Privacy statement

1. Who is responsible

The controller is Zwovo, with its registered office at Hristo Smirnenski 20, Dobrinishte, Bulgaria (not open to visitors). For privacy questions, email help@zwovo.com.

2. Which data we process, and why

When you make a free preview

You enter a business name, the type of business, a short description and a town. We use that to show the preview. We do not store it, unless you ask us to email the preview.

When you have a preview emailed to you

We store your email address and the details of the preview to send you the link, and at most two reminders. Every email has an unsubscribe link. We keep this for up to 12 months.

When you have your current website read

We read the public pages at the address you enter and take the business name, contact details, opening hours and photos from them. We use that only to make your preview and, if you order, your website.

When you become a customer

• Account: your email address, to sign in and to send you messages about your website.
• Business details: name, type of business, description, town, phone number, email address, address, opening hours and photos. These appear on your website.
• Payment: payment runs through Stripe. We see your name, email address, billing address, VAT number if you give one, and whether payment succeeded. We do not see or store your card or bank details.
• Changes: what you ask to change in your dashboard, and what was changed.
• Domain name: if you register a domain name through us, we ask for your name, address, email address and phone number and pass them to the registry.

When you contact us

We keep your message and contact details to answer you, including requests for custom work.

When you visit zwovo.com

Our hosting provider keeps technical logs for a short time (such as IP address and the page requested) to keep the website secure and available. The fonts on zwovo.com are loaded through Google Fonts; Google receives your IP address when that happens. We place no advertising or tracking cookies. See also our cookie statement.

3. On what basis

• Performance of the contract: making your website and keeping it online, your account, payments and changes.
• Legal obligation: keeping invoices and accounting records.
• Legitimate interest: security, preventing abuse, improving our service, and the reminders for a preview you asked us to email.
• Consent: where we ask for it. You can withdraw consent at any time.

4. Artificial intelligence

For paid websites an AI model by Anthropic writes the texts and processes the changes you ask for. To do so we send what you told us about your business to Anthropic. Anthropic does not use this data to train its models. Do not put sensitive personal data in your description or change requests; it is not needed for this.

5. Who we share data with

We do not sell data. We do use companies that work for us. With each of them we have agreements on security and confidentiality.

We also share data when the law requires us to.

6. Data outside the EU

Some of these companies are based in the United States. The transfer is based on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

7. How long we keep data

• Your account and website: for as long as you are a customer, and at least 90 days after that so you can come back. We then delete them, after 12 months at the latest.
• Invoices and payment records: for as long as the law requires (in Bulgaria up to 10 years).
• An emailed preview: up to 12 months.
• Messages and appointments made through customers' websites: up to 12 months.
• Messages to our support: up to 2 years after the last contact.
• Technical logs: a few weeks.

8. Visitors to our customers' websites

For the websites we make for customers, the customer is the controller; we process data on their behalf. We measure how often a website is visited and how often call, email or directions is tapped. We do this without cookies. To avoid counting a visitor twice within one day, we turn the IP address and browser into a code that changes every day and that we cannot trace back to a person. We only keep the totals.

When a visitor sends a message, asks for an appointment or books one through such a website, we store what they enter: name, email address, phone number, the message and the chosen day and time. We pass that on to the business behind that website, which uses it to answer or to arrange the appointment. For an appointment the visitor gets a confirmation and, the day before, a reminder by email, with a link to cancel. We keep this data for up to 12 months; the business can delete it sooner. Are you such a visitor and do you want to see your data or have it deleted? Ask the business you made the appointment with, or email us.

When a website shows Google reviews, we fetch them from Google. The visitor's browser does not connect to Google for that.

9. Security

All connections are encrypted. Access to customer data is limited to those who need it, and signing in uses a one-time link instead of a password. If we discover a data breach that puts you at risk, we report it to you and to the supervisory authority.

10. Your rights

You may ask us to show, correct or delete your data, to restrict its use or to transfer it to you. You may also object to use that is based on our legitimate interest. Email help@zwovo.com; you get an answer within a month.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Bulgarian supervisory authority (Commission for Personal Data Protection, cpdp.bg) or with the authority in your own country.

11. Changes

If something changes in how we handle data, we update this statement. We tell customers by email about an important change.