Privacy Policy

JEVAS (jevas.app) is jewelry store management software owned and operated by ZIMA LLC (“ZIMA”, “we”, “us”, “our”). This Privacy Policy describes what information we collect when you visit jevas.app or use the JEVAS application, how we use and protect it, with whom we share it, how long we keep it, and the rights and choices you have.

This policy covers:

• the public website (home page, pricing, legal pages and the JEVAS Store);
• the JEVAS web application used by jewelry stores and their staff after signing in;
• payment links and invoices that a store generates with JEVAS and sends to its customers (for example pages under jevas.app/pagar);
• text messages that a store sends to its customers through JEVAS;
• support, feature-request and billing communications with us.

JEVAS is a record-keeping and operations tool. ZIMA is not a bank, lender, payment processor, money transmitter or pawnbroker. We do not hold customer funds and we never see or store full payment card numbers.

1. Roles: who is responsible for what data

Companies and stores. A jewelry business that registers on JEVAS (a “Company”) can have one or several stores. The Company decides what data it enters about its inventory, customers, suppliers, staff and operations. For that data, the Company is the data controller (or “business” under US state privacy laws) and ZIMA is its processor/service provider: we process it only to provide JEVAS, following the Company’s instructions and this policy.

Staff users. People who sign in to JEVAS (owners, administrators, sales staff, workshop staff) have an account with us. For account, security and billing data, ZIMA is the controller.

Store customers. If you are a customer of a jewelry store that uses JEVAS, the store collected your information and decides how it is used. Please direct requests about your data to the store. We will assist the store in responding.

2. Information we collect

2.1 Information you or your Company provide

• Account data: full name, email address and a salted, hashed password. Sign-in runs on Supabase Auth; your password is never visible to us in plain text. The invitation code used to join a Company and the date you joined.
• Company and store data: Company name, invitation code, owner; store names, addresses, phone numbers and logos/photos; tax rate and tax-exempt settings; SKU prefix and numbering; label sizes and printer calibration; payment methods you define; time zone and language.
• Roles and permissions: the roles you create, the modules each role can open (company, dashboard, sales, layaways, customers, inventory, purchases, counts, labels, repairs/workshop, pawns, suppliers, expenses, reports) and which role each user has, plus whether a user is active or deactivated.
• Inventory data: items with name, SKU, barcode, category, metal and karat, weight, stones, size, cost, price, pricing mode (fixed or gold-based), quantity, photos, supplier, memo/consignment terms and due dates, location (store, showcase, workshop, layaway, sold, discarded), inventory counts and their results, transfers between stores, and imported CSV files.
• Customer data entered by the store: customer name, phone, email, address, notes and purchase history. Stores may also record identification details required by law for pawns or buybacks. JEVAS does not require stores to collect government ID numbers; if a store chooses to do so, it is responsible for that collection.
• Transaction records: sales and invoices (items, prices, discounts, taxes, shipping, due dates, payment method, partial payments, returns and refunds, attached receipts or files), layaways (items, deposit, payment plan, payments, reminders sent), repairs and other workshop orders (ticket number, piece description, photos, work requested, price, status, delivery), pawns (piece, loan amount, interest, due dates, payments and redemption), purchases and expenses (supplier, items, amounts, receipts), supplier charges and payments, and payment links created through connectors.
• Company documents and tasks: files you upload to the Documents section (for example EIN letters, business licenses, contracts, insurance policies) with optional alert dates, and tasks you create for your team.
• Billing data: the Stripe customer and subscription identifiers for your Company, plan status (trial, active, past due, canceled, unpaid), trial end, billing period and grace period dates, and billing emails. Your payment method (card or bank details) is collected and stored by Stripe, not by us.
• Connector credentials: if you connect Clover, Square or Stripe, we store the OAuth access and refresh tokens, merchant/location identifiers and connection status so we can create payment links on your behalf. Tokens are encrypted before they are written to the database.
• Communications: messages you send through the Support and Request a Feature pages, emails to soporte@jevas.app, questions typed into the in-app assistant, and your replies to our messages.
• JEVAS Store orders: when you buy hardware or supplies in the JEVAS Store, Shopify collects your name, shipping address, email, phone and payment details at checkout. We receive the order details needed to fulfil and support it.

2.2 Information collected automatically

• Activity and audit logs: who created, edited or deleted records and when (for example weight changes shown in the Change Reports section), sign-in events, and server logs with IP address, browser type, operating system, referring page, pages requested and timestamps.
• Device and browser information: screen size, language, time zone, and whether the browser supports features such as camera scanning or local printing.
• Camera and barcode scanning: if you use the in-app camera to scan a barcode or QR code, video is processed on your device only to decode the code. We do not record, upload or store camera frames.
• Cookies and local storage: see section 7.
• Spot gold prices: the app fetches public gold prices from a third-party API. The request contains no personal information.

