Privacy Policy

Last updated: April 22, 2026

ZelaVerse is a small, sole-operator software studio based in Alberta, Canada, operated by Zela ("ZelaVerse", "we", "us", or "our"). This Privacy Policy explains what information we collect, why we collect it, how we use it, how long we keep it, and what rights you have. We try to collect as little as humanly possible — and most of the time, nothing at all.

1. Short version (the plain-English summary)

• Our web apps are local-first. SnuggleBase, Fieldday, and PayOffPal store your data in your own browser. We can't see it. We don't back it up. You own it and are responsible for it.
• Our Discord bots only see what Discord gives them — the minimum required to run the commands and features you use. We don't record voice, we don't read DMs you didn't send to the bot, and we don't sell anything to anyone.
• We don't sell your data. Ever. Not anonymized, not aggregated, not "analytically enriched". Not.
• No advertising trackers. No Google Analytics, no Meta pixel, no Hotjar, no session recording. Our site uses no cookies beyond what's strictly necessary to remember your preferences on this device.
• You can reach a human. That human is Zela, at ask@zelaverse.com.

2. Who the Data Controller is

For the purposes of Canadian privacy law (Personal Information Protection and Electronic Documents Act, "PIPEDA", and the Alberta Personal Information Protection Act, "PIPA"), the European Union's General Data Protection Regulation ("GDPR"), and the United Kingdom's UK GDPR, ZelaVerse is the data controller for the personal information described in this Policy. Our privacy contact is:

Email: ask@zelaverse.com
Subject line: "Privacy request"

3. What we collect and why

3.1 Our website (zelaverse.com)

We use minimal server logs from our hosting provider (e.g. IP address, user-agent, requested URL, timestamps) solely to detect abuse, debug errors, and keep the site online. These logs are retained for up to 30 days. We do not use third-party analytics or advertising cookies on the marketing site.

3.2 Contact form

When you submit the contact form, we collect your name, email, topic, and message so we can reply. The form is processed by Web3Forms (a third-party form-delivery service) which relays your submission to ask@zelaverse.com. Web3Forms is the processor; see their privacy policy at web3forms.com/privacy-policy. Messages are retained in our email inbox for as long as is reasonably needed to respond and follow up (typically up to 24 months).

3.3 Discord bots (Ivar, PayLux, Sedah, Master Creep)

When you invite a ZelaVerse bot to a Discord server, the bot processes only the data Discord provides to it through the official API. Depending on the bot and its enabled features, this may include:

• Discord user IDs, server IDs, channel IDs, role IDs;
• Usernames, server nicknames, avatars;
• The contents of messages in channels the bot can see, or messages directly sent to the bot (e.g. Master Creep submissions), where required to deliver a feature (for example: auto-moderation, command parsing, submission workflow);
• Per-server configuration you set (moderation rules, welcome messages, role rewards, economy balances, etc.);
• PayLux only: transaction records (sender, recipient, amount, timestamp, associated PayPal identifiers returned by the payment processor), retained for accounting, tax, and fraud-prevention purposes.

Bots do not read voice audio, do not access DMs you did not send to the bot, do not systematically archive conversations outside of what's needed to run a requested feature, and do not use your message content to train machine-learning models.

Legal bases (GDPR, where applicable): (a) performance of a contract or taking steps at your request for operating the bot you invited; (b) legitimate interest in securing, moderating, and debugging our services; (c) your consent where we ask for it (e.g. opt-in adult modules); and (d) legal obligation where applicable.

3.4 Web applications (SnuggleBase, Fieldday, PayOffPal)

These applications are local-first. Your data (tasks, notes, budgets, debts, events, PINs, attendee records, etc.) is stored in your browser's local storage or IndexedDB on your device. We do not operate a database of this data and we cannot access it.

