ZARA for Business

This is a first draft written to build the required protections into the product. It has not yet been reviewed by an attorney and will be before ZARA takes paying customers.

When a business turns ZARA on, she acts as its AI operator. She only does what the owner permits, and each permission is a separate switch the owner can turn off at any time:

• Read the public website (respecting robots.txt, public pages only, rate limited).
• Connect tools the owner chooses (for example email, calendar, payments).
• Send email on the business’s behalf.
• Send text messages only to people who have given recorded consent.
• Make AI-voice calls only to people who have given recorded consent.

Guard rules built into the code: nothing is sent to anyone on the suppression list; no text or AI-voice without a consent record; no contact before 8am or after 9pm in the recipient’s local time; STOP and HELP work; ZARA identifies as an AI on first contact; and every outbound action is written to an audit log. The owner remains responsible for their business’s messages and for having the right to contact their audience. When ZARA handles customer data for a business, the DPA applies.