Book a demo
Product
Leads and follow-upZillow, NewHomeSource, your website and the model-home kiosk in one inbox. Texting checks consent first.Homesites and contractsCommunities, homesites, floor plans and lot premiums. The purchase agreement, e-signature and change orders.Construction and the buyer portalStages with photos, shown to the buyer on their own portal. You answer “how’s my home coming along?” once.Closing, co-op and warrantyLoan status to clear to close, realtor co-op paid on the final price, and warranty walkthroughs booked at closing.AI that does the legworkA website chatbot that turns visitors into leads, a 0–100 score with a reason, and plain answers about your numbers.
Solutions
Online sales counselorsWork every new lead first, then hand a ready buyer to the community.Community sales teamsTours, homesite holds and contracts, from the model home.Sales managers and ownersTraffic, appointments and sales by community and source.Closing coordinatorsContingencies, loan status and the closing date, on the buyer’s record.Warranty teamsWalkthroughs scheduled at closing and requests routed to your trades.
Pricing
Resources
Help CenterStep-by-step setup guides for every part of the CRM.US rules for buildersTCPA, Do Not Call, CAN-SPAM, Fair Housing, e-signature — with sources.Security and dataOne database per workspace, two-factor, encryption at rest, an audit trail.IntegrationsZillow, NewHomeSource, Twilio, Dropbox Sign, a calendar feed and an API.FAQStraight answers on scope, pricing, data and setup.
Company
AboutWho builds ZevroCRM and the facts at a glance.Book a demoA 30-minute walkthrough with your communities and plans.
Book a demo Sign in

Texting, calling, email, Fair Housing, e-signatures, privacy, recording and AI. For each rule: what it asks of you, with the source, what ZevroCRM does about it, and what stays with you.

Read the rules Security and data
As of
October 30, 2026
Rules
13
Sources
41
Type
Not legal advice

01Read first

  1. [N1]

    This page is general information, not legal advice. Laws change and depend on your facts: confirm how each rule applies to your business with your own attorney before you rely on it.

  2. [N2]

    ZevroCRM does not make a builder compliant with any law, and holds no SOC 2, ISO or other certification. It gives you tools that support the rules below; using them well is up to you.

  3. [N3]

    ZevroCRM’s own terms of service, privacy policy and data processing agreement are linked at the foot of every page.

Checked against the sources as of

02The rules [13]

Each rule on one sheet: what it asks of you, its status, what ZevroCRM does about it, what stays with you, and the primary sources.

[02] Opt-out

Opt-outs: honor them within 10 business days

What it asks of you
A person can withdraw consent, and you must honor it within 10 business days. One confirmation text with no marketing in it is allowed. A STOP in reply to a marketing text ends all your marketing texts and calls to that person.
Status
Status, Oct 2026: today the FCC accepts an opt-out made by “any reasonable means”. A new FCC order (FCC 26-67, published Oct 26, 2026) takes effect Nov 25, 2026. It lets you name a reply word (stop, quit, end, revoke, opt out, cancel or unsubscribe) as the way to opt out, provided you say so in your texts. If you name no method, “any reasonable means” still applies.
What ZevroCRM does
  • A reply of STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE or OPTOUT revokes the number’s texting consent at once, adds it to a STOP list, and sends one confirmation. Nothing more is texted to it until the person replies START.
  • Opt-outs in words count too: “opt out”, “STOP please”, “please stop texting me”, “remove me”, “wrong number” and similar short replies are treated as STOP.
  • The first text to a number, and every marketing text, ends with “Reply STOP to opt out.”
  • HELP gets a reply with your name and how to reach a person.
  • A STOP or a number on your own do-not-contact list blocks every text, not only marketing. The one exception is a one-time sign-in code the person has just asked for.
What stays with you
An opt-out the product cannot read — a long message, or a request by phone or email — must be revoked by your staff on the lead, within the 10 business days. A STOP to texts does not block calls placed from ZevroCRM: when a person opts out of marketing calls too, add the number to your do-not-contact list, which blocks both.
Sources
↑ All rules

