Personal data policy

The controller is the owner of the safzir service, operating on the domains safzir.com and safzir.online. Enquiries about data processing are accepted at support@safzir.online.

When the registration form is filled in, the following is stored: e-mail address, first and last name, company name, country, phone number, expected number of employees, selected modules, and a comment if one is left.

Alongside the application, technical details are stored automatically: the IP address of the request, the browser string (User-Agent), the page the visitor came from, campaign tags (UTM), and the country and city derived from the IP address.

The password itself is not stored. Only an irreversible hash is kept, from which the original password cannot be recovered.

The record of acceptance of the terms and of this policy is stored together with the date, time and document version.

Data the customer enters into the system — about their employees, buyers, suppliers and documents — is processed by the operator on the customer instruction and solely to run the service.

For that data the controller is the customer: they determine purposes and retention, while the service acts as a processor.

Actions in the system are written to an audit log: who changed which record and when. The log is used to investigate disputes and is protected against backdating.

Contact details — to review the application, get in touch about the account and send notices about the end of the grace period.

Technical details — to tell genuine applications from automated ones, limit the rate of requests, and understand which channel the customer came from.

Company details — to select a plan and a set of modules.

An application whose e-mail address has not been confirmed is deleted after 14 days, together with the IP address, geodata and password hash.

A rejected application is deleted 30 days after rejection.

An approved application is kept for as long as the organization created from it exists.

After an organization is closed its data is kept so that the customer can take an export. There is no automatic deletion: data is deleted on the written request of the customer sent to support@safzir.online, within the period given in section 7.

Audit log records are kept separately and for longer — they are needed as evidence of actions in disputes.

Requests to AI features — the brief for building a website or a till layout — are kept together with the result for as long as the organization exists. Conversations with the AI assistant are not stored on the server; only the system functions it calls are recorded in the audit log.

Data is not sold and is not passed to third parties for advertising.

Data is processed and stored on servers rented by the operator from the hosting provider Hetzner. Traffic between browser and server is encrypted.

Service mail — sign-up confirmation, invitations, invoices, notifications — is sent from the operator mail server and travels through the networks of the recipient mail provider.

AI features — the assistant, website building, till layout — work through an artificial intelligence provider that the customer chooses, together with an access key, in the settings of its organization: Anthropic, OpenAI, Google (Gemini) or DeepSeek. When an AI feature is used, the provider receives the user question and the organization data needed to answer it; this data may include personal data — for example names and contacts of counterparties, employees or guests. Questions to BI reports asked in words are processed by a provider connected by the operator, if the operator has enabled this feature. If the customer does not use AI features, the data of its organization is not passed to AI providers.

Cloudflare serves the domain records of the service and, at sign-up, checks that the application is filed by a person and not a program — for this it receives the IP address and browser details. Google delivers the website fonts and the rendering component of the web application — when they load, Google receives the IP address and browser details of the visitor.

Subscription payments go through the acquiring bank: card details are entered on the bank page and are not passed to the operator.

Mailboxes, banks and the tax service that the customer connects to its organization itself receive data on behalf of the customer.

You may request what information about you is stored, ask for it to be corrected or deleted, and withdraw your consent to processing.

Withdrawing consent means the application is deleted and, if an organization has already been created, that the service stops — it cannot operate without this information.

Requests are sent to support@safzir.online and answered within 30 days.

Passwords are stored as an irreversible hash, connections are encrypted, and operator staff access to customer data is limited and logged.

Different customers data is separated: one customer queries cannot return another customer records.

The site uses no third-party advertising or analytics trackers.

Campaign tags (UTM) and the referring address are kept in browser session storage for the duration of the visit, so that they are not lost when moving between pages and reach the application. They are removed when the tab is closed.

The application at safzir.online uses cookies that are necessary for signing in and keeping the session.

A new version is published on this page with its date. The version accepted by the customer is stored with their application.