, we also use your saved search and your email address to email you homes that fit it. Those emails are marketing, and they are the only marketing we send you. They stay off unless you switch them on, they are not a condition of anything, and you can stop them at any time, from the link in every one of them or on your account page.

We do not sell your personal information, and we do not give it to anyone else for their advertising.

Text messaging

Texting is switched off for now, so Zagent does not send you text messages. When it is on, Zagent communicates by SMS/MMS as part of the service, and only about things that would not keep — answers to messages you send us, word back from a listing agent, and showings that are coming up or have moved — plus a one-time introduction and messages a member of our staff writes to you themselves. We do not text you to say new homes have matched your search; those wait for you in your portal. We do not send promotional or marketing texts at all. You consent to this operational texting when you create an account, and it starts once texting is switched on and a phone number is on file.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text-message services.

Message frequency varies based on the activity in your home search. Message and data rates may apply. You can opt out at any time by replying STOP to any message; reply HELP or email us for assistance. Opting out of texts does not close your account — Zagent remains available on this site.

Who we share information with

We do not sell your information and we do not share it for anyone else’s advertising. It reaches these companies because they are how the product works, and each gets only the part it needs:

Twilio, our messaging carrier — your mobile number and the text messages sent to and from it.
OpenAI and Anthropic, the AI models behind Zagent — your conversations and the search preferences in them, so an answer can be written. Paperwork you send us goes to them too: a document you upload in the portal, or a photograph of one you text us, is sent whole to the AI provider so Zagent can read it and put the dates in your calendar. A contract and an accepted offer are read this way, and whatever else is written on the page goes with them. The one exception is your Sensitive documents page: nothing you put there is ever sent to a model, which is why proof of funds, bank letters and anything carrying an account number belong on that page and not in the chat.
Resend, our email provider — the address we are writing to and the full contents of the message, for every email Zagent or our staff send you or send on your behalf. When a licensed agent accepts a call you asked for, the email telling them can carry your email address, so they can add you to the calendar invitation. Email sent to our addresses reaches us through Resend too, including everything you send to support@zagent-ai.com, with its full contents.
Stripe, our payment processor — your email address and your internal Zagent account number, each time you start a checkout, together with the card details you give Stripe directly. If we send you an invoice, Stripe also receives what the invoice is for, and your name if it does not already have a record of you. We never see or store your card number.
Google, our mapping and street-imagery provider — the addresses and map points we look up for you. That includes a commute destination you give us and each home a drive is measured from, as described under “Your commute” above, and the address of a home whose street imagery you are shown. Our calls with licensed agents take place on Google Meet, so when you join one, Google receives what any Meet call carries, including the name you join with and your video or voice. When the agent sends you a Google Calendar invitation for the call, Google also receives your email address.
Listing brokerages, for listing photographs. A listing photograph, unless the brokerage uploaded it to us directly, loads straight into your browser from the listing brokerage’s own server, or the one its listing service uses, not from ours. That server sees your network address, your browser, that you came from Zagent, and which photographs you are looking at. We send it nothing about you.
U.S. Census Bureau — to locate a home with a missing map pin, our server sends its public listing address to the Census geocoder. We save the approximate coordinates. We do not send your name, account details or device location.
OpenFreeMap — the map backgrounds. Your browser fetches these directly from them, so they see your network address and which part of the map you are looking at. Nothing is sent to them from our side, and nothing identifies you to them by name.
Our hosting provider — the servers and backups the whole service runs on.

Listing agents and other transaction parties receive only what is needed to act on your instructions (for example, your interest in a showing), and a sensitive document reaches someone outside the firm only when you share it yourself. We may disclose information when the law requires it.

Retention and security

We keep records for three years. What differs is the day the three years start. While your account is open, we keep your conversations, paperwork, the records of your calls with our agents, and your transactions. When you close it, we keep those records, with your name and email address, for three years from the day it closes, then delete them.

A chat you delete leaves your account straight away. We keep a copy of it for three years from that day, then delete it. A sensitive document is destroyed three years after you upload it. If you delete it sooner, it leaves your page and its links stop working at once, and we keep a locked copy, which no one can open through Zagent, until those three years are up. Our log of what Zagent and our staff did keeps each entry for three years from the day it is written, and supervision alerts are kept for three years from the day they are resolved.

Inside the firm, any approved member of Zora REI staff can see your client file, your documents, and your conversations with Zagent — that access is what lets a licensed person supervise the work, which a brokerage is required to do. A market analysis or an offer package is released by someone holding a licence: Zagent prepares those and cannot send them itself. A message Zagent writes to a listing agent on your behalf is not held for a signature first. Our code puts it together from what you asked for, and an AI model may reword it so it reads naturally; the code then checks that the address, your questions and any times offered all came through, and sends its own version if any did not. Licensed staff watch those conversations as they happen and can pause Zagent or take one over at any point.

