This Privacy Policy describes how Zul Spot LLC (“Zul Spot,” “we,” “us,” or “our”) — the owner and operator of the POCAD Platform — and POCAD AC Services (“POCAD,” the licensed HVAC service collaborator) collect, use, store, share, and protect your information when you use the POCAD Client Portal on the web or through the POCAD iOS application (together, the “Platform”).
This Privacy Policy is specific to the Client Portal. The marketing website (pocadair.com) has a separate, simpler privacy policy that applies to general site visitors. If you have a Client Portal account, this policy applies to that account.
If you only read one section, read this one:
| Category | What we collect | Why |
|---|---|---|
| Identity | Full name, account type (customer / referrer / partner) | To identify you and assign the correct portal role |
| Contact | Email address, phone number | To log in, send notifications, and contact you about service |
| Service Address | Street, unit, city, state, ZIP | To dispatch technicians and tie service history to a property |
| Address Verification | Proof-of-address document (utility bill, bank statement, official letter) you upload during registration | To manually verify residency before granting full portal access |
| Account Security | Password (stored only as a salted hash; never in plain text), 2FA codes (when enabled) | To authenticate logins and protect your account |
| HVAC Equipment | System details you enter or that technicians record (brand, model, serial number, install date, location at the property) | To maintain your system records and calculate ClimaScore™ |
| Service Requests | Visit booking preferences, support ticket messages, comments on projects, quote acceptances/declines | To deliver service and respond to your requests |
| Payment Receipts | Zelle screenshots or PDF receipts (amount, payment memo) and, for card payments, the transaction reference returned by our processor (Stripe). We do not store full credit card numbers. | To verify and reconcile payments for service work |
| AI HVAC Companion | Your questions, the AI’s responses, and usage counters | To deliver AI guidance, enforce plan limits, and audit safety/abuse |
| Documents | Files attached to your projects (quotes, proposals, reports, photos) | To document the scope and history of work performed |
| Category | What we collect | Why |
|---|---|---|
| Device & Browser | Browser type, OS, screen size, user agent | For compatibility, security audits, abuse detection |
| IP Address | IP address and approximate (city-level) location derived from it | Security, rate limiting, fraud prevention |
| Activity Logs | Login timestamps, page actions, AI prompts, form submissions, push delivery results | Security, quality assurance, support troubleshooting |
| Cookies / Local Storage | Essential session cookies, CSRF tokens, and (on iOS) Keychain-stored credentials when you enable Quick Login | To keep you logged in and protect against attacks |
If you use the POCAD iOS application, we additionally process:
We use your information for the following purposes:
We do not:
The POCAD iOS app uses Apple Push Notification service (APNs) to deliver:
Push notification content is short and intentionally non-sensitive. We store the delivery attempt (timestamp, push status, error if any) for diagnostic purposes only. You can turn off push notifications at any time via iOS Settings → Notifications → POCAD, or by tapping More → Settings inside the app.
We use a small number of trusted vendors to operate the Platform. Each is bound by a contract that limits their use of your data to providing services to us. We share only what is necessary.
| Vendor | Purpose | Data shared |
|---|---|---|
| Hostinger | Web hosting & database (LiteSpeed + MariaDB) | All Platform data necessary to operate the service |
| Apple Inc. | Push Notification service (APNs); App Store distribution | Device push token, notification content (title + short message) |
| Stripe, Inc. | Card payment processing for memberships and projects | Payment details you enter are sent directly to Stripe; we receive only tokens/reference IDs, never full card numbers |
| Apple In-App Purchase (StoreKit) | Processing eligible subscription/purchase transactions made inside the iOS app | Handled by Apple under Apple’s terms; we receive a transaction identifier and status, not your card details |
| OpenAI (GPT-4-class model) | AI HVAC Companion language model | The text of your AI question and minimal context. Under our agreement, the vendor does not retain prompts for training. |
| Email Delivery (SMTP / transactional email) | Sending verification emails, receipts, and notifications | Email address, name, message content |
| SMS Provider (when enabled) | Sending visit reminders and 2FA codes | Phone number, message content |
| Zelle (via your bank) | Peer-to-peer payment confirmation | We receive only the receipt screenshot you upload; the underlying transaction is handled entirely by your bank and Zelle. |
We may also disclose information when required by law (court order, subpoena, regulatory investigation), to enforce our Terms, to protect rights, property, or safety, or in connection with a merger, sale, or financing of Zul Spot LLC — in which case successor entities will remain bound by this policy.
