Legal

Privacy Policy

Last updated: 2026-11-08

Draft - to be reviewed before launch.

1. Controller

GSM Solutions, [legal name, address], Serbia, is the controller for your account data. Contact: support@gsm.rs.

2. What we collect

• Account: name, email, password (hashed), language, the domains you add.
• Billing: handled by Paddle.com; we receive your plan, payment status and invoice numbers, never your card details.
• Service data: the AI provider keys you enter (stored encrypted), plugin version and connection status of your sites.
• Technical: IP address and browser data in server logs, kept for security for up to 30 days.
• Your AI key: to answer your visitors, your website sends your own AI provider key to our service with each chat message; it is used only for that call to your AI provider and is never stored or logged.
• Security and fraud prevention: failed logins, blocked attempts, signals that point to misuse of the account or the dashboard (Terms, section 8a). Kept while the account exists and up to 2 years after it is closed for misuse.

3. Your website visitors

When the chat runs through the hub, conversations of your visitors are processed on your behalf; for that data you are the controller and we are the processor. The chat only starts after the visitor has accepted your site's privacy notice, and conversations are deleted on your request.

4. Why and on what basis

To provide the Service (contract), to bill (contract, legal obligation), to secure the Service and prevent trial abuse (legitimate interest). For trial abuse prevention we keep a one-way hash of the domain and email that used a trial, also after the account is deleted.

5. Who receives data

Paddle.com (payments), our hosting provider in the EU, the email delivery service, and the AI provider you connect yourself. We do not sell data.

6. Retention

Account data is kept while the account exists. Unpaid accounts are deleted 90 days after suspension. Invoices are kept as required by law.

7. Your rights

Access, correction, deletion, restriction, portability and objection; complaints can be filed with the Commissioner for Information of Public Importance and Personal Data Protection (Serbia) or your local authority.

8. Cookies

We use only necessary cookies (session, security, language). The theme choice is stored in your browser.