Privacy Policy

This policy covers Zenith (zenithresell.com), its email order-parsing engine OrderLens, and the Zenith ACO Manager Discord application (the "Bot"). It describes what we actually collect, why, and what happens to it. Questions and requests: ZenithSupport@elbowsaio.com.

1. Account data

You sign in with Discord. We store your Discord ID, display name, and the email address on your Discord account (or a placeholder if none is shared), plus sign-in timestamps. The Discord OAuth grant uses the identify, email, and guilds.join scopes; the resulting OAuth tokens are stored so Zenith can offer to add you to its support server. We never see your Discord password.

2. Data you add to your workspace

Zenith stores what you put in it: inventory and purchase records, sales and fees, subscriptions and expenses, checkout profiles (including a card's last four digits only, if you enter them), delivery addresses used for jig analysis, alarms, notes, and collection checklists. If you use the Accounts page to store retailer-site logins (email, password, IMAP email, IMAP password, bot, notes), the passwords are encrypted at rest with AES-256-GCM under a server-only key and decrypted solely to display them back to your own workspace — they are used for storage and display only; Zenith never signs in to any retailer with them. This is your business data; it is scoped to your workspace and shown only to you, teammates you invite, and — for public storefront pages you explicitly enable — visitors to that page.

3. Order emails (OrderLens)

Gmail connection (primary method)

• You may connect one or more Gmail accounts (up to 5) with read-only access — Google's gmail.readonly scope. Zenith cannot send, delete, or modify anything in a connected mailbox, and never sees your password. Revoke anytime: the Disconnect button in Settings (which also revokes the grant at Google), or your Google Account → Security → Third-party access.
• Fetching is allowlist-scoped by construction: Zenith only ever queries for mail from supported retailer and carrier senders with order-shaped subjects — across inbox and spam, so a misfiled order is still found. Mail from any other sender is never listed, fetched, or seen.
• The OAuth refresh token is encrypted at rest (AES-256-GCM) under a key held only in the server environment. Disconnecting deletes the stored token and revokes the grant at Google; a revoked grant is detected and the connection is marked disconnected.
• You choose the historical window when connecting (1–24 months, or none). After the initial backfill, Zenith checks the connected mailbox periodically for new allowlisted retailer mail only.
• Limited Use disclosure: Zenith's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail-derived data is used solely to provide Zenith's user-facing order-tracking features: it is never used for advertising, never sold, and never used to train machine-learning or AI models. Parsing is performed by Zenith's own template engine — no email content is sent to any LLM or third-party AI service.

Forwarding (fallback method)

• Emails reach Zenith only when you forward them (auto-forward rule or backfill script) to your private ingest address, or by another route you configure. In this mode Zenith does not connect to your inbox.
• Inbound filtering attempts to drop login/verification codes, password-reset messages, and marketing before processing. Filtering is best-effort, not guaranteed.
• From each accepted email (either method) we store the sender, subject, received time, and message body, plus the structured order data parsed from it: items, quantities, prices, order numbers, shipping address, tracking numbers, and card last-four when the retailer prints it. Message bodies are retained so orders can be re-parsed when the parser improves; you can request deletion at any time.
• Support access is audit-logged: Zenith staff can view a stored email's content only through an internal inspector that records who accessed what, when, and for which support reason, before any content is shown. Routine parsing is fully automated; no human reads your email otherwise.

4. The Discord bot (Zenith ACO Manager)

Server administrators explicitly designate channels that receive automated checkout webhooks. The Bot processes only webhook- or bot-authored messages in designated channels — this is enforced in code; human-authored messages are skipped.

What the Bot extracts

• Commerce fields: automation-tool name, retailer, product name/URL, SKU, quantity, price, event type (success/decline), and timestamps.
• Discord metadata: message, channel, and server IDs — used for de-duplication and workspace attribution.
• Private reconciliation fields, visible only to the owning workspace: the retailer order number, the proxy endpoint with credentials removed (host:port and your own group label), and the billing-profile label from the webhook. The profile label is stored because it is how ACO checkouts are attributed to the customer who submitted that profile; it is your own naming, visible only to your workspace.

What the Bot refuses by design

The parser is an allowlist: unrecognized fields are dropped. Email addresses, physical addresses, payment details, and proxy usernames/passwords are detected only to be excluded — their values are never read into the stored event. One exception: when an embed cannot be parsed at all, its raw content is kept for parser debugging, never shown in any interface, and purged automatically after 7 days (the running service triggers this purge daily).

Why the Bot reads messages at all

The Bot uses Discord's Message Content capability for exactly one purpose: reading the embeds of webhook-authored messages in channels a server administrator explicitly designated with /watch add. Checkout webhooks are posted by other automation tools; there is no slash-command or button alternative that could deliver their content. The Bot registers slash commands (/watch, /backfill, /status) for everything a command can do.