We use administrative, technical, and physical safeguards to protect your data, including:
We retain personal data only as long as needed for the purposes described above. Approximate retention periods:
| Data type | How long |
|---|---|
| Active account profile (name, email, address, phone) | For as long as the account is active, plus up to 24 months after closure for support and audit |
| Service history, quotes, invoices, ClimaScore™ records | Up to 7 years for tax, warranty, and contractor record-keeping requirements |
| Payment receipts | Up to 7 years (tax recordkeeping) |
| AI HVAC Companion conversations | Up to 24 months for safety audit and abuse prevention |
| Push delivery logs | Up to 12 months |
| Login & security logs | Up to 12 months |
| Proof-of-address documents | Until verification is complete, plus up to 24 months. Documents are deleted earlier on verified request. |
After these periods (or earlier on a verified deletion request), data is securely deleted or de-identified.
Regardless of where you live, you may:
Email contact@pocadair.com from the email address on your account, with the subject line “Privacy Request — [Access / Correction / Deletion / Export].” We will verify your identity and respond within 30 days. There is no fee for reasonable requests.
If you are a California resident, you have the right to know what personal information is collected, used, shared, or sold; to delete personal information; to correct inaccurate personal information; to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising); and to non-discrimination for exercising these rights.
Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Florida, Oregon, and others as they take effect) have similar rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising (which we do not engage in).
The Platform is intended for adults age 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact contact@pocadair.com and we will delete it promptly.
The Platform is operated from the United States and is intended for users in the United States. If you access it from outside the U.S., you understand that your data will be transferred to and stored on servers in the U.S., where data-protection laws may differ from those in your country.
For users installing the POCAD iOS app from the App Store, the following summarizes our App Privacy “Nutrition Label” disclosures:
| Data type | Linked to user? | Used for tracking? | Purpose |
|---|---|---|---|
| Name, email, phone, address | Yes | No | App functionality, customer support |
| User content (support messages, AI questions, uploaded documents) | Yes | No | App functionality |
| Identifiers (User ID, Device Push Token) | Yes | No | App functionality, push notifications |
| Usage data (in-app activity) | Yes | No | Analytics for the operator only; not shared with advertisers |
| Diagnostics (crash logs, performance) | No | No | App functionality |
| Purchases (membership & purchase history) | Yes | No | App functionality; card details are processed by Stripe or Apple and are not stored by us |
We do not use any data for tracking across apps or websites owned by other companies (as defined by Apple’s AppTrackingTransparency framework).
On the web portal, we use only essential cookies and local storage for:
We do not use third-party advertising cookies in the Client Portal. The marketing site (pocadair.com) may use basic analytics; see its separate privacy notice.
We may update this Privacy Policy from time to time. The “Last Updated” date at the top reflects the most recent revision. Material changes will be announced on the login page and, where reasonable, by email or in-app notice. Your continued use of the Platform after changes are posted means you accept the updated policy.
Zul Spot LLC
Florida Limited Liability Company — owner of the POCAD Platform
Email: contact@pocadair.com
POCAD AC Services
Licensed HVAC service collaborator
Email: contact@pocadair.com
Support / Emergency: 754-317-1764
To exercise any privacy right, email contact@pocadair.com with subject “Privacy Request.”
← Back to Login