This policy explains what personal data ZemedelCo processes, why, and what rights you have under the General Data Protection Regulation (GDPR).
What data we process
Account data — name, email, language, password (stored as an irreversible hash) or a Google identifier when signing in with Google. Content — your questions, conversations, and uploaded documents. Payment data — payment history and billing details; card numbers are processed only by Stripe and never reach us. Technical data — IP address and device at sign-in (for security), aggregated usage statistics.
Why we process it
To provide the service (performance of contract), to issue invoices and keep accounts (legal obligation), for security and abuse prevention (legitimate interest), and — only with your consent — for news and visit analytics.
Where it is stored and who can access it
Data is stored encrypted on servers in the European Union. To generate answers, question content is processed by AI infrastructure providers under contractual confidentiality guarantees; your conversations are not used to train models. Other recipients: the payment provider (Stripe), hosting, and the email provider — only to the extent necessary.
Sub-processors and transfers to third countries
We use the following categories of sub-processors (data processors under Art. 28 GDPR): an AI infrastructure provider for generating answers (processing may take place on servers outside the EU, including in the USA); a payment services provider; a hosting provider; an email delivery provider. Data-processing agreements are in place with all sub-processors, and transfers outside the EU/EEA rely on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) plus supplementary technical measures. A current list of the specific companies is available on request via the contact form.
How long we keep it
While your account is active. You can delete individual conversations or the entire account at any time; invoices are kept for the statutory accounting periods. If an automatic conversation-deletion period is configured, it is stated in the service settings.
Your rights
You have the rights of access, rectification, erasure, restriction, portability, and objection. Your profile page has buttons for data export (GDPR) and account deletion. You can withdraw marketing consent at any time. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg).
Cookies
We use only necessary cookies for sign-in and preferences. Analytics cookies (Google Analytics) load only after your explicit consent via the banner.
Contact
For questions about personal data, write to us via the contact form.