Privacy Policy
How DOBG Ltd. processes personal data in ood.bg under the GDPR.
Effective from 31 October 2026. This policy describes how we process personal data when you use the ood.bg website, the ood.bg web application, the demo, the API and the MCP server, and when you communicate with us — in accordance with Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act.
1. Who the controller is
1.1. The controller of personal data is DOBG Ltd. („ДО БГ“ ЕООД), UIC 148050836, with its seat in Varna (hereinafter "we" or "the Operator"). For all questions about personal data: [email protected].
1.2. We have not appointed a data protection officer, as our activities do not fall within the cases under Art. 37 GDPR. Requests under this policy are handled by a responsible person at the Operator.
2. Two roles: controller and processor
2.1. We are the controller of the data of the Account, of plan payments, of the security of the Platform, of the website, of the demo and of communication with us. This policy applies to that data.
2.2. We are a processor of the data that companies enter in the Platform about their partners, customers, suppliers, employees and other persons (for example in documents, partner records and scanned files). The controller of that data is the company concerned. We process it only on its instructions, under the agreement under Art. 28 GDPR in Annex 1 to the General Terms. If you are a partner of a company that uses ood.bg and want to exercise your rights, contact that company; we will assist it.
3. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account — name, email, password (hash only), phone number and photo (optional), language and settings | registration, sign-in, use of the Services | performance of a contract — Art. 6, para. 1, point (b) |
| Sign-in with Google or Facebook — name, email and identifier from the account concerned | sign-in without a password, at your choice | performance of a contract — Art. 6, para. 1, point (b) |
| Two-factor authentication and passkeys — secret keys (encrypted), passkey public keys, backup codes (hashed) | protection of the Account | performance of a contract and legitimate interest in security — points (b) and (f) |
| Companies — name, UIC, VAT No., address, materially responsible person (MOL), bank accounts, logo, team roles and permissions | working with companies in the Platform | performance of a contract — point (b) |
| Plan payments — plan, period, amounts, VAT, status, invoices; card details are processed only by Stripe | payment, invoicing, accounting | contract — point (b); legal obligation (Value Added Tax Act, Accountancy Act) — point (c) |
| Security and logs — IP address, browser, date and time of sign-in, active sessions, log of actions in the company, failed sign-in attempts | security, prevention of abuse, evidence in the event of a dispute | legitimate interest — point (f) |
| AI assistant D.O.B.I. — your questions, the answers and the company data used | answers and drafts at your request | performance of a contract — point (b) |
| Public links to documents — access with a code, date, time, IP address, code signature | secure access for the recipient, proof of receipt and signature | legitimate interest of the company and of the Operator — point (f) |
| Communication — enquiries, feedback, correspondence | replying and improving the Services | legitimate interest — point (f); contract — point (b) |
| Demo — the email address to which you request a link, and whether you have consented to an email after the demo | sending the link; one email after the demo | legitimate interest — point (f); consent — point (a) |
| Marketing — email, preferences | news about ood.bg products and services | consent — point (a) (you can withdraw it at any time) |
| Website — technical server logs (IP address, date and time, requested URL, browser) | operation and security of the site | legitimate interest — point (f) |
3.1. We receive the data from you, from the team members who invite you, from Google or Facebook (if you choose that sign-in method), from Stripe (payment status) and from the European Commission's public VIES register (company data by VAT number).
3.2. Providing the Account and payment data is necessary to conclude and perform the contract. Without it we cannot provide the Services. Providing other data is up to you.
4. The AI assistant D.O.B.I.
4.1. When you ask D.O.B.I. a question, the Platform extracts from the selected company's data only what is needed for the answer, within your permissions, and sends it to an AI model provider to generate the answer.
4.2. Data containing personal information is sent only to providers with which we have a data processing agreement and which, under that agreement, do not use data submitted via the API to train their models (currently OpenAI, Google and Anthropic). We do not use your data to train AI models either.
4.3. The history of conversations with D.O.B.I. is kept for 90 days and is then deleted automatically. The company's Owner can switch off the AI features.
4.4. D.O.B.I. does not make decisions for you: every sending, issuing, payment or change requires your "Approve". We do not make decisions based solely on automated processing that produce legal effects concerning you or significantly affect you (Art. 22 GDPR).
5. Recipients and sub-processors
5.1. Hosting. The Platform's data is stored and processed on the Operator's own servers in the European Union. Backups are encrypted before they leave the server; when they are stored with an external provider, that provider has no access to their content.
