Privacy Policy

ZENIA Assistant is a software product available at https://buildbot.ro. ZENIA Assistant is not a registered company or separate legal entity.

The product is operated by Popescu Adrian Florin, an individual based in Romania, trading under the ZENIA Assistant / buildbot.ro brand. In this Privacy Policy, references to “ZENIA Assistant,” “we,” “us,” or “our” refer to the operator of the buildbot.ro product, unless the context indicates otherwise.

This policy explains how we collect, use, store, and protect personal data when you use the buildbot.ro website, the ZENIA dashboard, API, embed widget, and associated services.

Paid plans are being prepared for launch through Paddle. Until live checkout is enabled, some commercial features may be unavailable or limited to testing / early access.

For any privacy-related questions, requests, or concerns, you can reach us at:

• Product operator / data controller: Popescu Adrian Florin
• Product brand: ZENIA Assistant / buildbot.ro
• Email: contact@buildbot.ro
• Website: https://buildbot.ro

We aim to respond to all privacy requests within 30 days. If you are exercising a right under GDPR, we will respond within one calendar month as required by law.

We collect and process the following categories of personal data:

• Account data: name, email address, and password-related authentication data when you register
• Billing and subscription data: plan selection, billing cycle, subscription status, transaction references, customer / subscription identifiers, and payment events received from Paddle or the payment provider used at the relevant time; we do not store full card numbers, CVV, or full bank-account details
• Usage data: pages visited in the dashboard, features used, timestamps, and session identifiers
• Chat data: messages sent to and received from chatbots you create, including end-user messages through the embedded widget
• Content data: website URLs submitted for crawling, crawled page content, uploaded files, and custom text entries
• Technical data: IP addresses, browser type and version, operating system, device type, and referral URLs
• Support data: messages and attachments sent through support channels
• Communication preferences: email opt-in status for transactional and marketing communications

We process your personal data for the following purposes:

• Providing the Service: account creation, authentication, dashboard access, chatbot creation, knowledge ingestion, and chat widget operation
• Billing and subscriptions: processing plan selections, managing the subscription lifecycle, activating / suspending access based on subscription status, communicating billing events, and keeping necessary records
• Product improvement: analyzing aggregated usage patterns to improve features, fix bugs, and plan product development
• Security: detecting and preventing unauthorized access, abuse, and fraud
• Support: responding to your inquiries and resolving technical issues
• Legal compliance: fulfilling obligations under applicable law, including tax / commercial records where required and consumer protection
• Transactional communications: sending account confirmations, subscription-related notices, plan change notifications, and service alerts
• Marketing (only with consent): sending product updates and newsletters when you have explicitly opted in

We rely on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b)): processing necessary to provide the Service, manage your account, process subscriptions, and deliver chatbot functionality
• Legitimate interest (Art. 6(1)(f)): security monitoring, fraud prevention, aggregated analytics for product improvement, and maintaining operational logs
• Legal obligation (Art. 6(1)(c)): tax / commercial records where required, consumer protection, and responding to lawful requests from authorities
• Consent (Art. 6(1)(a)): marketing emails and newsletters, optional cookies for analytics

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

When you create a ZENIA account, we collect your name, email address, and a password. Passwords are not stored in plain text. Account credentials are stored using password hashing rather than reversible encryption.

We use session-based authentication. Session tokens are stored in secure, HTTP-only cookies and expire after a period of inactivity or when access is revoked.

You can update your account information or delete your account from the Account settings page in the dashboard. Account deletion removes your personal data and all associated workspaces, domains, and knowledge data, subject to any legal retention requirements.

Paid plans are being prepared for launch through Paddle. If live checkout is enabled, Paddle may process payments, subscriptions, applicable taxes, receipts, and commercial documents as checkout provider and, where applicable, merchant of record.

The ZENIA / buildbot.ro product does not collect or store your full card number, CVV, or full bank-account details.

From Paddle or the payment provider used at the relevant time, the product may receive and store:
• Customer, subscription, and transaction identifiers
• Subscription and payment status
• Payment confirmation, failure, cancellation, renewal, or refund outcomes
• References needed to activate your plan, enforce plan limits, and provide billing support

The product may store your selected plan, billing cycle (monthly or annual), subscription start date, renewal date, and payment status for account management and feature access enforcement.

VAT / applicable tax treatment and payment documents may be handled through Paddle depending on the final checkout configuration and the buyer’s jurisdiction.

When you create a chatbot and deploy the embedded chat widget, conversations between end-users and your chatbot are processed through ZENIA Assistant on buildbot.ro.

We process:
• Messages sent by end-users through the widget
• AI-generated responses based on your indexed knowledge
• Message timestamps, session identifiers, source references, and message counts

Conversation data is stored in your workspace and is accessible through the dashboard. It is used to deliver the chat functionality, support review of assistant behaviour, and enforce plan message limits.

End-users interacting with your embedded chatbot must be informed through your own privacy notice that their messages may be processed through ZENIA Assistant and related third-party AI providers used by the service. For content and conversations processed through the widget installed on your website, you may act as data controller toward your own visitors, while ZENIA may act as service provider / processor depending on the concrete configuration and applicable DPA.

ZENIA allows you to build knowledge bases by:
• Crawling website URLs that you submit
• Uploading files (PDF, DOCX, TXT, MD, XML) on paid plans
• Adding custom text entries

Crawled content and uploaded files are processed through our ingestion pipeline: text extraction, normalization, chunking, embedding, and vector storage. This data is used exclusively to power your chatbot’s responses.

