Privacy policy

1. Controller

Zack Data+AI solutions, owner Zakaria Aoune, Am See 21, 88356 Ostrach, email: [email protected].

2. What we process and why

• Account data (email, password hash, business details, optional 2FA secret) to provide the service (Art. 6(1)(b) GDPR).
• Billing data is processed by Stripe. We never see or store full card details (Art. 6(1)(b) and (c) GDPR).
• Content you create (chatbot information, quotes, leads) to provide the service (Art. 6(1)(b) GDPR).
• Website import: when you ask us to, we load public pages of the website address you enter (Art. 6(1)(b) GDPR).
• Support requests (name, email, message, support chat) to answer you (Art. 6(1)(b) and (f) GDPR).
• Quote acceptance: when a client accepts a quote via a shared link, we record name, time and IP address as proof for the issuing business (Art. 6(1)(b) and (f) GDPR).
• Security data (IP address, timestamps, login attempts) to protect the service against abuse, kept for at most a few days (Art. 6(1)(f) GDPR).

3. Chatbots on our customers' websites

When a business uses our chatbot on its website, that business is the controller for its visitors' data. We process chat messages and any contact details visitors share only on the business's behalf as a processor under our data processing agreement (Art. 28 GDPR).

4. Recipients and processors

We use the service providers listed on our subprocessor page. Hosting takes place in the EU. AI answers are generated by Perplexity AI, Inc., USA (forwards requests to the model maker, e.g. Anthropic PBC), which may process data in the USA on the basis of the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Data sent to our AI provider is not used to train AI models. Stripe may process payment data in the USA; Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses apply.

5. Cookies and local storage

We use one technically necessary session cookie to keep you logged in and to protect forms. The chat widget stores a random visitor ID in the browser's local storage so a conversation can continue. We use no advertising or tracking cookies and no third-party analytics.

6. Retention

We keep account and content data while your account is active. When you delete your account (Settings → Delete account), we delete it immediately, except data we must keep by law (e.g. invoices, 10 years under German tax law), which Stripe and our accounting keep.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR), and the right to lodge a complaint with a supervisory authority. Contact us at [email protected].

8. Security

Encrypted connections (TLS/HSTS), hashed passwords, optional two-factor login, strict security headers, rate limiting and EU hosting. Report security issues to [email protected] (see /.well-known/security.txt).