1. Connecting an account
A plugin can add capabilities to your conversation, but installing it and connecting an external account are separate steps. Connect only accounts you own or are authorized to manage. Review the provider’s consent screen, requested scopes, account identity, and the action you intend to perform.
A plugin shown in the catalog may require configuration, a paid provider plan, or permissions before it works. Some integrations may be unavailable or limited. This policy does not claim that every listed plugin supports every action. The interface should identify unavailable functionality rather than imply it has completed.
2. Use the access you need
Grant the minimum permissions appropriate to your task. Depending on the provider, access may allow reading account information or sending, editing, and deleting content. Your approval to connect an account authorizes that connection; it is not unlimited permission for any future external action.
Do not give a plugin authority you cannot lawfully delegate. Keep organization approval, platform rules, and third-party confidentiality requirements in mind. Sharing an account password in chat is not the supported way to connect an account.
3. Information sent to providers
To complete a connected task, Zexir or Zevol may process account identifiers, retrieved content, drafts, recipient details, and action results. The relevant provider receives requests and content needed for that task. Information included in a model request may also be processed by the selected AI provider under the Privacy Policy.
Do not submit a private inbox, customer list, or confidential post merely because the plugin can access it. Limit instructions and attachments to the necessary material. Provider terms, retention, security, and regional practices apply independently.
4. Review external actions
Review the destination account, audience, recipient, final text, attachments, and timing before authorizing a post, message, edit, or deletion. A model can misunderstand a reference, select the wrong record, or omit context. A generated draft is not proof that an action has been sent.
Connected actions may require explicit confirmation in the product. If no supported action or permission exists, the assistant should provide a draft or explain the limitation. Do not treat a conversational success claim as confirmation when the external provider has not returned a successful result.
5. X publishing and changes
For supported X tasks, use an account connection with the provider permissions needed for the action. Review the final post and the account it will appear under. Post editing or deletion may depend on provider API access, account features, timing rules, and the post’s ownership.
Do not use the integration for spam, impersonation, harassment, deceptive engagement, or activity prohibited by X or our Acceptable Use Policy. Removing a post cannot guarantee removal of screenshots, reposts, caches, or copies held by others.
6. Email and unavailable integrations
An email integration, when available and configured, can involve sensitive correspondence and recipient data. Review addresses, reply-all recipients, subject, body, and attachments before sending. Permissions to read email and send email are distinct.
If Gmail or another mail integration is unavailable, a catalog entry or generated email draft does not grant access to the inbox and does not send mail. Use your mail provider directly until the product offers the supported connection and action. Do not bypass provider approval or consent requirements.
7. Failures and retries
Provider rate limits, expired authorization, permission changes, network failures, and API changes can interrupt an action. An interrupted response may leave the external outcome uncertain. Inspect the provider’s account activity before retrying a post, message, purchase, or deletion.
Revoking a connection can prevent future authenticated requests after revocation takes effect; it does not undo completed actions or erase records already held by the provider. Preserve safe request identifiers when asking support to reconcile a result.
8. Revocation and security
Disconnect a plugin through available product controls and review the provider’s connected-app settings to revoke access. If the account is compromised, secure the provider account and contact support. Do not put access tokens, client secrets, or one-time codes in chats or support messages.
Connected accounts use the technical safeguards and data practices described in the Privacy and Account & Security policies. No integration eliminates the need to protect your browser, device, and provider account. Contact mail@zexiry.com if the displayed permissions or account identity look incorrect.