[03] DNC · hours

Do Not Call lists and calling hours, federal and state

What it asks of you
No sales calls or texts to numbers on the National Do Not Call Registry without written consent; download the registry for your area codes at least every 31 days. Keep your own do-not-call list, honor it within 10 business days and keep it for five years. Sales calls and texts only between 8 am and 9 pm in the recipient’s time zone. Several states are stricter.
Status
State rules for your target markets, Oct 2026. Florida: 8 am to 8 pm, at most three sales calls on the same subject in 24 hours, texts count as sales calls, and a texter gets 15 days after a STOP before a lawsuit. Texas: since Sept 1, 2025 (SB 140) its telephone-solicitation law covers texts, including registration with the Secretary of State unless an exemption applies. South Carolina: 8 am to 9 pm, the caller must give name, company and purpose, and texts are covered. North Carolina: 8 am to 9 pm and the national registry applies.
What ZevroCRM does
  • An admin can upload the registry numbers you downloaded; those numbers then cannot get marketing texts.
  • Your own do-not-contact list blocks every text to a number on it, and every call placed from ZevroCRM.
  • Florida: a fourth sales call to the same person within 24 hours is blocked. The count is the calls placed from ZevroCRM; texts are not counted toward it.
  • A sales call placed from ZevroCRM is checked first: blocked for a number on the National Do Not Call Registry unless the person inquired in the last 3 months, has a contract or a tour with you, or gave written consent; and blocked outside the recipient’s calling hours, using the same state windows as texts.
  • Texts are held to the recipient’s local hours: the lead’s time zone, else the community’s, and the area code’s zone too, so the stricter reading wins. Marketing texts follow stricter state windows where the code has them, such as Florida’s 8 am to 8 pm and Texas’s Sunday noon start.
What stays with you
Downloading the registry, and re-uploading it every 31 days, is yours; ZevroCRM cannot fetch it (it needs your own FTC subscription), but it shows when you last uploaded and reminds your admins when the copy is older than 31 days. A call dialled outside ZevroCRM is not checked. Texas registration, a written do-not-call policy and staff training are yours.
Sources
↑ All rules

[04] A2P 10DLC

A2P 10DLC: register before you text from a local number

What it asks of you
US carriers require business texts sent from an ordinary 10-digit number to be registered: your brand and each texting campaign, through The Campaign Registry. The CTIA Messaging Principles, which carriers enforce, ask for opt-in matched to the kind of message, a clear opt-in confirmation, and working STOP and HELP.
Status
Status, Oct 2026: Twilio has blocked all texts from unregistered US 10DLC numbers since Sept 1, 2023. CTIA guidance is an industry standard, not law, but a carrier can block traffic that ignores it.
What ZevroCRM does
  • Texts go out from your own Twilio account. You can enter a Twilio Messaging Service, which is what a 10DLC campaign is registered against.
  • STOP, HELP and START replies are handled as described above.
What stays with you
Brand and campaign registration is done by you in Twilio, in your company’s name. The opt-in confirmation text your campaign promises is yours to send.
Sources
↑ All rules

[05] CAN-SPAM

CAN-SPAM: marketing email

What it asks of you
Commercial email must not mislead in its sender or subject line, must say it is an ad, must give a valid postal address, and must offer an opt-out that works for at least 30 days and is honored within 10 business days. You are responsible even when someone else sends it for you.
Status
Status, Oct 2026: in force.
What ZevroCRM does
  • Every promotion email carries an unsubscribe link. One click on it, then a confirm, opts that person out, and later promotion sends skip them.
  • Promotion emails go out under your workspace’s name and branding, with your company’s postal address in the footer. A promotion email cannot be sent until that address is set.
What stays with you
Keeping the postal address in Settings → Branding current, honest subject lines and saying the email is an ad are yours.
Sources
↑ All rules

[06] Recording

Call recording consent

What it asks of you
Federal law lets one party to a call consent to recording. About a dozen states, Florida among them, require everyone on the call to consent. Texas, North Carolina and South Carolina are one-party states. When the two sides are in different states, the stricter rule is the safe one.
Status
Status, Oct 2026: in force. Recording a Florida call without everyone’s consent is a felony there.
What ZevroCRM does
  • Recording and the announcement are both on by default: a recorded US call starts with “This call may be recorded for quality and training purposes.” You can edit the wording.
  • If you switch the announcement off, a call is still recorded only when the buyer is in a one-party state. If the buyer is in an all-party state, or their state is unknown, it is not recorded.
What stays with you
Whether to record, and the announcement wording, are your call with your attorney. The buyer’s state is read from the lead, else the phone’s area code, else the community, and a cell number can be wrong about where its owner is.
Sources
↑ All rules

