Privacy & Consent Policy

1. Creator (owner) data

• Account: email, display name and avatar (if any), plan and dates (signup, last login, expiry). The owner API key and the REST API key are stored hashed (the REST key also encrypted so it can be shown to you).
• Discord: user ID and the linked server ID when you use the bot (an API key is bound to one server).
• Content: projects, scripts (the original code is only kept in encrypted backups, up to 20 versions; the obfuscated output is stored to serve it), panel settings, Discord webhooks (encrypted URL), rewards and API IP whitelist.
• Security and audit: log of your account actions with date and IP; dashboard sessions.
• Purchases: made in the external SellAuth store; we only keep the plan, the issued key and, if our own order flow is used, an optional contact email to recover the purchase. We do not store card data.

2. End-user data (people running scripts)

• License key (encrypted; a hash is used for lookups) and its status, activation date, expiry, execution count and last execution.
• Device HWID (identifier provided by the executor), bound to the key on first run.
• Log of every execution: date, script, key, HWID, IP address, result (valid, expired, banned…), executor name and version, and country (2-letter code from Vercel's CDN geolocation; no extra data is stored for the country).
• Data added by the creator: Discord ID, note and ban reason.
• Rewards: reward-session IP, checkpoint progress, issued key and, with referrals, which session invited you and the result of anti-abuse checks (same IP / same HWID).
• Watermark: each delivered script carries an encrypted identifier of the key (or a HWID hash for free scripts) that lets the creator and Aureviai know which key leaked a copy. It contains no readable data.

3. Technical data of any visitor

• IP address in server logs, rate limits and, on malicious behaviour, temporary IP blocks (24 h, escalating up to 30 days).
• Essential cookies and local storage described in the Cookie Policy. We use no analytics or advertising cookies.

4. Aureviai staff

Username, password (bcrypt hash), 2FA secret (encrypted), sessions, login history with IP and browser, and an immutable audit log of their actions.

5. Purposes and legal bases

• Providing the Service (validating keys, binding HWIDs, delivering scripts, showing statistics to the creator): performance of the contract with the creator and the legitimate interest of the creator and Aureviai in protecting licensed scripts.
• Security, fraud and abuse prevention (limits, IP blocks, reward anti-abuse, watermark, audit): legitimate interest.
• Statistics for the creator (executions per day, executor, country, active keys, retention): legitimate interest; shown aggregated in the dashboard of the script's owner.
• Billing and plans: contract and legal obligations.
• Discord webhook notifications configured by the creator: the creator's decision, as controller of their users' data.
• Where the law requires it, consent: you can withdraw it at any time (see section 9).

6. Creators as controllers of their users' data

For their end users' data, each creator decides what their script is for and Aureviai acts on their behalf (processor). The creator sees in their dashboard the keys, HWIDs, executions (IP masked in the list), executor and country of their users and can send them to their own Discord webhook (HWID masked; IP masked unless the creator enables showing it). The creator must inform their users and handle their requests.

7. Who we share data with (processors)

• Vercel Inc. — hosting of the website, API and loader; CDN and country geolocation.
• Neon (Databricks) — PostgreSQL database.
• Upstash — Redis (single-use sessions, limits, queues, realtime metrics).
• Railway — hosting of the Discord bot and the obfuscation service (receives script code to obfuscate it; does not store it).
• Discord Inc. — bot and webhooks configured by creators.
• SellAuth — store and payment processing.
• AI providers for the internal admin assistant (Bynara, elisart and, as a fallback, Vercel AI Gateway): only when Aureviai staff use the assistant in /admin, they may receive the dashboard data the query needs (e.g. creator emails, key prefixes or statistics). Passwords, full keys and secrets are never sent. Creators and end users do not interact with these providers.
• Ad providers chosen by each creator for rewards (e.g. Linkvertise, Lootlabs, Work.ink): opening a checkpoint takes you to their site, which applies its own privacy policy.

Some providers are outside your country (e.g. in the US); transfers rely on the safeguards each provider offers. We do not sell personal data.

8. Retention

• Creator account, projects, scripts, keys and execution log: while the account exists. Deleting a project or account deletes its scripts, keys, executions and rewards in cascade. There is currently no automatic age-based deletion of the execution log.
• Previous script versions: the latest 20 per script.
• Dashboard sessions: 7 days; admin sessions: 12 hours; reward sessions: 24 h in the cookie (the session record is kept with the reward's data).
• Temporary Redis data: nonces, script sessions and realtime metrics, seconds to minutes; IP blocks, up to 30 days.
• Audit logs: while the related account exists (the staff log is immutable).

9. Your rights and withdrawing consent

You can request access, rectification, erasure, objection, restriction or portability of your data, and withdraw consent where it is the legal basis, by writing to [CONTACT EMAIL — PENDING]. Tell us which data it is (e.g. your key prefix or Discord ID) so we can find it.

• If you are an end user, most of your data is managed by the creator of the script you use: contact them first; you can also write to us and we will forward the request.
• To stop sending data, simply stop running scripts distributed with Aureviai.
• If you are a creator, you can delete keys, scripts and projects from your dashboard or ask us to delete your whole account.
• You can also complain to your local data protection authority.

10. Security

AES-256-GCM encryption at rest of keys, original-code backups and webhook URLs, HTTPS, signed loader responses, bcrypt passwords, 2FA for staff, role permissions, audit logs and rate limits. No system is 100% secure.

11. Minors

The Service is not directed at people under the minimum age required in their country to consent to data processing. If you are a minor, use it only with permission from a parent or guardian.

12. Changes

Changes will be published on this page with their date. Important changes will be announced on /announcements.