Privacy notice for merchants
This notice explains what data we collect about you as a merchant using Seyla, why, and how long we keep it. For your shop's buyers' data you are the controller and we are the processor under the data processing agreement.
1. Who we are
The controller is Rastezh Digital EOOD („РАСТЕЖ ДИДЖИТЪЛ“ ЕООД), UIC 208950483, VAT No. BG208950483, registered office bl. 10A, fl. 3, apt. 11, Hristo Smirnenski housing estate, Slatina district, 1574 Sofia, Bulgaria, represented by its manager Denis Emilov Davidov. For questions about personal data: zdravei@rastezh.bg.
2. What we collect
Account: email address and password. The password is kept only as a hash by our sign-in provider (Supabase); we never see it.
Shop: its address, platform, access keys (encrypted), catalogue and the agent's settings.
Company details for the statement, if you fill them in: company name, UIC, VAT number, address, contact person.
Security and evidence: when you accepted which version of the terms, and a hash of the network address you did it from (the address itself is not kept); sign-in and sign-up attempts, to limit abuse.
How you use the dashboard: when you signed in and the important actions (going live, changing settings), so you can see them in the history and we can find errors.
3. Why, and on what basis
To provide the service and perform our contract with you (Article 6(1)(b) GDPR).
For accounting and tax once billing is switched on (Article 6(1)(c)).
For security, preventing abuse and proving what you accepted (legitimate interest, Article 6(1)(f)).
We email you only about your account and the service: confirmation, a new password, changes to the terms. We send no advertising emails without separate consent.
4. Who else processes it
Supabase (database and sign-in, EU, Frankfurt), Cloudflare (application hosting), Amazon Web Services (Amazon SES, sending the emails, EU), Mistral AI (the agent's language model, EU). The full list of sub-processors is in annex 3 of the data processing agreement. Where a provider transfers data outside the EEA, it does so under the EU standard contractual clauses.
5. How long
Account and shop data: while you have an account. After you close it we delete it within 30 days, except accounting records we must keep by law.
Accepted versions of the terms: while you have an account and 5 years after, to prove the contract.
Sign-in and sign-up attempts: up to 2 days.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Write to zdravei@rastezh.bg. You may complain to the Commission for Personal Data Protection (www.cpdp.bg).
7. Changes
Every change is a new version with a new date. If a change is significant, we show it to you the next time you open the dashboard.