Privacy Policy

The controller of personal data is Прайс Екс ЕООД (Pricex Ltd), company ID (ЕИК) 206487271, Petyofi St 1, Tsentralen district, Plovdiv 4000, Bulgaria. For questions about personal data write to [email protected].

We have two roles. For your account data and technical logs we are the controller. For the data of your business's customers that agents send with requests we are a processor acting on your behalf. You are the controller of that data. It is governed by the Data Processing Agreement.

• Account: name, email, password (we keep only a one-way hash), language, when you accepted the terms and when you last signed in.
• Business data: the information the Service extracts from your public website and what you enter, for example name, address, phone, email, opening hours, menu or catalog. If you are an individual, this data can be personal.
• Agent request data: date, time, number of guests, products, and the data the agent sends about the customer, for example name, phone, delivery address, notes. We process it on your behalf.
• A log of agent calls to the MCP address: tool, arguments (these can contain a customer's name, phone and address), the client name the agent reports, a session identifier, time and result.
• Messages through the contact form: name, email, subject, text.
• Session data: for every visitor, including those without an account, we keep a session with the IP address and user agent (browser type) of the device. Legal basis: legitimate interest, security.
• Technical data: cookies needed for the site to work (see the Cookie Policy), and the usual web server logs (IP address, time, requested address).

The Service uses an AI model to propose values from your public website. The proposals have no legal effect on individuals. You review them and decide. The Service makes no decisions about your customers.

The specific periods are:

• Account data: while the account exists. After you delete it we remove it, unless a law requires us to keep it longer.
• Business data and requests: while the business is in the Service, with the exceptions below.
• Log of agent calls to the MCP address (including arguments): 90 days.
• Personal data of customers inside requests (name, phone, address, notes): anonymised 12 months after the date of the request. The anonymised record in the request journal stays.
• Contact form messages: not stored by the application. They stay in the support mailbox and are deleted 12 months after receipt.
• A business the owner deleted: an administrator can restore it for 30 days, after which it is removed permanently.
• Session data, including IP address and user agent: until the session expires (2 hours of inactivity).
• Technical web server logs: 90 days.

The request journal is a chain of records and for that reason is not edited. When data is anonymised, the personal data in the record is replaced and the record itself stays.

• Anthropic, PBC (USA), provider of the AI model. It receives the text of the public pages of the website you add, to extract the profile. We do not send it the request data of your customers.
• TypeSafe AI, Inc. (USA), provider of the model that classifies businesses and chooses which of them to search for a query. It receives the public profile of businesses (text from their public website and catalog) and the text of the searches that AI agents send through the MCP endpoint. It does not receive the data of your customers' requests to the business (names, phones, addresses).
• Our own mail server (email.karlovo.net), hosted at Hetzner Online GmbH, Germany. Through it we send email (email confirmation, password reset) and receive messages sent to [email protected].
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (Germany, EU): the provider of the server infrastructure on which the Service runs.
• You and your team members see the request data of your business. Administrators of the Operator can access business data, including the contents of requests, for support and security. Every administrator action is logged, and contact details (phone, email) are masked in the administration screens.
• AI agents receive the published data of the business and the status of their own requests. For their own request they get back the name, address and notes they sent. The customer's phone is never returned to an agent.
• Authorities, where the law obliges us to give them data.

We do not sell personal data. We use no third-party advertising or analytics services. Fonts are loaded from our own server.

Anthropic is in the USA. Transfer of the text of public pages to it relies on the European Commission's standard contractual clauses or another ground under Chapter V of the GDPR that the provider applies.

TypeSafe AI, Inc. is also in the USA. Transfer to it relies on the European Commission's standard contractual clauses (Module 2, controller to processor) under TypeSafe's data processing agreement, updated on 24 April 2026. According to that agreement and TypeSafe's privacy policy, TypeSafe does not train models on its customers' data.

You have the right of access to your data, to rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time, without affecting processing before withdrawal.

Write to [email protected]. We reply within one month. If we are a processor for the data of one of your customers, we will pass the request to you as the controller.

You have the right to lodge a complaint with the supervisory authority: the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, website https://cpdp.bg. You may also turn to the court.

You reach the site over an encrypted connection (TLS). Passwords are stored only as a hash. Access to business data is limited to its members and to administrators of the Operator, who use it for support and security. Administrator actions are logged, and contact details are masked in the administration screens. Request records are linked in a chain that shows when an old record is altered. We limit the rate of calls and of sign-in attempts. Outgoing requests to user-supplied addresses go through protection against access to internal networks.

We will update this policy when the way we process data changes. The date of the last update is at the top of the page.