2.3 Information from third parties

• From Stripe: subscription and invoice status events (webhooks) so we can keep your plan up to date.
• From Clover, Square or Stripe (when connected): payment status of the payment links you created, so a sale or layaway can be marked as paid.
• From Twilio (when SMS reminders are enabled): delivery status of each message and opt-out replies.

3. How we use information

• Provide the service: run every module of JEVAS, show the right data to the right store and user, print labels and invoices, generate reports and change logs, synchronize inventory across stores.
• Authenticate and secure: sign users in, enforce roles and permissions, detect unusual activity, prevent fraud and abuse, and keep an audit trail.
• Bill and manage subscriptions: start trials, create Stripe checkout and customer-portal sessions, apply the 14-day grace period, block or unblock Companies based on payment status, and send billing notices.
• Payments on your behalf: create payment links with your connected Clover, Square or Stripe account and record when they are paid.
• Customer messaging on your behalf: send layaway reminders by SMS when a store enables them, and track delivery and opt-outs.
• In-app assistant: answer your questions and guide you through the app using your Company’s own data (for example today’s sales, stock levels, open repairs).
• Support and product: respond to support and feature requests, diagnose errors, and improve features using aggregated, de-identified usage information.
• Legal: comply with applicable law, enforce our Terms, and protect the rights, property and safety of ZIMA, our customers and others.

We do not sell or rent personal information, we do not share it for cross-context behavioral advertising, and we do not use Company data to train artificial-intelligence models.

4. Legal bases (where required)

Where laws such as the GDPR or UK GDPR apply, we process personal data: to perform our contract with you (providing JEVAS and billing); for our legitimate interests (security, fraud prevention, product improvement, support), which we balance against your rights; to comply with legal obligations; and, for optional features such as SMS reminders, based on the consent the store obtained from its customers.

5. Who we share information with

We share information only as described here. Our subprocessors, and what each one receives, are:

• Supabase (database, authentication, file storage, server functions) — all application data and uploaded files, encrypted at rest.
• Vercel (application hosting and edge network) — requests to jevas.app, server logs.
• Stripe (subscription billing; customer payment links if you connect Stripe) — Company name, billing email, subscription and payment events.
• Clover and Square (customer payment links, only if you connect them) — amount, description and reference of each payment link.
• Twilio (SMS delivery, only if you enable reminders) — customer phone number and message text.
• OpenAI (in-app assistant) — your question and the minimum Company data needed to answer it. Under our API agreement this data is not used to train OpenAI models.
• Shopify (JEVAS Store checkout) — your order and shipping details.
• Gold-API (spot metal prices) — no personal data.

We may also share information:

• with other users of your own Company, according to the roles and permissions your administrators set;
• with your customers, when you send them an invoice, payment link or reminder;
• with professional advisers (lawyers, accountants, auditors) under confidentiality;
• when required by law, subpoena or court order, or to respond to a lawful request from public authorities;
• to investigate or prevent fraud, security incidents or violations of our Terms;
• in connection with a merger, financing, acquisition or sale of all or part of our business, in which case this policy continues to apply until replaced with notice.

6. Text messages (SMS) program

• Program: JEVAS Layaway Reminders, sent on behalf of the jewelry store named in the message.
• Content: store name, layaway balance, due date and, optionally, a payment link. No marketing.
• Frequency: varies with the customer’s layaway schedule; typically one message a few days before and on the due date.
• Consent: the store must obtain the customer’s consent before enabling reminders for that customer.
• Opt out: reply STOP at any time to stop messages; reply HELP for help or email soporte@jevas.app. Opt-outs are honored automatically and recorded.
• Costs: message and data rates may apply according to the customer’s carrier plan.
• No sharing: phone numbers and SMS consent are not shared with third parties or affiliates for marketing purposes.

7. Cookies and similar technologies

JEVAS uses only cookies and browser storage that are necessary for the service to work:

• Session cookies set by Supabase Auth that keep you signed in and refresh your session.
• Active-store cookie that remembers which store of your Company you are working in.
• Local storage for your language on the public site, label-printer calibration, unsaved sale drafts, scanner preferences and whether you dismissed in-app guides.
• Vercel may set technical cookies for deployment protection or load balancing.

We do not use advertising cookies, third-party trackers or social-media pixels. Because we only use strictly necessary cookies, there is no cookie banner; you can still clear or block cookies in your browser, but you will not be able to stay signed in.