[07] Fair Housing

Fair Housing Act: ads, steering and AI scoring

What it asks of you
You may not treat a buyer differently, or publish anything that shows a preference, because of race, color, religion, sex, disability, familial status or national origin. Steering a buyer toward or away from a community for those reasons is illegal. Many states add more classes.
Status
Status, Oct 2026: the Act is in force and enforced. HUD withdrew its 2024 guidance on advertising through digital platforms, including AI ad targeting, by a memo of September 17, 2025 (the notice was published April 6, 2026); the law itself did not change.
What ZevroCRM does
  • Before a lead’s notes reach the AI for a lead score, words that name a protected class, or stand in for one (“baby on the way”, “near a church”), are replaced with “[protected]”, and the model is told not to use protected traits.
  • Every AI score is logged with its reason, the model and a fingerprint of the exact prompt, and an admin can export the log as a CSV for review.
  • The score is advice to your team, with a written reason. It does not by itself accept, reject or price a buyer.
What stays with you
The filter is a word list, not a guarantee. Your ads, your community pages, what your team writes and says, and any automation you set to act on a score tier are yours to keep fair.
Sources
↑ All rules

[08] E-SIGN · UETA

E-SIGN and UETA: electronic signatures

What it asks of you
A contract cannot be refused just because it was signed electronically. Where a law requires a disclosure to a consumer in writing, the buyer must first agree to receive it electronically, after being told how to get paper copies and withdraw consent. Some notices, such as default and foreclosure notices on a home, are excluded.
Status
Status, Oct 2026: the federal E-SIGN Act is in force; Texas, Florida, North Carolina and South Carolina have adopted UETA. Whether a county recorder accepts an electronic document is set by state and county rules.
What ZevroCRM does
  • Purchase agreements, change orders and selection sheets go out for signature through Dropbox Sign from your own account. ZevroCRM tracks each request as sent, viewed or signed, and files the signed PDF on the contract.
  • A change order moves the contract price only once it is signed.
What stays with you
Until you connect Dropbox Sign, the built-in signing page is for demos and testing only and is not a legal signature. The E-SIGN consumer disclosure, and which documents must stay on paper, are yours.
Sources
↑ All rules

[09] Privacy

State consumer privacy laws

What it asks of you
About twenty states have a comprehensive privacy law: a privacy notice, and the right of a resident to see, correct and delete their data and to opt out of its sale or targeted advertising. Most apply only above a size threshold, and many builders fall below it.
Status
Status, Oct 2026. Texas (TDPSA, since July 1, 2024) has no revenue threshold: it applies unless you are a small business by the SBA standard, which for new-home builders is $45 million in average annual receipts, and even a small business may not sell sensitive data without consent. California (CCPA) applies above $26,625,000 in revenue or other tests. Florida’s law reaches only companies with over $1 billion in revenue. North and South Carolina have no comprehensive law.
What ZevroCRM does
  • Your buyer portal shows buyers a privacy notice in your company’s name, and records which version each buyer accepted.
  • Each builder’s data sits in its own database, not a shared one.
  • Staff can export leads and buyers as CSV and correct any record.
  • A privacy request on a lead is answered by an admin from the lead page: download everything held on the person as one file, or delete their personal details. Deletion keeps the opt-out and consent records, so they are never contacted again, and refuses a lead with a contract — a sale record you must keep. Both are written to the audit log.
  • Sensitive fields such as a realtor’s tax ID are encrypted at rest; every change is kept in an audit trail.
What stays with you
Verifying who is asking, answering within the legal deadline (usually 45 days), and requests about a buyer under contract are yours, with your counsel. So is your own privacy policy.
Sources
↑ All rules

[10] Breach

Data breach notification

What it asks of you
Every state requires you to tell affected residents when their personal information is breached, and some require telling the attorney general.
Status
Status, Oct 2026. Texas: residents within 60 days, the attorney general within 30 days if 250 or more Texans. Florida: residents within 30 days, the state within 30 days if 500 or more. South Carolina: as fast as possible, plus the state and credit bureaus if over 1,000. North Carolina: without unreasonable delay, and a report to the attorney general.
What ZevroCRM does
  • An append-only audit trail of who did what, including sign-ins and exports, to help you work out what was reached.
  • Two-factor sign-in, passkeys, revocable sessions and account lockout reduce the chance of a breach through a stolen password.
What stays with you
Deciding whether an incident is a notifiable breach, and sending the notices, is yours. How fast ZevroCRM must tell you about an incident on our side is set in our data processing agreement: within 72 hours of our confirming it.
Sources
↑ All rules

