Privacy Policy

1. Who we are and what this policy covers

Zerve Technologies Inc., carrying on business as Zerve (“Zerve,” “we,” or “us”), provides software for campgrounds, RV parks, resorts, and other outdoor hospitality businesses. This policy explains how we handle personal information through zerve.ca and app.zerve.ca, our platform, support, and connected features, including QuickBooks Online.

Our privacy contact is our Privacy Officer, reachable at info@zerve.ca or 1957 Rue Hunter, Apt 322, Montreal, QC H3J 2N9, Canada.

Property operators use Zerve to manage their businesses. They determine why and how their guest and staff information is used for their operations, and we generally process that information on their behalf and instructions. We also handle information for our own account administration, billing, support, security, and legal obligations. Our role depends on the activity and applicable law.

If you are a guest, the property's privacy notice also applies to its handling of your information. Contact the property about your booking or its use of your information. You may also contact us; we will help identify the appropriate organization and respond to matters for which we are responsible.

2. Information we collect

Depending on the features used, we collect:

• Account and business information: names, work contact details, organization and property information, staff roles, access permissions, subscription details, and records of agreement acceptance and integration authorization.
• Guest and operational information: guest names and contact details; reservation dates, sites and accommodations; booking preferences and information supplied by guests or property staff; invoices, line descriptions, purchases, taxes, payment and refund records; messages, notes, tasks, and uploaded files.
• Payment-related information: We use Stripe Connect to process online payments. We send Stripe invoice details, amounts, related record identifiers, and the guest’s email address when available. Guests enter payment credentials directly on Stripe-hosted checkout pages. These payment flows do not collect or store full card numbers, card security codes, or bank-account login credentials on Zerve’s servers. Zerve receives transaction identifiers, amounts, currencies, payment status, customer contact and billing-address information supplied by Stripe, and information about refunds, payment failures, and disputes. Stripe API responses and event notifications may also include limited payment-method metadata. We use this information to record and reconcile payments, manage reservations and invoices, process authorized refunds, and resolve payment issues.
• Support and communications: website contact and demo requests, correspondence, troubleshooting information, and attachments you provide when asking for help or communicating through the Service.
• Technical and usage information: IP addresses, browser and device information, session and request records, feature activity, and diagnostic or error information, to the extent collected by our deployed systems.
• Integration information: the information described below and comparable data needed for other integrations you enable, as disclosed when connecting them.

We receive this information from individuals, property operators and their authorized users, use of our systems, and third-party services connected at the operator's request. Information entered into free-text fields or attachments may include personal information; users should include only what is needed for the relevant business purpose.

When a property operator connects Stripe, we send Stripe the operator’s business profile and contact information to help set up the account. Stripe collects required identity-verification and payout banking information through its own onboarding pages. Zerve stores the connected account identifier and onboarding, payment, and payout capability status. Stripe handles information under its Privacy Policy.

3. QuickBooks Online information

When an authorized administrator connects a QuickBooks Online company, we receive authorization tokens and a company identifier from Intuit. We use tokens to maintain authorized API access; you sign in to Intuit directly and do not provide your Intuit password to Zerve.

The current integration reads company information; sales items and associated income-account references; accounts for payment mappings; tax codes and rates; matching customer records; and relevant invoice or other transaction information needed to create, update, and validate accounting exports. API responses can contain additional fields within those records.

We send eligible Zerve customer display names and identifiers, invoice references, transaction dates, line descriptions, quantities, prices, taxes, payment amounts, and refund or void information to the connected company. Invoice descriptions may contain reservation or purchase details and other personal information entered by your business. This integration does not intentionally send guest email addresses or phone numbers as separate customer fields in its current version.

We store the company identifier, authorization tokens, mapping selections, external record identifiers, and synchronization results needed to operate the connection and troubleshoot exports. We use integration information to deliver the accounting functions you enable, validate results, maintain the connection, and investigate problems.

The integration currently exports to Canadian QuickBooks Online companies in CAD. It does not import bookkeeping changes into Zerve as a two-way ledger sync, initiate money movement, or send guest invoices through QuickBooks.

You can disconnect in Settings → Integrations → QuickBooks Online. This removes the stored access and refresh tokens used by Zerve and stops future synchronization through that connection; an already submitted request may still complete. You can also revoke authorization in QuickBooks. Disconnecting does not erase records already exported to QuickBooks or automatically delete Zerve invoices, mappings, external record references, or sync history. Retention and deletion are described below.