Checkout DMs — strictly opt-in

• The Bot only ever sends a direct message to a user who ticked the "DM me checkout updates"checkbox on their provider's submission page. This is enforced in the delivery pipeline itself: no message is even queued for a user who hasn't opted in, and the queue re-checks consent at send time.
• DMs are transactional only — the status of that user's own submitted checkouts (secured, declined, or cancelled). Never marketing, never other users' data. Decline notices are rate-limited by design to at most one per profile, per release, per day, no matter how many decline events the webhooks carry.
• Opting out on the same page stops delivery immediately, including anything already queued. If Discord reports your DMs are closed, the opt-in is automatically disabled rather than retried.

We do not sell Bot data, do not share it beyond our infrastructure providers, and do not use Discord message content to train machine-learning models. Removing a channel (/watch remove) or removing the Bot stops collection from it immediately.

Your own Discord webhooks

You may give Zenith Discord webhook URLs in Settings. Zenith then posts your own events (imports, sales, duplicates, cancellations, backfill completion, alarms) to those URLs. An optional second URL receives the same events with order and raffle numbers stripped, and an optional checkbox adds a feed of your ACO checkouts built only from item, site, quantity, bot, and proxy — no customer name, profile, or order number is ever included on that feed. Where these messages go, and who can read that channel, is your configuration and your choice.

5. ACO profile submissions (for providers' customers)

If you submit checkout profiles through a provider's zenithresell.com/aco/… link, this section is about you. Signing in with Discord shares only your Discord ID and display name (identify scope), so the provider knows whose profiles are whose. The profile you submit — name, email, phone, addresses, sizing, and card details — is stored for that provider's workspace and shown to that provider.

• Card storage: card number, expiry, and CVV are encrypted with AES-256-GCM under a key that lives only in the server environment, never in the database. Zenith's interfaces never display them — not even to the provider. They are decrypted in exactly one place: the CSV export the provider downloads to run your checkout.
• You can edit or delete your submissions on the same page at any time. Deleted profiles are immediately excluded from the provider's view, exports, and matching.
• The provider is responsible for how they handle exported data and for their arrangement with you. Zenith processes this data to operate the submission, matching, and export features on the provider's instruction.

6. Payments

Subscriptions are billed by Stripe. Your payment card is entered on Stripe's pages and handled by Stripe; Zenith stores only the Stripe customer/subscription identifiers and status needed to know your account is active.

7. Cookies

Zenith sets only functional cookies: the signed session (zenith_session, 30 days), the ACO submitter session (zenith_aco, 30 days, scoped to /aco), short-lived OAuth state cookies during sign-in, an optional promo-code cookie, and a time-limited admin support-view cookie (below). There are no third-party analytics, advertising, or tracking scripts on Zenith.

8. Who can see your data

• You, and teammates you grant access to (revocable in Settings; ACO dashboard access is a separate grant).
• Infrastructure processors that run the service: our hosting and database providers, Stripe for billing, and the Discord API for sign-in and Bot features. Product-catalog and pricing lookups send item identifiers, never your personal data.
• Zenith operations, for support and debugging. This includes a platform-admin "view as workspace" mode that is restricted to admin accounts and expires automatically after 4 hours.
• Nobody else. We do not sell personal data and have no advertising partners.

9. Retention and deletion

• Workspace data (inventory, sales, finances, profiles, site-account records): retained while your account is active, deleted on account deletion.
• Gmail OAuth tokens: deleted when you disconnect the account (the grant is revoked at Google at the same time).
• Stored email messages: retained while your account is active so orders can be re-parsed as the parser improves; deleted on request or account deletion. Support views of them are audit-logged, and those logs are retained.
• Checkout DM queue rows: kept with their delivery status (sent, failed, or suppressed) as the compliance record that a message was only ever sent under an active opt-in.
• Unparseable Bot messages: purged after 7 days, automatically.
• Deleting records in the product removes them from use immediately (some are retained briefly as soft-deleted rows before permanent cleanup).
• To delete your account and its data, or to request a copy or correction of your data, email ZenithSupport@elbowsaio.com. We complete deletion requests within 30 days.

10. Security

All traffic is TLS. Internal service APIs (including the Bot's) are authenticated with secrets using constant-time comparison. Data is scoped per workspace. Three classes of data are app-layer encrypted with AES-256-GCM under server-only keys: ACO card details, Gmail OAuth tokens, and site-account passwords. No system is perfectly secure; if a breach affects your data we will notify you without undue delay.

11. Your rights

• You can request a copy of your data, correction of it, or deletion of your account and its data at any time: ZenithSupport@elbowsaio.com. Deletion requests are completed within 30 days. Exercising these rights never affects the service you receive while your account is active.
• Most data is also directly self-serve: records can be edited or deleted in the product, Gmail connections disconnect in Settings, ACO submitters edit or delete their own profiles from their submission link, and DM opt-in is a checkbox either way.
• Zenith is operated from, and data is processed in, the United States.

12. Age and changes

Zenith is not directed at children. You must be at least 13 years old — or the higher minimum age Discord requires in your country — to sign in, matching Discord's own terms. Material changes to this policy will be posted here with a new effective date.