Privacy Policy

This Policy applies to information Kova handles as controller or business. It does not govern a retailer, Discord, Stripe, your email provider, or another third party. Their own terms and privacy notices govern their processing. If you provide information about another person, you represent that you are authorized to do so and to permit the uses described in this Policy.

Depending on how you use the Services, we may collect the following:

• Account and identity information: Discord user ID, username, display name, avatar, email address, OAuth account data, account status, and authentication or session records.
• Checkout profile information: names, email addresses, phone numbers, shipping and billing addresses, retailer selections, retailer account usernames and passwords, and profile labels or preferences.
• Payment and sensitive credentials: payment-card number, expiration date, card security code, card brand and last four digits, and other credentials you choose to provide for a requested checkout. Card and account credentials stored by Kova are encrypted at rest; authorized Kova personnel and systems may decrypt and export them when necessary to perform the Services you request.
• Mailbox connection information: mailbox email address, nickname, host, port, SSL setting, username, app password or access token, connection status, and last test time. Stored mailbox secrets are encrypted at rest.
• Mailbox order information: when you run order sync, Kova searches for messages from supported retailers and extracts order numbers, retailer names, product descriptions, amounts, order and message dates, and fulfillment or cancellation status. Kova does not retain raw email bodies for this feature.
• Billing and transaction information: billing contact details, invoices, amounts, due and payment dates, payment status, Stripe customer and invoice identifiers, receipts, purchased services, and transaction history. Stripe, rather than Kova, processes payments on Kova invoices.
• Activity and support information: profile and settings changes, imports and exports, administrative actions, support requests, messages, feedback, and any attachments or information you send us.
• Device and usage information: IP address, browser and device type, operating system, referring pages, timestamps, pages or features used, cookie and session identifiers, diagnostic data, and security or fraud signals. Some of this information may be generated automatically by our hosting and security providers.

We collect information directly from you; automatically from your browser or device; from Discord when you authorize sign-in; from Stripe regarding invoices and payments; from supported retailers, mailbox providers, and other services you direct us to interact with; from Kova operators performing requested services; and from service providers that help us operate, secure, and support the Services.

We may use personal information to:

• provide, operate, authenticate, maintain, and improve the Services;
• create and manage checkout profiles and carry out checkout or account instructions you request;
• connect to and test configured retailer or mailbox accounts, identify supported retailer order messages, and build the order history you request;
• create, send, collect, reconcile, and preserve invoices and payment records;
• communicate about your account, transactions, support, and service status;
• personalize settings, troubleshoot errors, perform analytics, and develop features;
• protect users, Kova, retailers, and others; prevent fraud, abuse, unauthorized access, chargebacks, and security incidents; and enforce our agreements;
• comply with law, lawful process, audits, tax and accounting duties, and requests from authorities; and
• establish, exercise, or defend legal claims and complete corporate transactions.

We may disclose personal information to the following recipients and for these purposes:

• Kova personnel and contractors: authorized operators, support staff, and contractors who need access to deliver, secure, bill for, or support the Services.
• Retailers and user-directed recipients: supported retailers, checkout systems, mailbox providers, and other parties you direct us to contact or that are necessary to carry out your instructions.
• Vendors and service providers: hosting, database, authentication, security, analytics, communications, customer support, and professional-service providers. These parties may process information for us under contractual or other restrictions.
• Discord and Stripe: Discord supports sign-in and community features; Stripe supports customer records, hosted invoices, payments, receipts, fraud prevention, and financial compliance.
• Legal and safety recipients: courts, regulators, law enforcement, counterparties, advisers, or others when we believe disclosure is required or appropriate to comply with law, protect rights and safety, investigate misconduct, or enforce agreements.
• Corporate transaction recipients: an actual or prospective buyer, investor, lender, insurer, adviser, or successor in a merger, financing, reorganization, sale of assets, bankruptcy, or similar transaction.

