Privacy notice

Controller

Event AI Grupa j.d.o.o., Trampov breg 60b, 51000 Rijeka, Croatia, OIB 23337460184. For any personal data question: sidrocjenici@gmail.com.

What we process

• Account data: email, name, interface language, hashed password (managed by Supabase Auth). When you open an account, we email your name, email address and chosen plan to our team so they can contact you and help with setup.
• Organisation data: name, OIB, outlet addresses, website, alert emails.
• Catalogue and prices: products and services, prices, anchor prices, price history and audit trail. This is not personal data, except the name of the user who made a change.
• Payment data: processed by Stripe; we only see subscription status and invoices, never card numbers.
• Technical data: for abuse protection we use a hash of the IP address (the address itself is not stored). For public price lists we count daily downloads without any personal data.
• Website visits: we count, per day, views of individual pages, clicks towards sign-up, submitted sign-ups, price list checks, assistant openings and answers to the cookie notice — together with the visit source (e.g. “Facebook ad, web shop campaign” or “search engine”), derived from the page address and the page you came from. We set no cookies, store nothing in your browser and store neither the IP address nor any identifier: only daily totals remain. When you open an account, we also record that visit source with it.
• Full automation request: the name, company, email, phone, website and message you enter in the form. We store them and email them to our team to reply with a quote.
• Sidro assistant (chat on the website and in the dashboard): your question and a few previous messages are sent to an AI model provider to generate the answer. We do not store the chat — it stays only in your browser until you close the tab. We only count how many questions, recognised needs and requests there were per day, with no personal data.
• Request from the Sidro assistant: if you send the form in the chat and tick the consent box, we store what you entered — name, company or project, email and/or phone, description of your need, deadline, budget and preferred meeting time — and email it to the Event AI Group team so they can contact you. Apart from the form, do not enter personal data in the chat.
• Form in our Facebook or Instagram ad: if you open and submit the form in our ad, we receive your name, phone, email and your answer about what you need to bring into compliance. We use them only to contact you and help you set up Sidro; the form is displayed by Meta and we retrieve the data from Meta’s advertising system.
• Ad measurement (only with your consent): if you choose “OK” on the notice about the ad-measurement cookie, the Meta Pixel is loaded on the marketing website. Meta then receives the address of the page visited, browser and device data, the IP address and the identifier from the _fbp cookie, and we record that a request was sent or an account opened — without name, email, phone or the content of the request. There is no Meta Pixel in the dashboard or on merchants’ public price lists.

Purpose and legal basis

Performance of the contract (Art. 6(1)(b) GDPR), legal obligations such as accounting (c), and legitimate interest in security and abuse prevention (f). Visit totals and the visit source recorded with an account are processed on the basis of our legitimate interest in knowing which parts of the site and which advertising work (f). Submissions from the public price list check are stored only if you leave your email. Automation requests and the form in our ads are processed to take steps at your request before entering into a contract (b); requests from the Sidro assistant on the basis of your consent (a), which you can withdraw by writing to sidrocjenici@gmail.com. The Meta Pixel is used only on the basis of your consent (a), to measure and improve our ads on Facebook and Instagram; you can withdraw it at any time via “Cookie settings” in the footer.

Processors

• Supabase (database and sign-in) — servers in the EU (Frankfurt).
• Vercel (application hosting) — functions run in the EU (Frankfurt), static content via a global network.
• Stripe (payments) — own privacy terms and standard contractual clauses.
• Resend (email delivery).
• OpenRouter — Sidro assistant answers (only the chat text is sent; Google Gemini models, with OpenAI as a fallback) and AI category suggestions (only on request; product names are sent).
• Meta Platforms Ireland Ltd. (Meta Pixel, only with your consent) — we are joint controllers with Meta for collecting and transmitting data via the pixel, and Meta processes it further as an independent controller; Meta may transfer data to the US under the EU-US Data Privacy Framework.

Cookies

Essential cookies: sign-in session, selected organisation and language — no consent is needed for these. The advertising cookie _fbp (Meta, up to 90 days) is set only if you accept advertising cookies on the notice; otherwise the Meta Pixel is not loaded at all. You can change or withdraw your choice via “Cookie settings” in the footer — we then also delete the _fbp and _fbc cookies. Your choice is kept in the browser’s local storage, not in a cookie. The merchant widget sets no cookies.

Retention

Account and organisation data are kept while the account is active and deleted within 30 days of a deletion request. Invoices are kept as required by law. IP hashes used for rate limiting are deleted after 24 hours.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection. Send requests to sidrocjenici@gmail.com. You can lodge a complaint with the Croatian Personal Data Protection Agency (azop.hr).

Security

Traffic is encrypted (HTTPS). Integration credentials (e.g. WooCommerce keys, Shopify tokens) are stored encrypted with AES-256-GCM. API keys are stored only as hashes. Only the service’s servers can access the database.