8. Data retention

• Company data is kept for as long as the Company has an account. Business records such as sales, layaways, repairs and pawns are not purged automatically because they are the Company’s books.
• Lapsed subscriptions: when a trial or subscription ends, the Company is blocked after the 14-day grace period but its data is kept so it can resume. If a blocked Company stays inactive for 12 months, we may delete it after notifying the administrators by email at least 30 days in advance.
• Deletion on request: a Company administrator can request deletion of the Company and all its data by emailing soporte@jevas.app. We complete deletion within 30 days, except for data we must keep for legal, tax or billing reasons (for example Stripe invoices), which we retain only as long as required.
• Deactivated users remain in the Company’s records so the audit trail of their actions stays intact. A user can ask for their personal identifiers to be anonymized once they no longer work for the Company.
• Logs and backups: server logs are kept for up to 90 days. Database backups rotate automatically and deleted data disappears from them within the backup window.
• Support messages are kept for up to 3 years to maintain a history of your requests.

9. Security

• All traffic is encrypted with TLS; data and files are encrypted at rest.
• Row-level security in the database ensures that every query is restricted to the user’s own Company and the stores they are allowed to see.
• Roles and permissions limit which modules each user can open; administrators can deactivate a user instantly and regenerate the Company’s invitation code at any time.
• Connector tokens are encrypted with a key kept outside the database.
• Secrets and API keys are stored in managed environment variables and are never shipped to the browser.
• We keep an audit trail of changes to key records so a Company can review what happened.
• We never ask for your bank, Clover, Square, Stripe or WhatsApp password by message, email or phone.

No system is completely secure. If we learn of a breach that affects your personal data, we will notify affected Company administrators without undue delay and in accordance with applicable law. To report a vulnerability, see security.txt or email soporte@jevas.app.

10. Your rights and choices

Depending on where you live, you may have the right to:

• know what personal information we hold about you and receive a copy;
• correct inaccurate information;
• delete your information, subject to legal retention obligations;
• receive your data in a portable format;
• object to or restrict certain processing, and withdraw consent where processing is based on consent;
• not be discriminated against for exercising these rights;
• lodge a complaint with your data-protection authority.

Inside JEVAS: users can edit their own name; administrators can edit users, roles, customers, inventory and every other record, and can export inventory and reports as CSV or printable documents. By email: for anything you cannot do in the app, write to soporte@jevas.app from the email address on your account. We may ask you to verify your identity, and we respond within the time required by law (normally 30 days, or 45 days under California law).

Store customers: send your request to the store that holds your information. If you contact us instead, we will forward it to the store and help it respond.

California residents: the categories of personal information we collect are identifiers, commercial information, internet activity and, when entered by a store, professional information and physical characteristics of items (not of people). We do not “sell” or “share” personal information as defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes other than providing the service.

Do Not Track: we do not track users across third-party sites, so we treat all visitors as if Do Not Track were enabled.

11. Children

JEVAS is a business tool intended for adults operating a jewelry store. It is not directed to children under 16 and we do not knowingly collect their information. If you believe a child has provided us with personal information, contact us and we will delete it.

12. International data transfers

ZIMA is based in the United States. The application is hosted in North America and our subprocessors may process data in the United States and other countries where they operate. Where required, we rely on appropriate safeguards such as standard contractual clauses with those providers. By using JEVAS you understand that your information may be transferred to and processed in countries whose laws differ from those of your country.

13. Data processing terms for Companies

When ZIMA processes personal data on behalf of a Company, we: process it only on the Company’s documented instructions (which include using JEVAS as designed); keep it confidential; apply the security measures described above; use only the subprocessors listed in section 5 and notify administrators before adding new ones; assist the Company with data-subject requests and breach notifications; and delete or return the data at the end of the service as described in section 8. Companies that need a signed Data Processing Agreement can request one at soporte@jevas.app.

14. Third-party links and services

Payment links open on Clover, Square or Stripe; the JEVAS Store checkout opens on Shopify; label printers and scanners you buy may have their own apps. Those services have their own privacy policies, which we encourage you to read. We are not responsible for their practices.

15. Changes to this policy

We may update this policy as JEVAS evolves. The “Last updated” date at the top shows the latest revision. For material changes we will notify Company administrators inside the app or by email before the change takes effect. Continued use of JEVAS after that date means you accept the updated policy.

16. Contact

ZIMA LLC · JEVAS
Email: soporte@jevas.app
Security reports: jevas.app/.well-known/security.txt
See also our Terms & Conditions.