Privacy Policy

This Privacy Policy describes how Zion Enterprises ("Zion," "we," "us") collects, uses, discloses, and protects personal data across our websites, applications, and services — LovinFreq, OneGigTicket, Barnaby, Mizracha, Omnivox, MOVVE, and our AI and software services (collectively, the "Services"). It is written to comply with data-protection laws worldwide, including the Brazilian LGPD (Law 13.709/2018), the EU/UK GDPR, the CCPA/CPRA and the comprehensive privacy laws of all U.S. states in which such laws are in effect, Canada's PIPEDA, and Australia's Privacy Act, and to extend the strongest applicable protections to all users regardless of location.

1. Controller; Roles

Zion Enterprises is the data controller for personal data processed through the Services, except that for client records processed within MOVVE (session notes, vitals, attendance, and payment records of a Trainer's clients), the Trainer is the controller and Zion acts solely as a processor/service provider on the Trainer's documented instructions. Our single point of contact for all privacy matters, including the exercise of rights and data-protection-officer inquiries, is support@enterpriseszion.com.

2. Data We Process

Depending on the Service and your choices, we process: (a) identification and contact data (name, email, sign-in identifiers); (b) account and credential data (hashed passwords, authentication tokens); (c) transaction data (purchases, tickets, minute packs — excluding full payment-card numbers, which are handled by PCI-DSS-compliant payment processors); (d) usage and device data (app interactions, device model, operating system, IP address, approximate location derived from IP); (e) content you submit (support messages, reviews, profile information); and (f) product-specific data described below.

On-device by design. Barnaby performs speech recognition and intent matching on your device; your voice is not sent to our servers, and your contacts and reminders remain local to the device. Mizracha computes direction using your device's sensors and location locally; your precise location is not transmitted to Zion.

Omnivox audio. To perform live translation, your speech is streamed to our servers and relayed to our AI provider for the duration of the session; we do not retain session audio after processing beyond transient operational buffers and metering records (duration, languages).

3. Purposes and Legal Bases

We process personal data: (a) to perform our contract with you — providing accounts, purchases, tickets, translations, reminders, and support (LGPD art. 7(V); GDPR art. 6(1)(b)); (b) to comply with legal obligations, including tax, consumer, and anti-fraud/anti-money-laundering requirements (LGPD art. 7(II); GDPR art. 6(1)(c)); (c) for our legitimate interests in securing, measuring, and improving the Services, balanced against your rights (LGPD art. 7(IX); GDPR art. 6(1)(f)); and (d) with your consent, where required — for example, marketing communications — which you may withdraw at any time without affecting prior processing (LGPD art. 7(I), art. 8 §5; GDPR art. 6(1)(a)).

4. Sensitive Data; What We Do Not Do

We do not require you to disclose racial or ethnic origin, religious belief, health status, or other special categories of data. Use of Mizracha or wellness features may allow an inference of belief or wellness interest; we process such data solely to provide the feature you requested, on the basis of your explicit request and consent, and never for advertising, profiling, or disclosure to third parties. We do not collect biometric identifiers or templates (as defined by Illinois BIPA, Texas CUBI, or Washington law). We do not sell personal data, do not "share" personal data for cross-context behavioral advertising within the meaning of the CPRA, and do not process personal data for targeted advertising, and we have not done so in the preceding twelve (12) months. We do not engage in automated decision-making that produces legal or similarly significant effects. We do not use dark patterns to obtain consent.

5. Consumer Health Data

To the extent wellness-related data (for example, LovinFreq usage or MOVVE vitals recorded by your Trainer) constitutes "consumer health data" under laws such as Washington's My Health My Data Act or Nevada SB 370, we process it only as necessary to provide the Service you or your Trainer requested, we do not sell it, and we do not use it for advertising. Where such laws require separate consent for collection or sharing, we obtain it.

