Privacy Policy

01Who we are

ZOREVA-UI is operated by Héctor Javier Yepez Vela, an individual (persona física) registered with Mexico’s tax authority (SAT) under the “Régimen de las Actividades Empresariales con ingresos a través de Plataformas Tecnológicas,” based in the State of Mexico, Mexico (“ZOREVA-UI,” “we”). We are responsible for the personal data described here. Privacy requests: legal@zoreva-ui.com.

This Policy covers zoreva-ui.com, ZOREVA-UI accounts, the MCP server and the ZOREVA-UI CLI (the “Service”). It doesn’t cover third-party AI clients, editors or sites you use with us; they have their own policies.

02Data we collect

Account data

• Email address and, if you sign in with Google or GitHub, the basic profile those providers share (name, avatar, provider ID).
• Plan, credit balance and usage records.

CLI data

• Prompts and project context you send. When you use ZOREVA-UI models, your messages and the file contents, command output and project rules (such as ZOREVA.md) the agent includes in a request are sent to our servers and forwarded to the model provider to generate a reply.
• Request metadata: model, token and credit counts, timestamps, CLI version and operating system.
• Update checks: about once a day the CLI checks for a new version. You can turn this off with ZOREVA_NO_UPDATE_CHECK.
• Shared requests: the CLI asks you once when you first use it. If you agree (or later turn it on with /privacy on), we keep a redacted copy of each request, up to 500 characters, with keys, tokens, passwords, emails, phone numbers, file paths and web-address parameters removed, together with Auto usage data such as the task type, response time and credits used.
• Crash reports: off by default. If you opt in (asked once after a crash, or /telemetry on), we receive anonymous crash details. They never include your code, prompts or file contents.

If you connect your own AI provider key with /keys, those requests go to that provider under its terms.

Billing data

When paid plans launch, Stripe will collect card and billing details. We receive limited data such as plan status, country and the last four digits of a card, never full card numbers.

Website and MCP data

• IP address, browser and device type, pages and endpoints requested, and timestamps, in server and security logs.
• Cookies and local storage described in the Cookie Policy.
• Emails, feedback and catalog submissions you send us.

03How we use data

• Provide the Service: authenticate you, run CLI requests, serve catalog downloads and MCP calls.
• Meter and bill usage in credits.
• Secure the Service: prevent abuse, fraud and attacks; enforce our Acceptable Use Policy.
• Fix bugs and improve reliability, using opt-in crash reports and logs.
• Train and improve Auto, ZOREVA-UI’s own model that picks how to answer each request, using only the requests you chose to share.
• Send service emails such as sign-in codes, security and billing notices.
• Comply with law.

Training uses only the requests you agreed to share. Unless you turn on sharing, we don’t use your prompts, code or files to train any model. If you turn it on, shared requests are used only to train and improve Auto, ZOREVA-UI’s own model that picks how to answer each request. They’re never sold or published, and never given to anyone to train their models. Turn it off any time with /privacy off; your stored requests are deleted right away. We don’t sell personal data.

04Who we share data with

We share data only with providers that help run the Service, under contract and only for that purpose. The current list is on Subprocessors: Amazon Web Services (Bedrock), Neon, Stripe, Resend, Cloudflare, Hostinger, Google and GitHub (sign-in). We may also disclose data when required by law, to protect rights and safety, or as part of a merger or acquisition under equivalent protections.

05International transfers

Our providers may process data in the United States and other countries. Where required, we rely on safeguards such as standard contractual clauses in our providers’ terms.

06Retention

We keep account data while your account is open. Billing records are kept as long as tax law requires. Logs and request metadata are kept only as long as necessary to operate the Service and for legitimate needs such as security, billing, dispute resolution and legal compliance, then deleted, de-identified or anonymized. We don’t keep the content of CLI prompts longer than needed to process the request, except where needed to investigate abuse. If you delete your account, your account and its associated data are removed within 30 days, except records we must keep by law (such as tax and billing records). Requests you chose to share are the exception: their redacted text is kept for up to 90 days.

07Shared requests and training

• The CLI asks you once when you first use it. Nothing is shared until you answer, and you can change your answer any time with /privacy on / /privacy off.
• The suggested answer depends on where you are: in the European Union, the European Economic Area, the United Kingdom and Switzerland it is No, and it is also No when we can't tell your region; elsewhere it is Yes. We use your approximate country from your connection, or your computer's time zone or language setting, only to pick this suggestion, and we don't store it.
• What’s kept: a redacted copy of the request (at most 500 characters) and Auto usage data. Keys, tokens, passwords, emails, phone numbers, file paths and web-address parameters are removed before storage.
• Purpose: only to train and improve Auto, ZOREVA-UI’s own model that picks how to answer each request.
• Retention: the text is deleted after 90 days.
• Turn it off with /privacy off; we delete your stored requests right away. Check it with /privacy status.

08Your rights

Depending on where you live (including Mexico’s LFPDPPP, the EU/UK GDPR and US state laws), you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. Email legal@zoreva-ui.com from your account address; we’ll respond within the time the law requires. You can also complain to your local data protection authority.

09Security

We protect data with encryption in transit, access controls and least-privilege access. See Security. No system is perfectly secure.

10Children

The Service isn’t directed to anyone under 18, and we don’t knowingly collect their data. If you believe a minor gave us data, contact us and we’ll delete it.

11Changes

We’ll post updates here and change the “Last updated” date. For material changes we’ll notify you by email or in the product.