Privacy Policy

Last updated: 4 November 2026

This policy explains what personal data we process when you use auwo вземания (auwo receivables) at vzemania.auwo.ai (the “Service”), why, how long we keep it and your rights under Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Who we are

The controller is Vaklin Stoynovski (natural person), Burgas, Bulgaria, trading under the auwo brand. Contact: audit@auwo.ai.

2. Two roles: you and your debtors

For your own account data we are the controller. For your customers’ data that you upload (names, emails, invoice numbers and amounts) you are the controller and we are your processor: we use that data only to prepare and send the reminders you approve. You are responsible for having a basis to contact those customers.

3. What we process

• Account: email and name from sign-in (Clerk).
• Your company details: name, company ID (EIK), VAT number, address, IBAN, contact person. They appear in the signature of the reminders.
• Uploaded receivables lists: customer, customer email, invoice number, date, due date and amount. The file itself is not kept, only what is read from it.
• Mailbox settings: SMTP server, user and password. The password is stored encrypted (AES-256-GCM). With Microsoft sign-in we use the Microsoft token only to send email.
• Log: which reminders were prepared and sent, when and with what result.
• Technical data: IP address and browser in hosting logs, for security and debugging.

4. Purposes and legal bases

• Preparing and sending the reminders you approve: performance of a contract (Art. 6(1)(b)).
• Security, abuse protection and debugging: legitimate interest (Art. 6(1)(f)).

We do not sell data, use it for advertising or make automated decisions with legal effects. Reminders go out only after your approval, or if you turned on automatic sending for a specific customer.

5. How the wording is produced

Reminder text comes from a template. Optionally the middle paragraph is rewritten by a language model through the Vercel AI Gateway. The model receives only the invoice number, amount, due date, days overdue and the customer name. We do not send emails, IBANs or other data. If the answer breaks our rules (missing facts, threatening words) we use the template.

6. Retention

• For as long as you have an account. You can delete all your data under Settings, “Delete all my data”.
• Technical logs: typically up to 30 days.

7. Recipients and processors

• Vercel Inc.: hosting and AI Gateway.
• Railway Corp.: database, in a European data center (Netherlands).
• Clerk Inc.: accounts and sign-in.
• The model provider behind AI Gateway (for example Google): only for the text described in section 5.
• Your own mail provider: reminders are sent through it.

Some of these may process data in the United States, protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

8. Cookies

We use only the strictly necessary cookies for sign-in and session (Clerk). No advertising or tracking, so there is no consent banner.

9. Your rights

You have the right to access, rectification, erasure, restriction, portability and objection. Write to audit@auwo.ai; we answer within one month. You may complain to the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).