Some features may require limited outbound requests:

• AI features (e.g. Fieldday's AI event builder, PayOffPal's AI advisor): when you invoke an AI feature, the specific prompt you submit may be transmitted to a third-party AI provider to generate a response. We do not send your entire dataset, and we disclose each such request in-app.
• Payment processing (Fieldday subscriptions, PayLux top-ups/withdrawals): handled by third-party payment processors (e.g. PayPal, Stripe). We receive only the confirmation and identifiers needed to fulfil your purchase.
• Email sending (Fieldday email sequences): if you configure and send emails from Fieldday, the email addresses and content you authored pass through a third-party email provider for delivery.
• PWA installation & updates: standard browser/hosting traffic to serve files.

4. Cookies and similar technologies

We use:

• Strictly necessary browser storage (localStorage, IndexedDB, service-worker caches) in our web apps, to make them work.
• No advertising cookies. No cross-site tracking. No third-party pixels.

5. How we share information

We do not sell personal information. We share it only with:

• Processors acting on our instructions (hosting provider, email relay provider, payment processors, AI model provider where applicable). Each processes only what is needed for its purpose.
• Authorities when compelled by a valid legal process or where disclosure is necessary to protect rights, safety, or property.
• A successor in the event of a merger, acquisition, or sale of assets, subject to notice where required by law.

6. International transfers

ZelaVerse operates from Alberta, Canada. Our processors may be located in Canada, the United States, or the European Union. Where personal data of EU/UK residents is transferred outside the EU/UK, we rely on appropriate safeguards such as Standard Contractual Clauses and recognized adequacy decisions (including Canada's PIPEDA adequacy).

7. Data retention

• Website server logs: up to 30 days.
• Contact-form messages: up to 24 months, then deleted.
• Discord bot data: retained while the bot remains in your server, or as long as you retain the account that owns it. Removing the bot from a server typically purges its per-server configuration within 30 days, except where retention is required for fraud, accounting, or legal purposes (PayLux transaction records: at least 7 years, per Canadian tax requirements).
• Web-app data: stored locally on your device. We do not retain it. Clearing your browser data or uninstalling the app deletes it; we cannot recover it.

8. Security

We use reasonable administrative, technical, and physical safeguards — including encryption in transit (HTTPS), encryption at rest where applicable, access controls, audit logging on PayLux, and minimized data collection. No system is perfectly secure; we encourage you to use strong, unique passwords for services that integrate with ours and to enable two-factor authentication on your Discord account.

9. Children

The Services are not directed to children under 13 (or the applicable age in your jurisdiction). Adult-oriented features require users to be at least 18 and of the age of majority where they reside. If we become aware that we have collected personal information from a child in breach of this Policy, we will delete it and terminate the relevant access.

10. Your rights

Everyone

• Access — ask what we hold about you.
• Correction — ask us to fix inaccurate information.
• Deletion — ask us to delete information, subject to legal retention rules.
• Withdraw consent — where processing is based on consent.
• Complain — to a privacy regulator (see below).

Canada (PIPEDA / Alberta PIPA)

You may complain to the Office of the Privacy Commissioner of Canada and, for Alberta residents, to the Office of the Information and Privacy Commissioner of Alberta.

European Economic Area & United Kingdom

In addition to the rights above, you have the right to data portability, to object to processing based on legitimate interest, to restrict processing, and to lodge a complaint with your national data-protection authority (or the UK ICO).

California (CCPA / CPRA)

California residents have the rights to know, delete, correct, opt out of "sale" or "sharing" (we do not sell or share), and to non-discrimination for exercising these rights. To exercise them, email ask@zelaverse.com with "California privacy request" in the subject line.

To make any of these requests, email ask@zelaverse.com. We will respond within 30 days (or sooner where the law requires). We may ask you to verify your identity or, for Discord bot data, your control of the relevant server or account.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects based solely on automated processing. AI features in our apps provide suggestions, not binding decisions.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by posting the updated version here with a new "Last updated" date and, where reasonable, by in-Service notice.

13. Contact

Privacy questions, requests, or complaints? Email ask@zelaverse.com.
ZelaVerse · Alberta, Canada.