Overview

cf0, Corp. (“cf0”, “we”, “us”) is an AI property manager for letting agencies and landlords, incorporated in Delaware, United States. This policy covers cf0.ai, our APIs, and Zero, our agent, wherever you use it, including from AI assistants and messaging tools.

Most people reach cf0 through an organisation: a letting agency, a property-management agency, or a portfolio landlord. Where that is the case, your firm decides who has access and what is uploaded, your firm administrators can see the content in your organisation’s workspace, and we process that content on your firm’s behalf.

Who decides. For the content and records your firm puts into cf0, and for the people Zero deals with for your firm, such as tenants, guests, owners and contractors, your firm is the controller and cf0 is its processor. The Data processing addendum governs that processing. If you are one of those people, your firm’s own privacy notice applies, and your firm is the first place to ask. cf0 is the controller for the rest: your account, billing, the details your firm gives us at sign-up and when it asks about a contract, and visits to cf0.ai. This policy covers both, and says where cf0 acts only for your firm.

What we collect

Identity and account data. Your user and organisation identifiers, and your email address. Your name, email, profile image, password, multi-factor settings, and organisation membership are held by our identity provider rather than in cf0’s own database. cf0 stores your email address where it needs to send you something, and stores identifiers to scope your data to you.
Content you upload or generate. Documents and files, maintenance notes, tasks, chat messages and threads, the notes and instructions your staff give Zero, and the outputs cf0 produces from them.
People your firm puts on record. The name, email address, role (tenant, guest, owner, landlord or contractor) and property of each person your firm’s staff add on cf0.ai, import from a file, or add from an AI assistant after confirming the details. For each person your firm’s connected systems bring in, the same details and also phone numbers and tenancy or booking details. For a person staff add, we record which staff member added them, when, and from where (cf0.ai, ChatGPT or Claude).
Zero’s email. The emails Zero sends and receives at your firm’s Zero email address, on agents.cf0.ai or on your firm’s own domain, and the approvals your staff give before Zero sends.
Calls and messages, on a cf0 contract. Where Zero answers your firm’s phone line, WhatsApp or iMessage, the caller’s number, the conversation, call audio and transcripts, and the photos and voice notes that guests send.
Data from accounts you connect. If you connect a mailbox, calendar, property-management system, file store, notes tool or messaging workspace, we receive the content you authorise. See “Connected accounts” below.
Product and interface state. Preferences such as theme, language, region, sidebar layout, dismissed hints, and recently viewed items.
Operational data. Request and error logs, and IP address. An error log can include the request context that caused it.
Enquiry data. If you use a contact form or book a demo, the name, email, firm, message, and IP address you submit. If you talk to Zero on our website, by chat or by voice, what you say in that conversation.
Sign-up and sales data. When your firm signs up: the firm’s name, country and number of units, and the admin’s name, email address, phone number and other onboarding answers. When someone at your firm asks about a cf0 contract, we also use the number of tasks your firm gave Zero and the number Zero completed.
Billing data. Where a paid plan applies, a customer reference and plan details. The business name, address and tax ID that your firm enters at checkout are held by our payment processor. Card details are entered on our payment processor’s hosted page and never reach cf0’s systems.

We do not ask for special category data (health, race, religion, sexual orientation, biometrics, trade-union membership), and no feature needs it. Do not upload it.

How we collect it

Directly from you. When you sign in, upload a file, send a message, or contact us.
From your identity provider. When you sign in, we read your verified identity and organisation from the sign-in token.
From accounts you connect. Only after you complete an authorisation flow, and only within the scopes you grant.
Automatically. Logs generated as the service runs, and a page-speed analytics script on our public website.

How we use it

To run the product and produce the outputs you ask for.
To authenticate you and keep each organisation’s data separate.
To send the notifications and updates you have turned on.
To debug, monitor, secure, and improve the service.
To respond to your enquiries and provide support.
To bill you, where a paid plan applies.
To tell cf0’s founders about your firm. They get one email when a firm signs up, with the firm’s name, its admin, country, unit count and onboarding answers. When someone at your firm presses “Talk to us about a contract”, they get one email with the firm’s name, the name and email address of the person who asked, the phone number, unit count and country from onboarding, and the number of tasks given to Zero and completed. They use it to reply to your firm about a contract.
To meet legal obligations and enforce our terms.