6. Disclosure of Personal Data

We disclose personal data only to: (a) service providers and processors bound by contract to process data solely on our instructions (hosting and infrastructure, payment processing, email delivery, AI model providers for Omnivox translation, analytics limited to service operation); (b) event Organizers, for ticket validation and event administration (OneGigTicket); (c) your Trainer, who controls the client records you and they create in MOVVE; (d) app stores and payment networks as necessary to complete transactions you initiate; (e) authorities, where required by law, subpoena, or court order, or to protect rights, safety, and the integrity of the Services; and (f) a successor entity in connection with a merger, acquisition, or sale of assets, subject to this Policy. We require all processors to provide at least the level of protection described here.

7. International Transfers

We are headquartered in Brazil and use infrastructure in the United States and other countries. Where personal data is transferred internationally, we rely on lawful transfer mechanisms, including adequacy decisions, the EU Standard Contractual Clauses and UK International Data Transfer Addendum, and the transfer safeguards of LGPD arts. 33–36, together with supplementary technical measures (encryption in transit and at rest).

8. Retention

We retain personal data only as long as necessary for the purposes described: account data for the life of the account; upon a deletion request, accounts are deactivated immediately and personal data is permanently erased within thirty (30) days, except data we must retain by law (for example, Brazilian tax and transaction records, retained five (5) years; application access logs under the Marco Civil da Internet, six (6) months); backups are cycled within ninety (90) days. MOVVE client records are retained per the Trainer's instructions.

9. Security

We implement technical and organizational measures appropriate to the risk, including TLS 1.2+ in transit, AES-256 encryption of sensitive fields at rest, bcrypt password hashing, short-lived rotating JWT tokens, row-level security in our databases, access controls on a need-to-know basis, and logging. No system is perfectly secure; we cannot guarantee absolute security.

10. Your Rights — Worldwide

Subject to applicable law, you have the rights to: confirmation of processing; access; correction; anonymization or deletion; portability; information about disclosures; restriction of or objection to processing; withdrawal of consent; and to lodge a complaint with a supervisory authority (in Brazil, the ANPD; in the EU/UK, your data-protection authority; in the U.S., your state Attorney General).

United States. Residents of California and of every other U.S. state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island, and Florida) have, as applicable, the rights to know/access, correct, delete, obtain a portable copy, and opt out of sale, sharing, targeted advertising, and certain profiling — noting that we do not sell, share, or advertise as described in Section 4. We honor the Global Privacy Control signal as an opt-out where required. We will not discriminate against you for exercising rights. You may use an authorized agent as permitted by law. If we deny a request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state Attorney General.

To exercise any right, email support@enterpriseszion.com or use our account deletion page. We verify requests using your account email and respond within the time required by your jurisdiction's law (LGPD: 15 days for confirmation/access; GDPR: one month; U.S. state laws: typically 45 days, extendable once). For MOVVE client records, we will refer your request to the responsible Trainer and assist them as processor.

11. Children

The Services are not directed to children under 13 (or the higher minimum age applicable in your jurisdiction, such as 16 in parts of the EU), and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us and we will delete it. Where parental consent is legally required for a minor's use, verified consent must be provided (LGPD art. 14; COPPA).

12. Cookies and Similar Technologies

Our website uses only strictly necessary storage (for example, your language preference stored locally in your browser). We do not use advertising cookies or cross-site tracking. If this changes, we will update this Policy and obtain consent where required.

13. Incident Response

In the event of a security incident affecting personal data, we will notify the competent authorities and affected individuals as required — including the ANPD and data subjects under LGPD art. 48, supervisory authorities within 72 hours under GDPR art. 33, and U.S. state regulators and residents under applicable breach-notification statutes.

14. Changes to This Policy

We may update this Policy prospectively. Material changes will be announced through the Services or by email with reasonable advance notice; the version and date above will always reflect the current text. This Policy is drafted in English; translations are for convenience, and the English version controls to the extent permitted by law.

15. Contact

Privacy questions, rights requests, complaints, and DPO inquiries: support@enterpriseszion.com. Supervisory authorities: ANPD (Brazil) · your EU/UK data-protection authority · your U.S. state Attorney General.