ZOVI Privacy Policy
This Privacy Policy explains how ZOVI (“ZOVI,” “we,” “us,” or “our”), operated as part of the METAVERSE ULTRA product suite, collects, uses, stores, shares, and protects information when you use our Discord bot, web dashboard, APIs, and related services (collectively, the “Service”). By using ZOVI, you acknowledge this Policy together with our Terms of Service.
1. Operator identity
The Service is operated by ZOVI. For privacy requests, legal notices, and data-protection inquiries, contact us using the details in the “Contact” section below.
Jurisdiction and registered entity details may be updated as ZOVI’s commercial entity structure is finalized. Until a specific governing jurisdiction is published in an updated version of this Policy, references to “applicable law” mean the laws that lawfully apply to ZOVI’s operation of the Service and to your use of Discord.
2. Scope
This Policy covers: (a) the ZOVI Discord bot; (b) Discord OAuth sign-in to the ZOVI dashboard; (c) guild-scoped configuration and operational records stored by ZOVI; and (d) optional Premium/Pro redeem-code records. It does not govern Discord Inc.’s independent processing, other bots, or third-party websites outside ZOVI.
3. Information we collect
We collect information in the following categories. We do not collect more Discord data than is reasonably necessary for the features you use.
Discord OAuth and account identifiers. When you sign in to the dashboard with Discord OAuth (when configured), we receive and store your Discord user id (snowflake), username and related public profile fields returned for the authorized scopes, and guild membership information needed to show servers you can manage and to enforce tenant isolation.
Encrypted tokens and sessions. We store an encrypted form of your Discord OAuth access token (AES-256-GCM when ENCRYPTION_KEY is properly configured) and a hashed session secret associated with an HttpOnly session cookie. We do not expose bot tokens or raw OAuth tokens to the browser dashboard.
Guild and configuration data. We store guild identifiers, module configuration, entitlements or plan markers, localization preferences and overrides, ticket records, economy/XP balances where enabled, security and protection configuration and related incident/evaluation records, broadcast campaign drafts and delivery attempt metadata, temporary voice-room templates, giveaway records, backup configuration snapshots (settings JSON checksums/previews as implemented), audit events (with redaction of secrets), add-on install state, redeem-code issuance/redemption records, and similar operational data described in product documentation.
Bot message and moderation processing. When the bot is invited and relevant intents/permissions are granted, the Service may process message content, member events, interaction payloads, and moderation-related signals as needed to evaluate rules, plan or execute protection actions, operate tickets and staff workflows, and provide other enabled modules. We do not maintain an indefinite corpus of all Discord messages, and this build does not provide a voice-recording pipeline.
Technical and usage data. We may process request metadata (timestamps, request identifiers, IP addresses as seen by infrastructure providers), health and error diagnostics, and cookie/session technical data necessary to operate the Service securely. Secrets and Discord-shaped tokens are redacted from logs where our observability layer applies.
Communications. If you contact us, we process the content of your message and any contact details you provide.
4. Bot, message, and moderation processing
ZOVI’s Discord bot processes events and content only as required for features enabled for a guild and permitted by Discord’s APIs, intents, and your permission grants.
Protection, AutoMod-style evaluation, security heat/join-gate planning, moderation case workflows, and similar modules may inspect message text, attachment metadata, member join/profile signals, or role/channel context to produce plans, dry-runs, or—where a verified Discord bridge confirms success—applied actions. Where a feature is Partial or Incomplete, ZOVI does not invent successful Discord side effects.
Server administrators control which modules are configured. Removing the bot or revoking permissions limits further processing through Discord’s normal mechanisms, subject to retention of records already stored as described below.
6. How we use information
We use information to: authenticate users via Discord OAuth; authorize guild-scoped access and permissions; operate bot and dashboard features you enable; encrypt and protect credentials; maintain audit logs and security diagnostics; provide localization; process entitlements and redeem-code unlocks where offered; operate an owner console for whitelisted product owners where configured; communicate about the Service; comply with law; and detect, prevent, and investigate abuse, fraud, or security incidents.
We do not sell personal data. We do not share personal data with third parties for their independent marketing purposes. We do not use Discord message content to train public foundation models.
7. Legal bases (where GDPR / UK GDPR applies)
Contract / requested service: processing needed to provide the bot and dashboard features you enable.
Legitimate interests: securing the platform, preventing fraud and abuse, and maintaining operational telemetry, balanced against your rights.
Consent: where a feature requires explicit opt-in (for example DM campaigns requiring consent records).
Legal obligation: when we must retain or disclose data to comply with law or lawful platform enforcement requests.
8. No sale of data
ZOVI does not sell your personal information. We do not exchange Discord user identifiers, message content, or guild configuration for monetary or other valuable consideration as a “sale” under applicable privacy laws.
If a future feature would involve optional analytics or integrations that change this posture, we will update this Policy and, where required, obtain appropriate consent or provide opt-out mechanisms before such processing begins.
9. Third parties and Discord
Discord. The Service depends on Discord Inc. (and its affiliates) as a platform. When you authenticate with Discord or use the bot in a Discord server, Discord’s Terms of Service, Privacy Policy, Community Guidelines, and Developer Policy also apply. We receive data from Discord’s APIs according to the scopes and intents configured for the ZOVI application.
Infrastructure processors. We may use hosting, database, cache, logging, email, or similar service providers acting as processors on our behalf. These providers are permitted to process data only to provide services to ZOVI and must implement appropriate security measures.