We do not train models on your content, and we do not sell your data. Your content is sent to model providers only to produce the output you requested.

Legal bases

If you are in the EEA or the United Kingdom, we rely on these bases under Article 6 of the GDPR and UK GDPR:

Contract. To provide the service to you or your firm.
Legitimate interests. To secure, debug, and improve the service and to run our business, including telling our founders about a new firm or a contract enquiry and replying to it, where that does not override your rights.
Consent. For connecting a third-party account and for marketing email. You can withdraw it at any time.
Legal obligation. For tax, accounting, and lawful requests.

Where cf0 processes content on behalf of your firm, your firm is the controller and cf0 is the processor. Your firm then chooses the legal basis, and the Data processing addendum applies.

No law makes you give us personal data. We need your account details to provide cf0, and your firm’s business details at checkout before Zero sends anything on a task. Without them, we cannot provide those parts of the service.

AI processing

cf0 is built on large language models. To answer a question, draft a message or work a task, the relevant content (the request, the conversation it sits in, and the records or extracts needed to answer) is sent to a model inference provider. Classification, such as sorting incoming mail, runs on a managed AI service of our cloud provider.

cf0 reads the text of PDF, Word, text and CSV files inside its own service, with no outside document provider. On a firm’s phone line and WhatsApp, call audio and the voice notes that guests send go to our voice provider for speech-to-text, and Zero’s spoken replies come from its text-to-speech.

The providers involved, what each one does and where, are named in Annex 3 of the Data processing addendum. If your firm needs a particular provider excluded, contact us before uploading content that would depend on it.

Connected accounts

You can connect third-party accounts (mail, calendar, notes, and messaging tools) so cf0 can work with them. Some connections are brokered by an integration provider that holds the access tokens and passes us the content within the scopes you granted. Mailboxes and calendars you connect by signing in with Google, Microsoft or Calendly are different: you approve that provider’s own permission screen, and cf0 stores the resulting access credentials itself, encrypted, with no broker in between.

Calendars. A calendar connection asks only for calendar permissions, never for mail. We read the list of calendars you can access so you can choose one; the busy times on the calendar you choose, so Zero can offer free slots; and the events Zero created, so it can move or cancel them. A member of your firm can also ask Zero what is in their own diary. For that, the titles, times, locations and attendee names of the events in the window they ask about are read and passed to the AI model that runs the conversation; descriptions, attendee email addresses and meeting links are not, and an event marked private is shown only as busy. We create, move and cancel viewing events on that calendar, and only when your firm’s approval rules allow it. Tenants, leads and callers are only ever offered free slots; the details of your other appointments are not shown to them. Free slots and the details of viewings Zero manages are passed to the AI model that runs the conversation, as described under “AI processing”. Calendar data is used only to provide scheduling: we do not sell it, use it for advertising, or use it to train AI models. Disconnecting the calendar deletes the stored credentials.

Google user data. cf0’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Content pulled from a mailbox or messaging workspace routinely contains personal data about other people who are not cf0 users: senders, recipients, meeting attendees. If you connect such an account you are asking us to process their data, and you are responsible for having a basis to do so. An email that Zero acts on is copied into the lead, work order or task it opens. Past mail that an admin chooses to import keeps no content, but teaches Zero who its senders are and their role. Both can stay in your workspace after you disconnect the account.

You can disconnect an integration at any time in settings, which stops any further access to that account. Disconnecting does not remove what cf0 already took from it. When you ask us to remove it, we delete at the level we can act on (specific items you identify, your workspace, or your whole account), as described under “Deletion”.

Zero in AI assistants

Your firm can let its staff reach Zero from an AI assistant such as ChatGPT or Claude. A staff member connects by signing in with their cf0 account. The assistant then holds a token that lets it use Zero for that person and nothing else in cf0. It never sees their cf0 password.