We may also disclose information with your consent or at your direction, and may use or disclose aggregated or deidentified information where permitted by law. We do not sell personal information for money or share it for cross-context behavioral advertising, and we do not knowingly use sensitive personal information to infer characteristics unrelated to providing the Services.

We and our providers use cookies, tokens, and similar technologies that are necessary to authenticate users, maintain sessions, remember settings, prevent abuse, and operate the Services. Blocking required cookies may prevent the portal from working. Because we do not sell personal information or use it for cross-context behavioral advertising, there is no separate advertising-cookie opt-out on the Services.

We retain personal information for as long as reasonably necessary for the purposes in this Policy, including while your account is active, and then as needed for security, fraud prevention, dispute resolution, enforcement, tax, accounting, backup, and legal obligations. Retention depends on the data's nature, sensitivity, purpose, risk, and applicable requirements. Raw email bodies read during order sync are not retained; parsed order records remain with your active account. Deleting your account deletes the account and associated profiles, stored credentials, settings, sessions, and activity records from the active Kova database, but may not immediately remove limited backup, security, or diagnostic records. Invoice snapshots and records held by Kova, Stripe, retailers, or other third parties may remain where needed for legal, accounting, payment, fraud-prevention, or dispute purposes. We may retain deidentified information where permitted by law.

We use administrative, technical, and organizational safeguards designed for the nature of the information we process. These include access controls, authentication, activity logging, data minimization in user-facing views, and AES-256-GCM encryption at rest for stored card numbers, card security codes, retailer passwords, and mailbox secrets. No transmission, storage system, or security control is infallible. You use the Services and transmit information at your own risk, must secure your Discord, retailer, payment, and mailbox accounts, and should notify us immediately of suspected unauthorized access.

You may update profile and account information in the portal, export available non-sensitive account data, or request account deletion from Settings. Because exports intentionally omit passwords, mailbox secrets, full payment-card numbers, and security codes, an export is not necessarily a complete access response under applicable law.

Depending on where you live and subject to legal exceptions, you may have rights to request access, confirmation, correction, deletion, or portability; obtain information about sources, purposes, and recipients; opt out of certain sales, targeted advertising, or profiling; limit certain uses of sensitive information; withdraw consent; appeal a denied request; and receive equal service without unlawful discrimination.

To exercise a right not available in Settings, email support@kovaaco.com with the subject "Privacy Request." Describe the request and include the email and Discord username associated with your account. We may verify your identity, request additional information, deny or limit a request where permitted, and retain a record of the request. Authorized agents may submit requests where applicable, but we may require proof of authority and direct identity verification. To appeal, reply to our decision with "Privacy Appeal" in the subject line.

In the preceding 12 months, Kova has collected the categories described in Section 2 and disclosed them for business purposes to the recipient categories in Section 5. This may include identifiers, customer records, commercial information, internet or network activity, approximate location derived from IP address, account preferences or inferences, and sensitive information such as account credentials, payment-card data, and mailbox credentials. We collect and use these categories for the purposes in Section 4 and retain them as described in Section 7.

Kova has not sold personal information for money or shared it for cross-context behavioral advertising in the preceding 12 months. Kova does not knowingly sell or share the personal information of consumers under 18. Where a legally recognized opt-out preference signal applies, our no-sale/no-sharing practice applies regardless of the signal. We do not offer financial incentives for personal information.

The Services are intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact us so we can investigate and take appropriate action.

Kova operates from the United States. If you access the Services from elsewhere, your information may be transferred to, stored in, and processed in the United States and other countries where Kova or its providers operate, which may have different data protection laws than your jurisdiction.

We may update this Policy to reflect changes in the Services, our practices, or law. We will post the revised Policy and update the date above. If required by law, we will provide additional notice or seek consent before a material change takes effect. Your continued use after the effective date acknowledges the updated Policy.

Direct privacy questions or requests to JKHEM Holdings LLC d/b/a Kova ACO at support@kovaaco.com. You may also use our Support page.