You are responsible for ensuring you have the right to crawl and index the content you submit. We do not use your content to train models, share it with other users, or make it publicly accessible.

When you delete a knowledge source, all associated chunks, embeddings, and stored files are permanently removed.

For internal product improvement, we analyze aggregated, non-personally-identifiable usage patterns across the platform. This helps us understand which features are used, detect performance issues, and prioritize development.

We do not sell usage data to third parties. We do not use your knowledge base content or chat conversations for training AI models.

When you contact us for support, we collect and store your messages, any attached files, and metadata such as timestamps and your account identifier. This data is used solely to resolve your inquiry and improve our support processes.

Support logs are retained for a reasonable period to allow follow-up on recurring issues and to meet any legal record-keeping obligations. We do not share support communications with third parties except where required to resolve a technical issue involving a subprocessor.

We send the following types of emails:

• Transactional emails: account confirmation, password reset, billing receipts, plan change confirmations, subscription expiry warnings, and service alerts. These are sent as necessary to operate the Service and do not require separate consent.
• Marketing emails: product updates, feature announcements, and newsletters. These are sent only when you have explicitly opted in.

You can manage your email preferences from the Account settings page. You can unsubscribe from marketing emails at any time using the unsubscribe link included in every marketing message.

Unsubscribing from marketing emails does not affect transactional communications, which are essential for providing the Service.

We use cookies and similar technologies for the following purposes:

• Essential cookies: session authentication, CSRF protection, and language preference. These are strictly necessary to operate the Service and cannot be disabled.
• Optional usage cookies: if you consent, we may use limited usage statistics to understand how the dashboard is used.

The embedded chat widget uses only the cookies necessary for its operation (session management and CSRF protection).

For detailed information about the specific cookies we use, their purposes, and how to manage them, please see our Cookie Policy.

We share personal data with categories of service providers only as necessary to operate the Service:

• Infrastructure and hosting providers: application infrastructure, storage, and service delivery
• Database and storage technology providers: account data, workspace data, and knowledge base content
• Email delivery providers: transactional email delivery
• AI inference and embedding providers: prompt, context, and content necessary to generate responses and embeddings
• Paddle or other payment providers, after checkout activation: checkout, subscriptions, applicable taxes, receipts / commercial documents, and transaction status handling
• Operational monitoring or support providers, if enabled: error handling, service reliability, and customer support workflows

We require service providers to process data only for the purposes needed to operate the Service and to maintain appropriate security measures. We do not sell your personal data to any third party. The specific provider list is maintained on the Sub-processors page.

Your data is primarily intended to be stored and processed within the European Economic Area (EEA) or through providers offering appropriate data-protection safeguards.

Where a service provider may process data outside the EEA, appropriate transfer safeguards may be used, such as Standard Contractual Clauses, adequacy decisions where applicable, or other legally recognised mechanisms.

If you have questions about the specific transfer mechanisms in place, you may contact us at contact@buildbot.ro.

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account data: retained while your account is active and for up to 30 days after account deletion to allow recovery
• Knowledge base data (crawled content, uploaded files, embeddings): retained while the associated domain exists and deleted permanently when the source or domain is removed
• Chat conversations: retained while the associated workspace is active
• Billing / subscription records: retained according to applicable tax, commercial, and compliance obligations; where records are handled by Paddle, Paddle may apply its own retention periods
• Support communications: retained for up to 3 years after the last interaction
• Operational logs: retained for up to 90 days for security and debugging purposes
• Usage data: retained in aggregated form; individual session data is retained for up to 12 months

When data is no longer needed, it is permanently deleted or irreversibly anonymized.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your personal data, subject to legal retention obligations
• Right to restriction (Art. 18): request that we limit processing of your data in certain circumstances
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest, including profiling
• Right to withdraw consent (Art. 7(3)): withdraw consent for any processing based on consent at any time

To exercise any of these rights, contact us at contact@buildbot.ro. We will verify your identity before processing any request. You can also delete your account and associated data directly from the Account settings page.

If you believe that we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with a supervisory authority.

In Romania, the competent supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Website: www.dataprotection.ro

You may also lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence or place of work.

We encourage you to contact us first at contact@buildbot.ro so we can try to resolve your concern directly.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encrypted connections over HTTPS
• Password hashing and secure account authentication
• Secure, HTTP-only session cookies
• Role-based access controls within the application
• Access restrictions for administrative functions
• Input validation and protections against common abuse patterns
• Operational logging and security review where appropriate

No system is completely secure. If you discover a security vulnerability, please report it to contact@buildbot.ro so we can address it promptly.

To exercise your data protection rights or to ask questions about this privacy policy, contact us at:

• Product operator / data controller: Popescu Adrian Florin
• Product brand: ZENIA Assistant / buildbot.ro
• Email: contact@buildbot.ro
• Website: https://buildbot.ro

Please include your account email address so we can locate your data. We will verify your identity before processing any request and respond within one calendar month.

We may update this privacy policy from time to time to reflect changes in our practices, the Service, or applicable law.

When we make material changes, we will notify you by:
• Posting a notice in the dashboard
• Sending an email to the address associated with your account

The “Last updated” date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

Continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you do not agree with a change, you may close your account.