Privacy Policy

Last updated November 2, 2026 · Zoti Software LLC

This Privacy Policy explains how Zoti Software LLC (“Zoti,” “we,” “us” or “our”) collects, uses, shares and protects personal information, and the choices you have. We do not sell your personal information.

1. Who we are and what this covers

Zoti Software LLC is a Florida limited liability company located at 1000 Brickell Avenue, Suite 715 PMB 802, Miami, FL 33131. This policy applies to personal information we collect through zoti.io (the “Site”), when you contact us or buy our services, and when you use software we host and operate for you (“Hosted Software”). Together these are the “Services.”

When we process information on behalf of a business customer, for example their own customers’ data stored in Hosted Software, that customer controls it and Section 6 applies.

2. Information we collect

Information you give us

• Contact and enquiry details: name, email address, phone number, company name and the content of messages or forms you send us.
• Account details: login email, name, role, password (stored in hashed form) and settings.
• Billing details: billing name, address and transaction history. Card and bank details are collected and stored by our payment processor, Stripe. We do not store full card numbers.
• Project and business content: brand assets, website content, business profile information, posts, files and other materials you give us to deliver the Services.

Information collected automatically

• Device and usage data: IP address, browser type, device type, pages viewed, referring pages, and dates and times of access, collected through server logs and similar technologies.
• Cookies and local storage: see Section 8.

Information from third parties

• Connected accounts: if you connect a third-party account to Hosted Software (for example Google Business Profile, Google Search Console, Google Calendar, Microsoft Outlook or Microsoft 365, Zoom, Facebook or Instagram), we receive the information that account makes available with your permission, such as business listings, reviews, posts, performance data and calendar availability. Section 7 explains what we access from Google and Microsoft accounts.
• Payment processor: confirmation of payments, refunds and disputes from Stripe.
• Agency partners: if an agency provides Hosted Software to you under its own brand, it may give us your name, email and business details to set up your account.

3. How we use information

• to provide, operate, maintain and support the Services, and to deliver the work you order;
• to respond to enquiries and send quotes, invoices, receipts and service messages;
• to process payments, manage subscriptions and prevent fraud;
• to secure the Services, troubleshoot problems and monitor for abuse;
• to improve the Services and develop new features;
• to send you news about our services if you have not opted out (you can unsubscribe at any time using the link in the email);
• to comply with law, enforce our Terms of Service and protect our rights and the rights of others.

4. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we process personal information on these legal bases: to perform a contract with you; our legitimate interests in running, securing and improving our business (balanced against your rights); your consent, where we ask for it (you may withdraw it at any time); and to comply with legal obligations.

5. How we share information

We share personal information only as described here:

• Service providers that help us run the Services under contracts that limit their use of the data, including hosting and infrastructure (such as Netlify and Supabase), payment processing (Stripe), telephone calling and phone numbers, text messaging, email delivery and outreach, LinkedIn outreach tools, call transcription and AI processing, and customer support tools.
• Third-party platforms you connect, when you ask us to publish or sync content to them.
• Agency partners that provide Hosted Software to you, limited to the account and service information they need to support you.
• Legal and safety: when required by law or legal process, or to protect the rights, property or safety of Zoti, our customers or others.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent or at your direction.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties, except service providers that deliver the messages for us.

6. Data we process for our customers

When our customers use Hosted Software or software we build for them to store information about their own customers or contacts, we process that information as a service provider (or processor) on their behalf. We use it only to provide the Services to that customer, following their instructions and our agreement with them. If you are a customer of one of our clients and want to exercise privacy rights, please contact that business directly. We will help them respond.

Lead generation and appointment setting

Some customers engage us to contact prospective customers on their behalf by phone, text message, email and LinkedIn, and to book appointments with them. To do this we process business contact details (such as name, job title, company, work email, phone number and LinkedIn profile), the history of our contact with each person, appointment details, and the content of messages and replies. These details come from our customer, from business data providers and from the person themselves.

• Call recording. Calls may be recorded and transcribed for quality, training and compliance. Where the law requires, we tell the person at the start of the call. Recordings are kept for a limited period and then deleted.
• Automated analysis. We use automated tools, including AI, to transcribe and summarize calls and to score them for quality and coaching. These tools do not make decisions that have legal or similarly significant effects on the person contacted.
• Do-not-contact requests. If you ask us to stop contacting you, we add you to a permanent do-not-contact list that applies across all of our customers and every channel. We keep the minimum details needed to honor that request, even after other information about you is deleted.

If we contacted you on behalf of one of our customers and you want to stop further contact or exercise your privacy rights, reply STOP to a text, use the unsubscribe link in an email, tell the caller, or email hello@zoti.io.

Text messages

If you agree to receive text messages, for example about an appointment booked with one of our customers, we send confirmations, reminders and rescheduling messages on that customer’s behalf. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. Consent to receive texts is not a condition of any purchase. See our SMS Terms for details.

7. Google and Microsoft user data

If you connect a Google or Microsoft account to Hosted Software, we access only the data needed for the features you use:

• Google Business Profile and Google Search Console: managing your Business Profile, reading reviews and reporting on search performance.
• Calendars (Google Calendar, Microsoft Outlook and Microsoft 365): the list of your calendars, so you can choose which one receives appointments; your free/busy times, so we offer appointment slots only when you are available (we do not read the titles, descriptions or attendees of your other events to do this); and the appointments our team books for you, which we create, update and cancel, including a Google Meet, Microsoft Teams or Zoom link, and which we monitor so we know when you move or delete one.