Outside the firm, a sensitive document reaches someone else only after you approve sharing. For an offer, choose the listing contact on one of your saved or in-progress homes. We use their email on file; they verify that address with a code, without creating an account. Verification lasts for a limited session. They can return to the same page and verify again while access is on. Access ends when you turn it off, delete the document, close your account, or the file reaches the end of its retention period. You do not need a consultation or a Zora agent assignment to use this.

Temporary links remain available for other recipients you enter yourself. Those links expire and can be withdrawn sooner; anyone holding one can open the file while it is active. Every document opening is recorded, along with refused attempts on expired or withdrawn shares, with the time and network address. You can see that list on your Documents page.

Version history

privacy-v11 · October 2, 2026 — Public listing addresses are sent to the U.S. Census Bureau for missing map pins. Approximate coordinates are cached; client identity and device location are not sent.
privacy-v10 · October 2, 2026 — Offer documents can be shared with a listing contact selected from the client’s homes. Recipients verify their email for a limited session and can return while access remains on, up to document retention. Clients can stop access; legacy temporary links keep their expiry.
privacy-v9 · October 2, 2026 — Optional current-location drive checks: browser permission is requested when the client clicks, the device location is sent to Google for that trip, and Zagent does not save a location history or change the saved work commute.
privacy-v8 · October 2, 2026 — Separate client opt-in and agent agreement for call transcripts, used to improve Zagent’s recommendations. Choices can be withdrawn by clients. Transcripts follow Zora’s data protection policies and three-year record retention. Calls are never recorded as audio or video. Transcription remains off.
privacy-v7 · October 2, 2026 — CALLS WITH A LICENSED AGENT. The section on calls now says they take place on Google Meet, by video or voice. Among what we keep about a call it now names who took it, the time agreed and the Meet link, beside the times you suggested, how it went and the agent's notes. It says that Google Meet's attendance is read only when our Google connection is switched on, that it shows whether each person who joined was signed in to a Google account, that we do not record or transcribe calls, and that these records are part of your file: kept while your account is open and for three years after it closes. The retention section now names the records of your calls among what we keep. YOUR PURCHASE. The page said that, apart from the things it listed, we collect what you tell us. If you buy a home through us, we also record the day it closed and the commission we received, and the page now says so. RESEND. When a licensed agent accepts a call you asked for, the email telling them can carry your email address, so they can add you to the calendar invitation. That email goes through Resend, and the entry for Resend now says so.
privacy-v6 · September 25, 2026 — CONTACT. Questions and requests about your data now go to support@zagent-ai.com. It replaces the address this page gave before, which was the firm owner's own mailbox. Mail sent there is recorded, given a deadline, and put in front of a member of our staff. WHO GETS WHAT. The entry for Resend, our email provider, said only that it carries the emails we send. Email sent to our addresses reaches us through Resend too, including everything you send to support@zagent-ai.com, and the entry now says so. LISTING PHOTOGRAPHS. The list of who gets what left out the listing brokerages. A listing photograph, unless the brokerage uploaded it to us, loads into your browser straight from the listing brokerage's own server, or its listing service's, so that server sees your network address, your browser, that you came from Zagent, and which photographs you look at. The list now names them. INVOICES. The entry for Stripe named only what a checkout sends. If we send you an invoice, Stripe also receives what it is for, and your name if it does not already have a record of you. The entry now says so. CALLS WITH A LICENSED AGENT. If you book a call with a licensed Zora agent, we keep a record of it: the times you suggested, when it took place, how it went, and the agent's note on it. When Zagent made the call's Google Meet link, the record may also hold Google Meet's attendance: the name shown for each person who joined, when they joined and for how long, which we use to confirm whether the call took place and, if it did not, who missed it. Zagent never reads or keeps a recording or a transcript of a call. The entry for Google now says that calls take place on Google Meet, and that Google receives your email address when the agent sends you a calendar invitation for one.
privacy-v5 · September 24, 2026 — RETENTION. The policy now says how long we keep records, and the product does what it says. We keep records for three years, counted from a day that depends on the record. While an account is open we keep its conversations, paperwork and transactions; when it closes, those records, with the client's name and email address, are kept for three years and then deleted. The previous wording said account data was kept for as long as the account is open, and a closed account in fact kept the name and email address indefinitely. DELETING A CHAT. A chat a client deletes leaves their account at once, and a copy is kept for three years from that day, then deleted. It used to be destroyed immediately, which our own rule that records are kept forbids. SENSITIVE DOCUMENTS. Destroyed three years after upload, not ninety days. A client may delete one sooner: it leaves their page and every link stops at once, and a locked copy that no one can open through Zagent is kept until the