Privacy Policy.

Controller: Nephworx Ltd., EIK 207138187, VAT BG207138187, registered seat: 51 Cherni Vrah Blvd., Hladilnika Industrial Zone, Lozenets District, 1407 Sofia, Bulgaria.

Where an organization uses the Platform to invoice its own clients, we process those clients' data on the organization's behalf as a data processor. The terms for that processing are set out in our Data Processing Agreement.

For questions about personal data, write to contact@smetni.app.

On registration: email, name, password (hashed), language and time zone.

On entry: clients, invoices, templates, EIK, bank details: everything you actively enter into the platform.

Automatically: IP address, browser type, time and pages visited, events within the platform (for support and analysis).

On payment: the first 4 and last 4 digits of the card, cardholder name, validity period. Full card data is processed directly by Stripe.

• To provide the service (issuing invoices, sending emails, support). Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
• To meet legal obligations (accounting and tax documentation, responding to lawful requests). Legal basis: Art. 6(1)(c) GDPR.
• To improve the product (anonymised usage analysis) and for security and abuse prevention. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
• For marketing communication, only if you have given explicit consent. Legal basis: consent, Art. 6(1)(a) GDPR.

We do not carry out automated individual decision-making, including profiling, that produces legal effects concerning you.

With our technology providers, all under signed DPAs. A full list is available in our list of sub-processors.

With competent public authorities where the law requires.

We never sell personal data and never share it with third parties for marketing purposes.

• While you have an active account: for the whole period.
• After termination: 24 months for legal retention, after which data is irreversibly erased.
• Financial documents (invoices, payments): 10 years, under Bulgarian accounting law.
• Logs and anonymised analytics: 12 months.

• Right of access: to receive a copy of your personal data.
• Right to rectification: to correct inaccuracies.
• Right to erasure (“right to be forgotten”), except where the law requires retention.
• Right to portability: export in a machine-readable format.
• Right to object to certain types of processing.
• Right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.

You can exercise any of these rights from Settings → Privacy, or by writing to contact@smetni.app.

If you believe we process your personal data unlawfully, you also have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg.

• AES-256 encryption at rest and in transit (TLS 1.3).
• Product data is hosted in the EU (AWS, Frankfurt). Certain providers process limited data outside the EU under the safeguards of Chapter V GDPR: see the list of sub-processors.
• Two-factor authentication (2FA) available for all accounts.
• Our team’s access is audited and limited to what the service requires.

Read more about our measures on the security page.

We use cookies for functionality (keeping your session, preferences) and for anonymised analysis. Details in our Cookie Policy.

For material changes we will notify you by email and within the Platform with at least 14 days’ notice. Minor changes (stylistic, technical) are published without separate notice.