Privacy Policy

Zovo Holdings LLC · Last updated: 28 September 2026

Zovo runs a tipping service for hospitality workers. A guest taps or scans a tag, tips the worker who served them, and Stripe pays the tip to that worker's own payout account. This policy explains what we collect, why, how long we keep it and how to ask us to delete it. It covers both this website and the tipping service itself.

We are the data controller for everything described here. Where a property uses Zovo for its staff, that property is also a controller of its own workers' data — they decide who is on the roster. Contact us at support@zovotipping.com.

If you are visiting this website

The demo form. If you ask us for a demo we store the name, work email, company, role, property or location count and the free-text description you give us. We use it to contact you about a demo and to prepare pricing. We do not sell it, and we do not use it for advertising. It is held by Supabase, our database provider for this website.

We keep it until you ask us to remove it, or until we have had no contact for two years. Unlike the periods further down this page, that one is not enforced by an automated job — we clear these by hand. Ask us and we will do it straight away.

Analytics. This website runs a page-analytics script provided by Lovable, the tool we built it with, which records page views and sends them to Tinybird, an analytics service. It is not advertising, and we do not use it to build a profile of you.

Fonts. This website loads its fonts from Google Fonts, which means Google receives your IP address when a page loads.

Cookies on this website. Cloudflare, which serves the site, sets a __cf_bm cookie to tell humans from bots. We set none of our own here. The tipping pages are different and are covered below.

If you are a guest who left a tip

We never see your card. Card numbers, expiry dates, security codes and wallet tokens go directly to Stripe, our payment processor. They do not pass through and are not stored on our systems.

What we do record about a tip:

• The amount you tipped and the service fee you paid.
• A one-way keyed hash of your IP address and of your browser's user-agent string. These are HMAC-SHA256 digests computed with a secret key; we never store the raw values and cannot recover them from the hash. We use them to detect card-testing attacks and to defend chargebacks.
• A device class (iOS, Android or other) and a session identifier that links your page view to your payment, so we can measure how guests reach the tipping page and where they stop. The session identifier is a random value minted for that visit and carried in the page's links — it is not a cookie, it is not stored on your device, and it identifies a visit rather than a person.
• Whether you arrived by NFC tap or QR scan.
• An optional star score, message and service tags, if you choose to say thanks. This is what you choose to write, and the worker and property can read it.
• Whether the thank-you page showed you the review invite and whether you opened it, and the star you tapped, if any. The star is saved as private feedback to the property; it never changes where the invite takes you. We do not see or receive the review you write on Google.
• A "Report a problem" message, if you send one, and any contact details you choose to add. It goes to the property's managers.
• An email address, only if you ask Stripe for a receipt. It goes to Stripe; we do not store it.

We do not collect your name, your address, or your card details, and we do not use advertising trackers.

Cookies on the tipping pages. We set none of our own. The session identifier above is a random value carried in the page's own links, not stored on your device — close the tab and it is gone. Stripe's payment script, which the page loads so that Apple Pay and Google Pay work, sets its own cookies for fraud prevention; those are Stripe's and are described in Stripe's privacy policy.

How long we keep it. The tip itself is a tax and payroll record and is kept for seven years. The identifiers around it are cleared sooner, by a job that runs every night:

\* Applied by hand for now, not yet by the nightly job; we are automating it. Ask us and we will clear it straight away.

A word on the fourth row, because the honest version is narrower than it sounds. If you opened a tip page and never paid, the empty record is deleted after 90 days. If you got as far as the payment screen and then changed your mind, the record stays — it is part of the payment trail — but everything that could identify you is cleared from it after 180 days, the same as any other tip.

Raw page-view records older than two years are condensed into daily totals and the individual records deleted. Nothing about an individual visit survives that: no session identifier, no hashes, and no time more precise than the day.

Every period on this page is a floor, not a ceiling — we keep records longer where the law requires it. If a record is subject to a legal hold, an audit, a subpoena or an open dispute, we keep it until that ends, and we suspend the automatic deletion for it. That is the only reason anything here is kept beyond the period stated.

If you are a worker

To pay you, we hold your name as guests see it, your phone number (in international format — it is also how you sign in), your job title, your tips, the cash tips you report, your shifts and your payouts.

When you sign in we store only a SHA-256 hash of your session cookie, never the cookie itself, so a copy of our database cannot be replayed as a login. Alongside it we keep keyed hashes of the IP address and browser you signed in from — the same one-way kind described above — so that a stolen session can be investigated.

To be paid, you set up a payout account with Stripe. Stripe collects your legal name, date of birth, address, government identification and bank details in order to comply with financial regulation. We never see or store those. Our database holds only Stripe's account reference and whether you are cleared to be paid.