[11] AI

AI rules: chatbots and automated decisions

What it asks of you
Do not let a chatbot mislead people about being a bot to make a sale (California), disclose AI when asked (Utah), and do not use AI to discriminate on purpose (Texas). Colorado will require notice, an explanation and human review when AI materially influences a housing decision. The FTC treats deceptive AI claims as unfair practices.
Status
Status, Oct 2026. Texas TRAIGA took effect Jan 1, 2026; its disclosure duty is for government agencies, while private businesses face prohibitions. Colorado replaced its 2024 AI Act with SB 26-189 (signed May 14, 2026); its main duties start Jan 1, 2027, and it matters only if you sell in Colorado.
What ZevroCRM does
  • The website chatbot is labelled “AI assistant” and tells every visitor “You are chatting with an AI assistant.” Visitors can ask for a person.
  • No AI feature runs until your admin or owner accepts the AI data terms, which name the AI providers used (Google, xAI and Anthropic), and each staff member acknowledges how AI handles buyer data.
  • The buyer privacy notice says an AI assistant may have answered the first inquiry.
  • The AI lead score is logged with its reason, as described under Fair Housing.
What stays with you
If you sell in Colorado, the notices and the human-review process are yours. Before text reaches an AI provider, phone numbers (in the usual US formats), emails and Social Security numbers are replaced with placeholders; this is pattern-based, so do not paste ID documents or financial details into AI features.
Sources
↑ All rules

[12] RESPA §8

RESPA Section 8: co-op and affiliated lenders

What it asks of you
On a sale financed with a federally related mortgage, no one may pay or take a fee for referring settlement business. Co-op commissions between real estate brokers for real brokerage work are allowed. A builder that refers buyers to an affiliated lender or title company needs a written disclosure at or before the referral, and may not require the buyer to use it.
Status
Status, Oct 2026: in force. Cash sales fall outside it.
What ZevroCRM does
  • The co-op owed to each realtor is calculated at closing from the final price, capped per workspace, with the realtor who registered the buyer first on record. Admins can export 1099-NEC rows.
What stays with you
ZevroCRM does not produce the affiliated business disclosure or check your referral arrangements. Those, and any incentive tied to a lender, are for your attorney.
Sources
↑ All rules

[13] ADA · WCAG

Accessibility: ADA and WCAG

What it asks of you
The Department of Justice says the ADA covers a business’s website. There is no federal web rule for private businesses; WCAG is the yardstick courts and settlements usually use.
Status
Status, Oct 2026: DOJ’s 2022 web guidance is still published. WCAG 2.2 is the current W3C Recommendation. DOJ’s 2024 rule with a WCAG deadline covers state and local governments, not builders.
What ZevroCRM does
  • WCAG 2.2 AA is the design target for the staff app, the buyer and realtor portals, and the kiosk. The target includes a skip link, labelled fields, visible focus, keyboard alternatives to dragging, and respect for reduced-motion settings.
What stays with you
There is no independent accessibility audit of ZevroCRM, so we do not claim full conformance. Your own website, and the documents you upload, are yours.
Sources
↑ All rules

03Out of scope

  1. [X1]

    The GLBA Safeguards Rule applies to businesses significantly engaged in financial activities. A builder is usually not one; a builder’s own mortgage company, or a builder that finances sales, may be.

  2. [X2]

    The Interstate Land Sales Full Disclosure Act governs lot sales and property reports, not how you use a CRM.

  3. [X3]

    The FTC rule on reviews and testimonials matters if you ask buyers for reviews. ZevroCRM does not send review requests.

  4. [X4]

    State telephone-solicitation laws outside Texas, Florida and the Carolinas. ZevroCRM applies several stricter state texting windows, but this page covers only those four states in detail.

  5. [X5]

    Mortgage lending and fair-lending law (such as ECOA). ZevroCRM tracks loan status; it does not originate loans or score credit.

Something here out of date, or a rule we missed? Write to hello@zevrocrm.com.

Ask a question

A 30-minute walkthrough of the consent records, the send-time checks and the audit trail, set up with your own communities. We reply within one business day.

Ask in a demoSecurity and data