What goes to the assistant. Answers about Zero’s work: how many tasks are open, task titles, their state and due date, and what is waiting on the staff member. When Zero needs the staff member to decide something, the answer includes a short quote of the person’s reply. People are described by role and property, never with contact details. Someone on your firm’s records appears as a reference code with their role. Email addresses, phone numbers and access codes are removed. Task details stay on cf0.ai. To approve a message from the assistant, the staff member sees the full message with the recipient’s details replaced by their reference code. A name that is not on your firm’s records, such as one typed into the chat, is passed back as written.

What comes from the assistant. What the staff member asks of Zero: a question, a task, or an answer to something Zero is waiting on. A task or an answer is stored in your firm’s workspace exactly as if it had been given on cf0.ai. With a task, the staff member can add a new person: their name, email address, role and property. Zero first shows those details and stores the person only after the staff member confirms them, with a record of who added them, when, and from which assistant. Zero emails that person only after a member of your firm’s staff approves the email. A question is answered by Zero using the AI processing described above, and cf0 does not store or log the question or the answer.

Updates to ChatGPT. A staff member using ChatGPT can ask to be told when a task they gave Zero finishes or needs them. Each update carries the task’s title and a short summary, with people described the same way, and goes only to the ChatGPT address that asked for it.

The assistant’s provider. The provider of the assistant, such as OpenAI or Anthropic, is chosen by your firm and is not one of cf0’s sub-processors. Whatever reaches the assistant is held under that provider’s own terms and privacy policy and your firm’s agreement with it. Depending on the plan and its settings, it may keep conversations or use them to train its models.

What cf0 records. One log line per request from an assistant: the kind of request, its outcome, which assistant made it, and how long it took. Never the token, and never what the request said.

Ending access. A staff member can disconnect cf0 in their assistant’s settings. When someone leaves your firm in cf0, their assistant loses access at its next request, and any ChatGPT updates they asked for stop within about an hour.

Sub-processors

We keep the vendor list short. Every subprocessor that handles your firm’s data is named in Annex 3 of the Data processing addendum, with what it does and where it processes data. We tell firm admins before we add one. The categories are:

Cloud hosting, compute, database, object storage, edge network and DNS.
Identity, authentication, and organisation management.
Large language model inference and classification.
Zero’s mailboxes and other email delivery.
Third-party account integration.
Voice calls, telephony, and WhatsApp and iMessage messaging, for firms on a cf0 contract.
Payment processing.

For our own website we also use a customer relationship management provider for the analytics script described under “Cookies and local storage”, a calendar provider for demo bookings, and our voice provider for conversations with Zero on the website.

We share personal data only:

with the categories of sub-processor above, to run the service;
with your organisation and its administrators, where you use cf0 as part of a firm;
with a third-party service when you direct us to connect it;
in connection with a merger, acquisition, or sale of assets, with this policy continuing to apply;
where the law requires it.

We do not sell personal data and we do not share it for cross-context behavioural advertising.

The Service links to third-party websites and services. Those services are governed by their own privacy policies, which we do not control, and this policy does not apply to them.

Text messages (SMS)

When you give us your mobile number for text messages, we use it, and the record of your consent, only to send the cf0 texts you asked for and to act on your STOP and HELP replies.

We do not share or sell mobile numbers, SMS opt-in data or consent with third parties or affiliates for marketing or promotional purposes.

Text messaging originator opt-in data and consent are not shared with any third party, except the aggregators and providers that deliver the text messages (our telephony provider and the mobile carriers).

When you reply STOP, we keep a record of the opt-out so that we do not text you again. The program terms are in section 22 of the Terms.

International transfers

cf0 is a United States company. Our primary database, file storage and Zero’s agent storage are held under European Union jurisdiction, and our api servers run in Frankfurt, Germany. Some sub-processors operate outside the European Union, mainly in the United States: identity and sign-in, payment processing, Zero’s mailboxes and other email delivery, voice calls and telephony, WhatsApp and iMessage messaging, connected-account integrations, and scheduling. Model inference runs in the United States. Classification, background queues and logs are not pinned to a region and may run or be kept outside the European Union. Data handled by those services is transferred to and processed where they operate.