Optional AI and media providers. If AI chat, speech, music, translation, or object-storage integrations are configured, requests may be sent to those providers only when the corresponding adapters are wired and health-checked for live use. Until then, ZOVI adapters are designed to refuse fabricated replies or invented playback rather than silently calling providers. When live provider calls are enabled, provider terms and privacy policies apply to data sent to them.
We do not control Discord’s independent processing of platform data outside ZOVI.
10. AI features — important disclaimers
ZOVI may offer AI-assisted configuration planning, chat validation, knowledge-base stubs, quota accounting, or similar features. These capabilities may be unavailable, credential-gated, or Partial.
AI outputs can be incorrect, incomplete, or inappropriate for your community. AI configuration plans do not execute arbitrary system commands or invent Discord side effects; human confirmation and verified execution paths are required where the product so indicates.
Do not submit secrets, passwords, payment card data, or sensitive personal data about others into AI prompts. Where AI providers are used, prompts and related metadata may be processed by those providers under their terms.
ZOVI does not claim live model inference or guaranteed AI availability unless credentials and health checks confirm an operational provider.
11. Retention
We retain information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.
Session records expire or are revoked according to session lifetime and logout. Encrypted OAuth token material is retained while a valid session or refresh path requires it and is removed or rendered unusable when sessions are revoked or purged under our operational practices.
Guild configuration, tickets, economy balances, security incidents, campaign metadata, redeem-code records, and audit events are retained while the guild uses the Service and for a reasonable period thereafter for abuse investigation, backups/previews as implemented, and legal compliance. We do not store indefinite raw message corpora or voice recordings in this product build.
When you remove the bot or stop using the Service, residual records may remain until deleted under retention schedules or upon a verified deletion request, subject to legal holds.
12. Security practices
We implement technical and organizational measures appropriate to the nature of the Service, including: encryption of Discord OAuth tokens at rest with AES-256-GCM when configured; hashing of session secrets; HttpOnly, SameSite=Lax cookies (Secure in production); redaction of secrets in logs and audit metadata; guild-scoped authorization and tenant isolation in the data model; confirmation requirements for high-impact actions; and rejection of unverified billing webhooks until provider verification is operational.
No method of transmission or storage is perfectly secure. You are responsible for safeguarding Discord accounts, server permissions, and access to the dashboard. Promptly revoke ZOVI’s access and contact us if you suspect unauthorized use.
13. International transfers
ZOVI and its processors may process and store information in countries other than the country where you or your Discord server members reside. Those countries may have different data-protection laws.
Where required, we use appropriate safeguards for cross-border transfers (such as contractual clauses or other lawful transfer mechanisms). By using the Service, you understand that your information may be transferred to and processed in such locations.
14. Your rights
Depending on your location, you may have rights to access, correct, update, delete, or export personal data; to object to or restrict certain processing; to withdraw consent where processing is consent-based; and to lodge a complaint with a supervisory authority.
Discord users may also manage platform-level permissions and authorized applications in Discord’s own settings. Server administrators control bot permissions within their guilds.
To exercise rights regarding data ZOVI stores, contact us using the Contact section. We may need to verify your identity and Discord user id and may decline requests that are unlawful, abusive, or that would compromise other users’ privacy or security. Some data is controlled jointly with Discord or solely by Discord; we will explain when a request must be directed to Discord.
15. Children’s privacy
The Service is not directed to children under 13 years of age (or the minimum age required in your country to use Discord). Consistent with Discord’s requirements and our Terms, you must meet Discord’s minimum age and be at least 13 years old to use ZOVI.
We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to ZOVI, contact us and we will take appropriate steps to delete such information where required.
16. Discord Terms and Developer Policy compliance
ZOVI is designed to operate as a Discord application in compliance with Discord’s Terms of Service, Developer Policy, and related platform rules. We process user data obtained through Discord only to provide and improve visible, disclosed application functionality, not to independently monetize Discord user data outside the Service.
We do not use self-bots or unauthorized client automation. Privileged intents (such as Message Content or Server Members), when requested, are used for stated moderation, protection, and membership features.
17. Jurisdiction placeholder
[JURISDICTION PLACEHOLDER] The governing law, venue, and dispute-resolution forum for privacy-related disputes will be stated here when ZOVI’s operating entity and primary establishment are finalized. Until then, mandatory consumer protections in your country of residence remain unaffected to the extent they cannot be waived.
Nothing in this Policy limits rights that cannot be limited under applicable law.
18. Changes to this Policy
We may update this Privacy Policy from time to time. The “lastUpdated” field at the top of this document indicates the effective date of the current version. Material changes will be posted in the Service or otherwise communicated when appropriate.
Continued use of the Service after an update constitutes acceptance of the revised Policy, except where applicable law requires a different standard.
19. Codes, payments, and refunds
ZOVI does not sell personal data and does not currently run paid checkout. Redeem codes and any future fees are non-refundable as described in the Terms of Service. A privacy request, deletion request, or decision to remove the bot is not a request ZOVI must answer with money, credit, or a chargeback.
If payment processing is enabled later, ZOVI may retain the minimum transaction records needed to enforce the no-refund policy, respond to a payment dispute, and meet legal accounting duties. Those records are not used to market to you.
20. Contact
For privacy questions, data-subject requests, or security notices regarding ZOVI, contact the operator at: [email protected] (placeholder — replace with the production contact address before public launch), or through the support channel published on the ZOVI dashboard or official Discord presence.
Please include your Discord user id, the relevant guild id if applicable, and a clear description of your request. Do not send passwords or full authentication tokens in email.