three years are up. It used to be destroyed at once. LOGS AND ALERTS. Records of what Zagent and our staff did are kept three years from the day they are made, and supervision alerts three years from the day they are resolved. Neither had an end before. HOME ALERTS. The page said we do not use personal information for advertising. A client who switches on new home alerts has their saved search and email address used to email them homes, which is marketing email. The page now says so, that it is the only marketing we send, that it is off until switched on, and how to stop it. It also says those alerts take a commute limit into account, as the search does. We still sell nobody's information and give it to nobody for their advertising. WHAT WE COLLECT. The list now names the documents a client sends, the network address and browser recorded with the documents accepted at sign-up, and the counts kept by network address to stop abuse such as repeated sign-in attempts. A new section describes the public pages: a visitor's network address and question count are kept for the daily limits, then deleted three years after the last question, which the product did not do before. MESSAGES TO LISTING AGENTS. The page said their wording is fixed in our code. In fact an AI model may reword each one, and our code checks the address, the questions and any times offered survived before it is sent. The page now says that. TEXT MESSAGES. Texting is switched off, and the page now says so. The list of what we text about now also names the one-time introduction and messages our staff write by hand.
privacy-v4 · September 23, 2026 — CORRECTIONS, and they are labelled as such. This version carries every correction made to this policy on 23 September 2026. YOUR COMMUTE, the page. The previous wording said a commute destination was used to measure drive times "and nothing else: not to advertise to you, not to decide anything about you, and never shared". The last of those was not true: measuring a drive means sending the destination to Google, which places the address on the map and then measures the journey from each home to it. The section now names Google, says what Google receives and why, says that Google handles it under its own privacy policy and that we cannot promise what Google keeps, and says what happens if a client leaves the destination blank. The promises that were true are kept: no advertising, no decisions about the client, nothing given to the other side of their deal, removable from the account page. The list of who we share information with described Google as receiving data only when street imagery is displayed, and is corrected to match. YOUR COMMUTE, the product. This one changed the code rather than the page. Removing a commute destination cleared it from the client's profile and left the coordinate we had rounded it to — about a hundred metres, which locates a workplace to the block — in the table of measured drive times, which nothing in the product ever deleted from. Clearing it, changing it to another place and closing the account now all remove the drive times measured to it as well, and the page says so. Nothing was promised about this before and nothing is taken away: the earlier text said removal stopped further lookups, which was true, and the new text says removal also takes the measured journeys, which is now true. Drive times are measured through Google alone. The code could fall back to a second mapping company when no Google key was saved, which would have made this section's naming of Google conditional on a setting no client can see; that fallback is removed, so the one company named is the only one an address is sent to. WHO GETS WHAT. Named every company a client's information reaches and said what each one gets — the payment processor and the email provider were doing so already and were not listed, and the map provider is fetched by the client's own browser. Said that paperwork a client sends us is sent to the AI provider in full, which it always was: a document uploaded in the portal or texted in is passed to the model so Zagent can read the dates off it, and the previous list named only conversations and search preferences under a promise that each company gets "only the part it needs". WHO CAN OPEN A FILE. Replaced "access is limited to supervising staff" with what the code does. Any approved staff account can open a client file; that is wider than the old sentence said. Licensed release is a separate and narrower gate, and the page no longer overstates its reach either: a market analysis and an offer package are released by somebody holding a licence, while a message Zagent writes to a listing agent is sent under continuous supervision rather than held for a signature — the earlier wording claimed the second was licensed release too, which describes a setting this brokerage does not run. And a document the client shares is opened by somebody outside the firm through a link whose every use is logged. TEXT MESSAGES. Removed the promotional text-message programme: the page said we send occasional news and promotions to clients who opt in, and no such message can be sent — marketing is refused at the sending boundary. The sign-up form offered the same programme as a tick box and no longer does.
privacy-v2 · September 11, 2026 — Added the commute destination a client may give us — what it is measured for, that it is theirs to remove, and that it is deleted with the account. Added "Homes near me": what an approximate location is used for, that it is rounded before it leaves the browser, that it is held in a temporary cookie and never written to our records, and that declining costs nothing.
privacy-v1 · August 10, 2026 — First published, with the text-messaging disclosures the carrier registration was approved against.

Changes and contact

If this policy changes, its version and effective date change with it, and the history above records what moved. Questions or requests about your data: support@zagent-ai.com.