For data that cf0 processes for your firm, the Data processing addendum includes the Standard Contractual Clauses and the UK International Data Transfer Addendum. If you need a signed copy, or written confirmation of where a specific category of data is stored, email luca@cf0.ai and we will send it or confirm the position.

Retention

We would rather state this accurately than tidily. cf0 deletes some customer content automatically, on the schedules listed below. Other content you upload or generate is kept until you delete it, until your firm asks us to delete it, or until you close your account and ask us to remove it. It is not aged out on a timer.

What we can state precisely:

Replies to tasks given to Zero. We keep the first 600 characters of each reply with the task and delete the text 30 days after the task closes.
Guest conversations with Zero. Zero’s conversation with a guest, and the photos and voice notes they sent it, are deleted 30 days after the guest’s check-out, or 30 days after their last message if that is later.
Email processing records. Some records of how email was handled, such as delivery records, are deleted or emptied automatically after 30 to 90 days.
Cookie consent records. When you make or change a cookie choice, we keep a record of it on our server: a random consent ID, the policy version, your choice and the time. It holds no name, email, IP address or browser details. We keep each record for as long as we need it to show your consent, and delete it after at most 5 years. To have it deleted sooner, email us your consent ID from the cookie policy page.
Recovery history. Our cloud provider keeps a rolling 30-day history of our primary database and of Zero’s agent storage, so that we can restore them to an earlier point in time. Content deleted from the live system can therefore persist in that history for up to 30 days.
Deletion records. When content is deleted we keep a record of the deletion, and the file’s metadata such as filename, size, and timestamps, after the content itself is removed. We use it to show that the deletion happened.
Operational logs and error reports. Retained for the periods configured by our infrastructure providers. We have not set a shorter, cf0-specific period, and we will tell you the current position if you ask.
Billing records. Retained for as long as tax and accounting law requires.

If your firm needs a defined retention or deletion schedule as a condition of using cf0, contact us and we will agree one with you in writing.

Deletion

When you delete an item in the product it becomes immediately unavailable across cf0 and is queued for removal from object storage. A background process then works to erase the underlying bytes and records the outcome. Deletion in the product is scoped to the person who created the item.

For anything broader (closing an account, removing a departed colleague’s data, or erasing an entire organisation), email luca@cf0.ai. We handle those requests directly rather than through a self-service control. We will acknowledge within 5 business days, carry the request out, and confirm in writing what was removed and what was retained.

Three limits you should know before relying on this:

Content deleted from the live system can remain in the recovery history for up to 30 days, after which it is discarded.
Copies that have already left cf0 (content sent to a model provider, an email Zero sent, or a message delivered into your own messaging workspace) are governed by that provider’s, the recipient’s or your firm’s retention, not ours.
Records of the deletion itself, and basic file metadata, are kept as described under “Retention”.

Security

These are the measures actually in place:

Our primary database is encrypted at rest with a managed encryption key, and traffic to and from the service travels over TLS.
Every request is authenticated against a cryptographically verified sign-in token. Your organisation is read from that token and never from anything the browser can set.
Internal services are not reachable from the public internet. They are addressable only through our own gateway, which is the single place where identity is established.
Data access is scoped by organisation on every query, and the ability to destroy stored objects is deliberately isolated so that ordinary application code cannot do it.
Secrets are held in a managed secrets store and injected at deploy time. They are not committed to source control.
Production access is limited to those who need it.

Being equally clear about what we do not have: cf0 has not completed a SOC 2 audit, an ISO 27001 certification, or an independent penetration test, and we claim no regulatory certification. We are a small company and would rather you knew that than assumed otherwise. If your diligence process needs a security questionnaire completed, we will complete it honestly.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulator as required by law.