Intuit handles information within its services under its own Global Privacy Statement and applicable agreements. Contact Intuit or use its account controls for requests concerning information it controls.

4. How we use information

We use personal information to:

• create accounts, authenticate users, and apply access permissions;
• provide reservations, guest management, invoicing, payment-record management, staff operations, communications, and authorized integrations;
• administer subscriptions, respond to contact and demo requests, and provide customer support;
• identify and fix errors, investigate unauthorized access, prevent fraud, and maintain service reliability;
• send service, security, billing, and account notices;
• comply with legal obligations, handle disputes, and maintain appropriate business records.

Where consent is required, we obtain it in a manner appropriate to the sensitivity and circumstances. Uses that require an optional choice will be presented separately from information processing necessary to provide the requested service. We do not treat acknowledgment of this policy as blanket permission for unrelated uses.

5. Who receives information

We disclose information as needed to:

• Your property or organization and its authorized users, according to their roles and the functions involved.
• Service providers supporting hosting, storage, communications, payment processing, diagnostics, support, and other disclosed service functions, subject to appropriate contractual safeguards.
• Services you connect, including Intuit for QuickBooks Online, to carry out the authorized integration. Their own terms and privacy policies apply to information they handle in their services.
• Professional advisers, regulators, courts, or other recipients where reasonably necessary to meet legal obligations, protect rights and security, or establish or defend legal claims, as permitted by law.
• A successor business, where relevant information is transferred in a merger, acquisition, or similar transaction under appropriate confidentiality and privacy protections.

Providers used by the current application and website include Amazon Web Services for infrastructure, storage, and email delivery; Cloudflare for the marketing website; Formspree for website contact forms; Stripe Connect for payment processing; Sentry for error reporting; and OpenAI for the assistant described below. Google receives browser requests when the marketing website loads Google Fonts. Error reports may include user identifiers and request context.

6. AI-assisted features

When an authorized staff user uses Zerve’s assistant, we send their messages, recent conversation history, relevant property settings and context, and tool results to OpenAI through its API to generate responses and perform requested assistance. Depending on the request, this information can include guest names, email addresses, phone numbers, reservation details, staff information, and other relevant business records. Users should include only information needed for the request and review the assistant’s responses before relying on them.

Under OpenAI’s default API policy, inputs and outputs are not used to train or improve its models. OpenAI permits API customers to explicitly opt in to sharing data for model improvement; this is separate from the processing needed to provide the assistant.

OpenAI may retain prompts, responses, and related metadata in abuse-monitoring logs for up to 30 days by default. Longer retention may occur where required by law or reasonably necessary to protect OpenAI’s services or others from harm. Temporary prompt caches may also be retained for up to 24 hours to improve response performance. These are OpenAI’s default policies, not a promise of zero data retention. See OpenAI’s API data controls.

OpenAI states that access to stored API data is limited to authorized employees who need it for engineering support, investigating possible abuse, or legal compliance, and specialized contractors bound by confidentiality and security obligations who review for abuse and misuse. See OpenAI’s business privacy commitments.

Information sent to OpenAI may be processed in the United States and other countries where OpenAI and its service providers operate, including locations outside Quebec and Canada. OpenAI publishes its providers and their processing locations in its sub-processor list.

Using the assistant is optional. Authorized staff may choose not to submit assistant requests and may use Zerve’s standard screens instead. Zerve stores conversation history, tool results, and assistant responses to provide conversation continuity and related service functions. OpenAI’s retention periods do not determine how long these records remain in Zerve. Stopping use of the assistant does not automatically delete prior records; requests concerning access or deletion can be sent to info@zerve.ca and are handled as described in sections 9 and 10.

7. Cookies and similar technologies

We use session_token and pending_auth cookies to maintain sign-in and verify authentication. We also use browser local storage to remember your theme preference. Blocking necessary cookies may prevent some features from working.

8. Where information is processed and how we protect it

We host the Zerve application and store its application data on Amazon Web Services (AWS) in the Canada (Central) region (ca-central-1), in Canada.

Our service providers and services you connect may process personal information outside Quebec and Canada, including in the United States and other countries where they operate. This includes the OpenAI processing described in section 6. Hosting the Zerve application in Canada does not mean that all processing by these providers takes place in Canada. Information processed outside your jurisdiction may be accessible to courts, law enforcement, or other authorities under those countries’ laws. Contact our privacy officer for information about our service providers and cross-border processing practices.