We do not read, send or store your email through these connections.

Zoti’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We apply the same restrictions to data received from Microsoft APIs. In particular:

• we use this data only to provide and improve the features you connected, and do not transfer it to others except as needed to provide those features, for security, to comply with law, or as part of a merger or acquisition;
• we do not use it for advertising, and we do not sell it;
• we do not use it to create, train or improve any AI or machine-learning model, whether general-purpose or our own, and we do not send it to any AI or machine-learning service, whether third-party, self-hosted or offline. The AI tools described in section 6 process recordings of our own phone calls and never receive data from Google or Microsoft APIs;
• our staff do not read it unless you give permission, it is needed for security or to comply with law, or it is aggregated and anonymized for internal operations;
• we store only the calendar details of appointments we book and the access tokens needed to keep your account connected; tokens are encrypted at rest and never shown in a browser.

You can disconnect at any time in Hosted Software, in your Google Account (myaccount.google.com/permissions) or in your Microsoft account (myapps.microsoft.com). When you disconnect, we stop accessing the account and delete the stored access tokens within 30 days. Appointments already on your calendar stay there. To ask us to delete other data we hold from your Google or Microsoft account, email hello@zoti.io.

7A. Zoom user data

If you connect your Zoom account to Zoti Booking (book.zoti.io), Zoti creates a Zoom meeting for each appointment our team books for you, and puts its link in the calendar invite. To do this we use three Zoom permissions:

• Your Zoom user ID and email (user:read:user), read once when you connect, so we know which Zoom account is yours.
• Creating meetings (meeting:write:meeting): one scheduled meeting per appointment, in your own Zoom account. We send Zoom the meeting’s title (the meeting type, the prospect’s name and your name), its time and length, and the settings “waiting room on” and “participants cannot join before the host”.
• Deleting meetings (meeting:delete:meeting): only a meeting we created, when the appointment it was made for could not be completed.

We do not access your other meetings, recordings, chats, contacts or account settings.

What we keep. An access key that lets us create meetings for you, which we encrypt before storing it and never show in a browser; your Zoom user ID and email; and, for each appointment we booked, the Zoom meeting’s ID and link.

How we use it. Only to create and remove the meetings described above. We do not sell Zoom data, use it for advertising, share it except as needed to provide the appointment (the meeting link goes to the person invited), or use it to create, train or improve any AI or machine-learning model. We do not send Zoom data to any AI or machine-learning service.

Removing Zoti Booking. You can remove the app at any time in the Zoom App Marketplace (Manage › Added Apps › Remove; step by step at book.zoti.io/zoom). Zoom notifies us, and we then delete your Zoom connection: the access key, your Zoom user ID and your Zoom email. Meetings already booked stay in your Zoom account and on the invites. The appointment records kept for the business you take meetings for (time, prospect and meeting link) are kept with that business’s records; to ask us to delete them, or to access the Zoom data we hold about you, email hello@zoti.io (see section 11).

8. Cookies and similar technologies

The Site uses only cookies and browser storage that are needed for it to work, for example to remember that you have already seen the intro animation during your visit and to keep you signed in to Hosted Software. We do not currently use advertising cookies. If we add analytics or marketing tools, we will update this policy and, where the law requires, ask for your consent first. You can control cookies through your browser settings. We honor Global Privacy Control (GPC) signals as an opt-out of any sale or sharing, as applicable law requires.

9. How long we keep information

We keep personal information for as long as needed to provide the Services and for the purposes in this policy. That includes keeping business and billing records for as long as tax and accounting laws require, generally up to seven years. When we no longer need information, we delete or anonymize it. After a subscription ends, customer content in Hosted Software is deleted after the 30-day export window described in our Terms, unless the law requires us to keep it.

• Calendar access tokens: until you disconnect the calendar, and deleted within 30 days after that or after your subscription ends.
• Zoom access keys, Zoom user ID and Zoom email: until you remove Zoti Booking from your Zoom account or disconnect it; deleted as soon as Zoom tells us you removed it, and in any case within 30 days after you disconnect or your subscription ends.
• Call recordings: for a limited period set in our agreement with the customer, and then deleted.
• Do-not-contact records: kept permanently, because that is what keeps the request honored.

10. Security

We use administrative, technical and physical safeguards designed to protect personal information. These include encryption in transit, encryption of stored credentials and access tokens, access controls and least-privilege access for our team. No system is completely secure, so we cannot guarantee absolute security. If a data breach affects your personal information, we will notify you and the authorities as required by law, including Florida’s data breach notification law.

11. Your rights and choices

Depending on where you live, you may have the right to:

• know or access the personal information we hold about you;
• correct inaccurate information;
• delete your information;
• receive a portable copy of your information;
• opt out of marketing emails, and of any sale, sharing or targeted advertising (we do not engage in these);
• object to or restrict certain processing, or withdraw consent (EEA and UK); and
• appeal our decision on your request, and complain to your local data protection authority.

To make a request, email hello@zoti.io. We will verify your identity before acting on a request and respond within the time required by law, usually within 30 to 45 days. You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights.

12. International transfers

We are based in the United States, and we and our service providers process information in the United States and other countries. Where the law requires, we use appropriate safeguards, such as Standard Contractual Clauses, when transferring personal information from the EEA, UK or Switzerland.

13. Children

The Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children under 13 (or under 16 where the law sets a higher age). If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here and change the “Last updated” date. If a change is material, we will tell active customers by email before it takes effect.

15. Contact us

For questions or requests about privacy, contact us: