Back
Under the GDPR and Bulgarian law

Privacy Policy

Политика за поверителност

Last updated: October 14, 2026

1. General Information

Personal Data Controller

This Privacy Policy describes how Zhizhevo Stone EOOD / STEVEN STUDIO ("we", "our", "ours") collects, uses, stores and protects the personal data of our users and clients in full compliance with:

  • Regulation (EU) 2016/679, General Data Protection Regulation (GDPR)
  • Personal Data Protection Act (PDPA), Bulgarian legislation
  • Electronic Commerce Act (ECA)
  • Copyright and Related Rights Act (CRRA)

2. What Data We Collect

Automatically Collected Data

  • • A visit number computed on the server that changes every day. Nothing is stored in your browser for statistics
  • • Device and browser type
  • • Pages visited, how far down you scrolled and how long the page was open
  • • Which site you came from, and a campaign tag if you followed a link from one of our messages
  • • Taps on phone, Viber and email, and the steps in the enquiry form, without what you typed
  • • Your result in the terminal game (level and time), if you play it
  • • Security records when someone opens an address that break-in bots look for: IP address, browser, page

⚠️ No cookies are used for the statistics and your IP address is not recorded. It is used for a moment on the server to compute the visit number. Statistics and security records are kept for 12 months and then deleted.

Voluntarily Provided

  • • Name
  • • Email address
  • • Phone number
  • • Messages
  • • Company (optional)

⚠️ Important:

We never collect sensitive personal data (race, ethnicity, political views, health status, sexual orientation, biometric data) without your explicit consent and legal basis.

Why we process data and how long we keep it

  • An enquiry from the form, the Viber card or the AI assistant: to reply and prepare an offer, as you asked (Art. 6(1)(b) GDPR). Kept for 24 months.
  • Visit statistics and security records: legitimate interest in knowing which pages work and in protecting the site (Art. 6(1)(f)). Kept for 12 months.
  • Analytics and advertising cookies: only with your consent (Art. 6(1)(a)). You can withdraw it at any time from the "Cookies" link at the bottom of every page.
  • Contracts and invoices: kept for 10 years, as the Bulgarian Accountancy Act requires.
  • You do not have to give us any data. Without a phone number or email, though, we cannot reply.

3. Data Collection Tools and Forms

The site has free tools where you can leave data to get a result or an offer. This is what each one collects.

Site Scanner (Website Analysis)

  • • Email address, name, phone
  • • Scanned website URL
  • • Scan result (score)

AI Visibility Check

  • • Email address, name, phone
  • • Business name, city, website URL
  • • Check result (score)

Chatbot Builder Demo

  • • Email address, name, phone
  • • Industry, communication tone, business name
  • • Color preferences

Referral Programme

  • • Name, email address, phone
  • • Referral method

Purpose of processing: To send you the result, reply and, if you wish, prepare an offer.

Retention period: 24 months

Legal basis: Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

4. Automated Profiling and Lead Scoring

When using our Quiz (quote questionnaire), we perform automated profiling to provide better service.

What we collect:

  • • Answers to business questions (project type, budget, timeline)
  • • Email address, phone number
  • • Preferred communication method

How lead scoring works:

  • • Qualification, how well the user matches our services
  • • Budget, estimated project budget
  • • Urgency, how soon the user wants to start
  • • Fit score, overall compatibility with our services

Purpose: Personalizing recommendations and prioritizing requests for faster service.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR). No decision with legal effects on you is made automatically: a person reads every request.

Your rights:

You have the right to object to automated profiling and request a manual review of your request. Contact us at brixeat@gmail.com.

5. AI Chatbot

🤖 How the AI Chatbot Works

The assistant is an AI (OpenAI) and says so in its first message. A note under the input says the conversation is kept. We record it so Steven can read it and reply in person (Art. 6(1)(b) GDPR). If you do not want it kept, call us instead or delete it with the "Delete" button under the input.

📝 What we record:

  • Content: the text of your messages and the assistant's replies
  • Time and date of each message
  • Technical data: conversation number, device type, browser, page address
  • Name, email and phone, if you type them
  • How fast the assistant replied

✅ We do not record IP addresses or location. To stop abuse, we keep an encoded fingerprint of the connection with each message. It lets us count messages from one connection, but the address cannot be recovered from it.

🎯 Purpose of processing:

  • To read your request and reply
  • To prepare an offer if you asked for one
  • To fix the assistant's answers when it got something wrong

⏱️ Retention period:

24 months (2 years) from the date of the conversation, then deleted automatically.

🔒 Security and encryption:

  • Conversations are kept in a Supabase database that the provider encrypts at rest (AES-256)
  • Connections to the site and the database are encrypted (TLS)
  • Only the company's manager has access to the records

🤝 Third parties (AI providers):

To reply, the assistant sends the conversation text to OpenAI through its API.

  • ✅ OpenAI does not use data sent through the API to train its models
  • ✅ OpenAI keeps what is sent for up to 30 days to detect abuse, then deletes it
  • ✅ OpenAI is in the USA. Data is transferred under OpenAI's data processing terms, which include the European Commission's standard contractual clauses

More information: OpenAI Privacy Policy

🗑️ Right to deletion:

You have the right to delete all your chats at any time:

  1. From the assistant: the "Delete" button under the input deletes the conversation at once
  2. By email: send a request to brixeat@gmail.com
  3. By phone: call +359 87 72 75 750

⏱️ Requests by email or phone are carried out within 72 hours.

After deletion, data is irreversibly erased and cannot be recovered.

6. Cookies

Analytics and advertising cookies load only after you accept them. The site works fully without them. You can change your choice at any time from the "Cookies" link at the bottom of the page.

✅ Necessary cookies (Strictly Necessary)

Required for the site to function. Cannot be refused.

  • • Your cookie choice (cookie-consent)
  • • Cloudflare Turnstile, bot protection in the contact form
  • • Assistant conversation number (sessionStorage, gone when you close the tab)
  • • Admin login, for the site owner only

📊 Analytics cookies

Help us understand how visitors use the site.

  • • Google Tag Manager and the Google tools it loads
  • • Microsoft Clarity session recordings. Forms and the assistant are hidden in the recordings
  • • Vercel Analytics
  • • Vercel Speed Insights

Loaded only with your consent.

🎯 Marketing cookies

To measure Google ads.

  • • Google Ads (Google's advertising tag)

Loaded only with your consent.

💾 Local Storage

Data kept in your browser and never sent to us.

  • • cookie-consent, your cookie choice
  • • locale, your preferred language
  • • quiz-completed, quiz-dismissed, whether you finished or closed the quiz

7. Data Security

🛡️ Technical measures:

  • ✓HTTPS everywhere (HSTS)
  • ✓Security headers (Content Security Policy, X-Frame-Options, X-Content-Type-Options)
  • ✓Request rate limiting against abuse
  • ✓Bot protection on forms (Cloudflare Turnstile and hidden fields)
  • ✓The database is encrypted at rest by the provider (AES-256)
  • ✓Database access keys live only on the server

Who processes data on our behalf

  • Vercel Inc. (USA): site hosting
  • Supabase Inc.: the database with enquiries, conversations and statistics
  • OpenAI (USA): the AI assistant's replies
  • Resend (USA): the new-enquiry notice to our mailbox
  • Google (Gmail): the mailbox where enquiries arrive
  • Upstash: counting requests per IP address for a short time (up to 1 hour) to stop abuse
  • Cloudflare: bot protection in the form
  • Google, Microsoft (Clarity) and Vercel Analytics: only if you accept analytics cookies. Google Ads: only if you accept marketing cookies

When data leaves the European Union, the transfer relies on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, depending on the provider. We sell data to no one.

⚠️ Important to know:

Despite all security measures, no system can guarantee 100% protection. If you notice suspicious activity or a security breach, please immediately notify us at brixeat@gmail.com

8. Your GDPR Rights

As a data subject, you have the following legal rights:

Right to Access

You can request a copy of the data we store.

Right to Rectification

You can request correction of inaccurate or incomplete data.

Right to Erasure

Known as the "right to be forgotten". You can request deletion of your data.

Right to Restriction

You can request temporary restriction of processing of your data.

Right to Data Portability

You can receive your data in a structured, machine-readable format (JSON/CSV).

Right to Object

You can object to processing based on legitimate interest and to direct marketing. Cookie consent can be withdrawn at any time.

📞 How to exercise your rights:

📧Email: brixeat@gmail.com

📞Phone: +359877275750

💬From the AI assistant: the "Delete" button

Response deadline: Up to 30 days from submitting the request (may be extended to 60 days for complex requests).

🏛️ Right to file a complaint with a supervisory authority:

If you believe your rights have been violated, you can file a complaint with:

Commission for Personal Data Protection (CPDP)

Address: Sofia 1592, bul. "Prof. Tsvetan Lazarov" No. 2

Phone: +359 2 915 3 518

Email: kzld@cpdp.bg

Website: www.cpdp.bg

9. Policy Changes

We reserve the right to update this Privacy Policy. In case of significant changes, we will notify you through:

  • A new "last updated" date at the top of this page
  • An email to clients we have a contract with

Last updated: October 14, 2026

10. Contacts

For any questions related to this Privacy Policy or the processing of your personal data:

General inquiries

📧 brixeat@gmail.com📞 +359877275750

Data and privacy questions

📧 brixeat@gmail.com

Have questions about your data?

Write to us at any time.