5.2. We share data, only to the extent necessary, with:
- Stripe — processing plan payments (card details, amount, email);
- OpenAI, Google and Anthropic (Claude) — generating D.O.B.I.'s answers (see section 4), only when you use the AI features;
- Google and Meta (Facebook) — only if you choose to sign in with the account concerned;
- Cloudflare — protecting the registration form from bots (Turnstile): technical information about the browser and the IP address;
- email delivery service providers — sending documents, notifications and system messages;
- the European Commission (VIES) — checking the VAT numbers you enter;
- payment service providers chosen by the company (for example ePay.bg, Paysera, PayPal, Stripe) — when a recipient pays a document online;
- recipients you specify — for example the customers to whom you send documents;
- public authorities — where we are required to by law (for example the National Revenue Agency (NRA), a court, the prosecutor's office), and only on a legal basis;
- the Operator's accountants, lawyers and auditors — subject to a duty of confidentiality.
5.3. We do not sell personal data and do not provide it to third parties for advertising.
6. Transfers outside the European Economic Area
Some of the providers listed in section 5.2 (for example Stripe, OpenAI, Google, Anthropic, Meta, Cloudflare) may process data in the USA or other third countries. In such cases, the transfer is based on the European Commission's adequacy decision under the EU–US Data Privacy Framework (for certified companies) or on standard contractual clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), with supplementary measures where needed. You can request information about the applicable safeguards at [email protected].
7. Retention periods
| Data | Period |
|---|---|
| Account and companies | while the Account is active; on a deletion request — deletion within 30 days |
| Company documents and data | while the company exists in the Platform and for at least 30 days after termination, for download; the company is responsible for its own statutory retention periods |
| Invoices and accounting data for plan payments | for the periods required by the Accountancy Act and tax legislation (up to 10 years) |
| Security and activity logs | for as long as necessary for security and for proving actions, but no longer than 5 years after the Account was last used |
| History of conversations with D.O.B.I. | 90 days |
| Demo — email without consent | 30 days; with consent — 12 months or until you unsubscribe |
| Marketing consent | until it is withdrawn |
| Website technical logs | a short time, usually up to 30 days |
| Backups | deletion takes effect at their next rotation |
When the period expires, the data is deleted or anonymised, unless the law requires longer retention or the data is needed for protection in a legal dispute — in that case, only for as long as the need lasts.
8. Your rights
You have the right to:
- access — to obtain confirmation and a copy of your data (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure — the "right to be forgotten" (Art. 17);
- restriction of processing (Art. 18);
- portability — to receive your data in a structured, machine-readable format or to have it transferred to another controller (Art. 20);
- object to processing based on legitimate interest, and to direct marketing at any time and without giving reasons (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal (Art. 7, para. 3);
- lodge a complaint with the Commission for Personal Data Protection (CPDP) or with the court (Art. 77 and 79).
You can exercise most of these rights yourself from the "Profile" page — correction, data download (JSON), deletion request, notifications. For anything else, write to [email protected]. We respond without undue delay and at the latest within one month; for complex or numerous requests, this period may be extended by a further two months, in which case we will let you know. Exercising your rights is free of charge. We may ask for additional information to confirm your identity.
9. Security
We apply appropriate technical and organisational measures: encrypted connection (TLS), encryption of sensitive data, password hashing, two-factor authentication and passkeys, isolation of each company's data at database level, role-based access control, an activity log, encrypted backups and regular review of the measures. Details are on the Security page.
In the event of a personal data breach, we notify the Commission for Personal Data Protection within 72 hours, and the affected persons without undue delay where the breach poses a high risk to their rights (Art. 33 and 34 GDPR).
10. Children
The Services are intended for businesses and professionals and are not directed at persons under 18. We do not knowingly collect children's data. If you believe that a child has provided us with data, write to us and we will delete it.
11. Cookies
The ood.bg website does not use advertising or tracking cookies. The application uses only necessary cookies for sign-in, security and language. Details are in the Cookie Policy.
12. Changes
We may update this policy in the event of changes in the Services, in our providers or in legislation. We notify registered users of material changes by email or in the Platform before they take effect. The date of the current version is stated at the top.
13. Supervisory authority
Commission for Personal Data Protection (CPDP) — 1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd., tel. 02 91 53 518, [email protected], cpdp.bg.
If you reside in another EU country, you can also lodge a complaint with the supervisory authority there.