Cookies and local storage

What is actually set in your browser, and the outside services it loads. The cookie policy lists every cookie and storage key, and Cookie settings in the footer changes your choice:

Authentication cookies. Our identity provider sets them to keep you signed in. The product does not work without them.
Interface storage. We use your browser’s local storage and session storage for setup drafts, sign-in return paths, your cookie choice and, if you allow functional cookies, your earlier chat with Zero. This stays on your device, and clearing site data removes it.
A page-speed analytics script. Our public website loads it from Cloudflare Web Analytics to count page views and measure page speed. It sets no cookie and no storage. It loads only after you allow analytics cookies, or in the US until you opt out. If your browser sends a Global Privacy Control signal, it is not loaded at all. It is not loaded on the app pages under cf0.ai/app, or on the confirmation pages that Zero’s emails link to.
The demo booking calendar. Our public website embeds it from our scheduling provider, Cal.com, which can set its own cookies when it loads. It loads when you reach the booking section, because you need it to book a call, so it does not wait for your cookie choice.
Country flags at sign-up. The sign-up form shows country flags that your browser loads from flagcdn.com, an outside image service. That service receives your IP address and browser details when the flags load.

We do not use advertising cookies and we do not run cross-site ad tracking. You can block or clear cookies in your browser; blocking authentication cookies will stop you signing in.

Your rights

Subject to applicable law, you can ask us to:

Access. Give you a copy of the personal data we hold about you.
Correct. Fix data that is wrong or incomplete.
Delete. Erase your personal data, as described above.
Export. Provide your data in a structured, machine-readable format.
Restrict. Limit how we process your data.
Object. Object to processing based on our legitimate interests, including direct marketing.
Withdraw consent. Where we rely on consent, without affecting processing already carried out.
Complain. To your local supervisory authority. In the UK that is the Information Commissioner’s Office.

If you are a California resident, you have additional rights under California and other US state privacy laws. See “US state privacy rights” below.

Where cf0 processes content on behalf of your firm, we may need to direct your request to your firm, and we will tell you if that is the case.

How to exercise them

Email luca@cf0.ai from the address on your account and tell us what you want. There is no form to fill in. We may ask you to confirm your identity before we act.

We will acknowledge within 5 business days and respond substantively within 30 days, or tell you why we need longer where the law allows an extension. An authorised agent may act for you with proof of authorisation.

You can change your profile and notification preferences, and disconnect integrations, in settings at any time.

US state privacy rights

If you live in California or another US state with a comprehensive consumer privacy law, you have the rights below alongside everything listed under “Your rights”.

Know and access. What we collect, why, and who we disclose it to is stated in this policy rather than in a separate chart: see “What we collect”, “How we use it”, “Sharing”, and “Retention”. We treat those sections as our notice at collection.
Correct and delete. As described under “Your rights” and “Deletion”, including its honest limits.
Opt out of sale or sharing. There is nothing to opt out of: we do not sell personal data or share it for cross-context behavioural advertising. If your browser sends a Global Privacy Control (GPC) signal, we honour it as an opt-out request and load no analytics script during that visit.
No retaliation. Exercising these rights will not cost you your account or be held against you.
Appeal. Where your state grants an appeal right and we decline a request, email us with “appeal” in the subject line and someone other than the first reviewer will look at it again.

Under California’s Shine the Light law you may ask once a year whether we disclosed personal information to third parties for their own direct marketing. We do not do that, so the answer would be no. You can still write to us and check.

We do not use personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects you. Zero works within your firm’s rules and approvals: each email it drafts on a task waits for a member of staff to approve it, and decisions with such effects stay with people.

If we create aggregated or de-identified data from personal information, we will not attempt to re-identify it, and we will require the same of anyone we share it with.

These rights are not absolute; where the law permits, we may decline a request and tell you why. Where cf0 processes content on behalf of your firm, we may route your request to your firm, as described above. Nevada residents: we do not sell personal data as that state’s law defines it, so no opt-out registration is needed.

Children

cf0 is a business product for people aged 18 and over. It is not directed at children and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. The date at the top of the page shows when it last changed. If a change materially affects your rights or how we use your data, we will email account holders or show a notice in the product before it takes effect.

Contact

Questions, requests, and complaints about this policy or how we handle your data go to luca@cf0.ai. A person reads that address.

cf0, Corp.
131 Continental Dr, Suite 305, Newark, DE 19713, United States