How long we keep it. Your earnings records are payroll records and are kept for seven years. Your shift records are kept for three years.

Cash tips you report. If you report cash tips on your Zovo page, we keep the date and amount you entered, and any correction your manager made with the reason they gave. Those amounts are payroll records and are kept with your earnings. Zovo never moves that cash; it is a record only. The optional note you typed is cleared 90 days after you leave.

Google reviews that name you. If your property connects its Google Business Profile, we read that location's public Google reviews and match workers' first names in the review text, so the dashboard can show your managers the reviews that mention you by name. We never link a review to a particular tip or guest — Google does not tell us who wrote it.

Your phone number is cleared automatically 90 days after you leave, along with your payout-setup status. Your name stays, because payroll records need a name against each line. You do not have to wait for the 90 days — ask us and we will clear it straight away (see "Your rights" below).

If you are a manager

We store the email address Cloudflare Access proves when you sign in, your display name, your role and when you were last active. Every change you make in the dashboard is written to an audit log with your member id and a keyed hash of your IP address. That log is part of the payroll trail and is kept for seven years; the IP hash on it is cleared after 180 days.

Connecting Google. A manager who connects the property's Google listing authorises Zovo to read that listing's reviews. We store Google's access token sealed with its own key, use it only to read the reviews, and revoke it when the listing is disconnected. The reviews themselves — reviewer display name, stars, text, reply and dates, all public on Google — are stored for the property's review dashboard, and deleted on request or 30 days after the property disconnects Google (applied by hand for now, like the row marked * above). Property logos you upload or pick are stored on Cloudflare.

If you are removed from a property's dashboard, your email address and display name are replaced with a placeholder 90 days later, automatically. The audit log keeps pointing at your record — it just stops naming you.

Who else holds your data

We deliberately designed the payment path so that sensitive data lives with the processor rather than with us.

For the tipping service:

• Stripe — payments. Card details, wallet tokens, billing name and postal code, receipt email, fraud-scoring signals, refunds and disputes. For workers, the identity and bank details a payout account needs.
• Twilio — the SMS codes workers use to sign in. Phone numbers and verification attempts.
• Cloudflare — hosting, manager sign-in, email routing and storage of property logos. Sign-in logs for managers, and request logs.
• Google — the property's Google listing (to find it and read its public rating) and, when a property connects it, that listing's reviews.
• Neon — our database. Holds point-in-time history for a restore window, which means a cleared field stays recoverable there for a short period after we clear it.

For this website:

• Lovable — the tool this site is built and hosted with.
• Supabase — where the demo form's answers are stored.
• Tinybird — page-view analytics.
• Google — fonts, which means your IP address when a page loads.
• Cloudflare — serving the site, and the bot-detection cookie above.

We do not sell personal information, and we do not share it with anyone outside these lists.

Your rights

Depending on where you live you may have the right to see what we hold, to correct it, to have it deleted and to know who we shared it with. We honour these requests regardless of where you live.

• Workers — we can export everything we hold about you: your profile, the tags you have carried, your tips, the cash tips you reported, your earnings, your shifts, your payouts and the notes guests left you. We can also delete your identity while keeping the earnings records the law requires us to keep. Both are built and work today.
• Guests — we cannot identify you by name, because we never collected it. To find your tip, send us the Stripe receipt (amount, date, last four digits) or your thank-you link, and we will clear the identifiers attached to it.
• Managers — write to us from the address on your account.
• Anyone who filled in the demo form — write to us and we will delete it.

Email support@zovotipping.com. We will confirm your request within 10 business days and complete it within 45 days, or within one month where the GDPR applies. Where the law allows an extension and we need one, we will tell you in writing.

What we keep even after a deletion request. Tip amounts, earnings records, reported cash-tip amounts, payout records and the audit trail of payroll actions are tax and payroll records. We keep those for their retention period and tell you that we have. We remove the personal data around them.

We also keep a record of the request itself — the date, who asked, what was asked for, what we did and when we confirmed it — for seven years. This is the one record we do not delete on request, because it is the evidence that we honoured you. It is kept outside the product database and is not used for anything else.

Backups. We copy each day's records to encrypted storage overnight. Records already written to a backup are not edited — they are deleted when the backup expires, 13 months after it was taken.

Children

The service is not directed at children and we do not knowingly collect data from anyone under 13.

Changes

We will update the date at the top when this changes. If a change is significant we will say so on the page rather than quietly editing it.

Contact

Zovo Holdings LLC — support@zovotipping.com