Privacy policy
This policy describes what personal data ZasuwAI processes when running the website zasuwai.pl/en, selling its services and answering enquiries, and what rights the people whose data is processed have.
1. Data controller
The data controller is USŁUGI BIZNESOWE PIOTR KLESZCZEWSKI, a business run by Piotr Kleszczewski, address: ul. Pokorna 2/316, 00-199 Warsaw, Poland, NIP 5252998288, REGON 528223040. Contact on data protection matters: kontakt@zasuwai.pl.
2. What data we process
- Order data: first and last name, email address, phone number, company name, company registration number, EU VAT number, website or shop address, line of business, shop platform, expected number of enquiries, purpose of cooperation and comments.
- Billing data: data needed to issue an invoice, and transaction data passed on by the payment provider. We do not process or store any payment card data.
- Data from conversations with the assistant: the content of messages written in the website chat window and in other written channels we serve (Messenger, Instagram, WhatsApp, Telegram, email), and the contact details that a person gives voluntarily.
- Phone conversation data: when providing the "Voice" add-on we process the call recording and transcript, the phone number, the length of the call and a summary that is later passed on to our Customer. At the start of the call we say that the call is conducted by an AI assistant.
- Shopify shop data: if a Customer connects a Shopify shop to ZasuwAI, the ZasuwAI app can only read the shop's products and orders. The agent reads them at the moment a buyer asks about a product or an order status, and does not copy the catalogue or orders into our database. If the Customer turns on abandoned cart reminders, we receive only the first name, email address and abandoned cart contents of those buyers who agreed in the shop to receive marketing messages, and in the sending log we record the address to which the reminder was sent. In this case we process the buyers' data on behalf of the Customer, who is their controller. When the app is removed we delete the shop access key, and when we receive a request passed on by Shopify, including a buyer's request to delete data, we delete the related conversations and reminder log entries.
- Contact data: data given in an email or a contact form.
- Technical data: IP address, information about the device and browser, and data collected by cookies, described in the Cookie Policy.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Concluding and performing the contract, setting up and maintaining the service, administering the subscription | Article 6(1)(b) |
| Issuing and keeping invoices, tax and accounting obligations | Article 6(1)(c) |
| Handling enquiries, conversations with the assistant and contacts | Article 6(1)(b) and (f) |
| Marketing of our own services, including contacting companies (B2B) by email and phone, establishing and defending claims (legitimate interest) | Article 6(1)(f) |
| Sending commercial information with consent, where it has been given | Article 6(1)(a) |
4. Data obtained from other sources
In B2B marketing we may obtain companies' business contact details from publicly available sources, for example websites and registers. We process business data (for example the company's email address, phone number, name and website address) in order to present an offer, on the basis of our legitimate interest.
We may contact companies by phone, calling the company's publicly listed number. Such a call may be made by an AI assistant, which says so at the start of the call. The call may be recorded and transcribed so that we can carry out the actions agreed during the call.
You can object to such processing at any time by writing to kontakt@zasuwai.pl or by saying so during the call. We immediately add the number to a list that we no longer call, and every commercial email includes an option to opt out.
5. Recipients and processors
Data may be passed to trusted suppliers who process it on our behalf under data processing agreements:
- Supabase – hosting of the database and server functions; this is where accounts, orders, the knowledge base and the assistant's conversation history are stored. This is the main processor.
- Stripe – handling of payments and billing.
- Resend – sending emails, including notifications and login links to the account.
- Telephony and speech synthesis provider – handling of phone calls, recordings and transcripts.
- Artificial intelligence provider – the provider of the language model that runs the assistant.
- Google – cloud services, including encrypted database backups stored in Warsaw, email, and, where a calendar is connected, the handling of bookings.
- Meta Platforms – serving the Messenger, Instagram and WhatsApp channels, if the Customer connects them.
- Hosting providers – Lovable (website hosting platform) and Railway (supporting services).
- Email service provider – OVH.
- n8n – an automation platform that handles part of the enquiry flow.
- Where necessary – an accounting firm, lawyers and authorised public authorities.
6. Transfer of data outside the European Economic Area
Some suppliers may process data outside the European Economic Area, including in the United States. In such cases the data is transferred with appropriate safeguards, in particular the standard contractual clauses approved by the European Commission, or where the supplier takes part in the Data Privacy Framework.
7. Retention period
- Data related to a contract – for the whole term of the contract and until the limitation period for claims expires.
- Data contained in invoices – for the period required by tax and accounting law.
- The Shopify shop access key – until the app is removed or the shop is disconnected in the account.
- Abandoned cart reminder log entries – 30 days from the sending of the reminder.
- Encrypted database backups – 30 days from the creation of the backup.
- Data processed on the basis of consent – until the consent is withdrawn.
- Data processed on the basis of legitimate interest – until a justified objection is raised or the purpose ceases.
8. Rights of data subjects
You have the right to access your data, to request its rectification, erasure or restriction of processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time; withdrawing consent does not affect the lawfulness of processing carried out before that. Requests can be sent to kontakt@zasuwai.pl.
You also have the right to lodge a complaint with the supervisory authority in your country or with the Polish Personal Data Protection Office, UODO (uodo.gov.pl).
9. Voluntary provision of data
You provide data voluntarily, but it is necessary to conclude and perform the contract and to issue an invoice. If the data is not provided, the order cannot be fulfilled.
10. Automated decision-making
The data is not used to make decisions that produce legal effects and are taken solely by automated means. The website assistant talks to the user, but does not take such decisions about them.
11. Changes to the policy
We may update this policy. The current version is published on the Website together with its effective date.