We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information. These include account authentication, role-based access controls, and encryption of stored accounting authorization tokens. No method of transmission or storage is completely secure. We address security incidents and provide notifications as required by applicable law and our customer agreements.

9. Retention and deletion

We retain information only as long as reasonably necessary for the purposes described in this policy, considering the customer’s instructions, service needs, and applicable legal obligations. We delete information earlier where it is no longer needed and no retention obligation applies.

Retention depends on the type of information and why it is still needed. Cancelling a subscription or stopping use of a feature does not automatically erase its records. Our current systems do not apply a general automatic deletion deadline to customer operational records, account records, support correspondence, integration history, or assistant conversations. This does not change our obligation to delete information when it is no longer needed, subject to applicable legal retention requirements. Contact our privacy officer about retention or deletion of particular records.

• Customer operational records and uploaded files: We retain these to provide the service and follow the customer’s lawful instructions. After termination, customers have 90 days to request an export under our Terms of Service. A timely pending export request may require us to retain the records needed to fulfill it. Export requests and deletion requests are handled separately.
• QuickBooks information: Authorization tokens are cleared from the active connection record when disconnected in Zerve. Copies may remain in backups as described below. Disconnecting does not remove integration mappings, external record references, or sync history used to reconcile transactions and investigate issues.
• Account, support, and technical records: Retention depends on account administration, agreement evidence, support, security, and legal needs. Application server logs are configured for 30-day retention. Outbound email-delivery records are scheduled for daily cleanup after 180 days. These periods do not apply to all diagnostic records or records held by external providers.
• Assistant conversations and tool results: Zerve stores these for conversation continuity and related service functions. Stopping use of the assistant does not automatically delete them. Business records created or changed through the assistant are separate records. OpenAI’s own retention practices are described in section 6.
• Zerve’s own tax and accounting records: These are generally retained for 6 years from the end of the last tax year to which they relate, or longer where required by law. This does not mean that every guest record is kept for 6 years after a property stops using Zerve. Property operators remain responsible for exporting and keeping records for their own obligations.
• Backups and older file versions: Automated database backups are configured for 7-day retention. Manual database snapshots and older or deleted file versions do not currently have an automatic expiry configured and may remain until separately removed. Deleting a record from active systems does not immediately remove these copies. A deletion request must also account for retained recovery copies and older file versions, subject to applicable legal requirements.

When particular records must be preserved for a legal requirement, active dispute, or investigation, we retain only what is necessary, restrict its use to that purpose, and delete it when the need ends. We review these exceptions periodically rather than applying them to an entire customer account indefinitely.

To request deletion, contact info@zerve.ca. We will verify the request, determine our role, coordinate with the property operator where appropriate, and delete or de-identify information where required or appropriate. If we must retain particular records, we will explain the applicable restriction unless prohibited by law and limit their use to the reason for retention.

Disconnecting an integration, cancelling a subscription, and requesting deletion are separate actions. Records held by the property or an external provider may require a request to that organization.

10. Your choices and privacy requests

Depending on applicable law and our role, you may request access to your personal information, corrections, information about its use and disclosure, withdrawal of consent, and deletion where applicable. Withdrawal may affect features that depend on the information. We will explain applicable legal or contractual restrictions and consequences.

Contact info@zerve.ca. We may request proportionate information to verify identity or authority. We will respond within the time required by applicable law and explain any permitted extension or refusal. Where we process information on a property's behalf, we will assist that property in responding appropriately.

You may raise a concern with our privacy officer and, where applicable, the Office of the Privacy Commissioner of Canada or the relevant provincial privacy regulator. Authorized administrators can manage connected integrations in settings. Choices concerning the assistant and browser cookies are described in sections 6 and 7.

11. Children and changes

Zerve's business accounts are intended for authorized adult users. Properties may enter information about children who are guests; such information remains covered by this policy, and the property must provide required notices and obtain any required parent or guardian permission.

We will identify policy updates by date and version, publish the revised policy on our website, and email the designated account contacts about material changes. We will also notify other affected individuals directly where required by applicable law. Where a new purpose or practice requires consent, we will obtain it before proceeding. Updating this policy does not itself authorize incompatible uses of previously collected information.