Zovanion provides AI-assisted business documents, standard operating procedures (SOPs), policies and meeting summaries. This notice explains how we handle personal data under the EU General Data Protection Regulation (GDPR).
1. Who is responsible?
Zovanion is operated by Gregor Škof, Slovenia, European Union. For privacy requests, email info@zovanion.com.
We act as controller for website visits, accounts, service security and enquiries. When a business customer provides personal data in documents for its own purposes, that customer will normally be the controller and Zovanion its processor. Such processing requires appropriate data-processing terms. If your information appears in a customer's documents, contact that customer to exercise your rights; we will assist it as required.
2. Data we process and why
We process the following information, depending on your use of Zovanion:
- Account data: email address, password hash, account settings, access rights and subscription or usage information, to provide your account (contract; GDPR Article 6(1)(b)).
- Work content: prompts, uploaded or entered text, document filenames, meeting notes or transcripts, generated documents, revisions and history, to deliver and save requested services (contract or the business controller's instructions).
- Technical data: session tokens, device or connection details and IP addresses processed by hosting or security services, to prevent misuse, protect accounts and maintain the service (legitimate interests; GDPR Article 6(1)(f)).
- Correspondence: information sent to us, to provide support and handle legal requests (contract, legitimate interests or legal obligation; GDPR Article 6(1)(b), (f) or (c)).
Data comes from you, your organisation, your use of the platform or infrastructure records. Account details are needed to use account-based features; without the relevant document or instructions, an AI request cannot be completed. Do not submit personal or confidential information you are not authorised to provide. Special-category data may require additional legal safeguards.
3. AI and uploaded documents
When you use an AI feature, Zovanion's backend processes your request. For uploaded files, it extracts readable text and sends relevant text, instructions and/or meeting content to Anthropic's Claude API to generate a result. This is an external AI service, not a model running solely on Zovanion servers. Generated results and certain inputs or metadata are stored in your account history. Temporary uploaded working files are deleted after request processing; saved records depend on the feature used.
We do not sell customer documents or use them to train our own AI models. According to Anthropic's commercial-data policy, API inputs and outputs are not used for model training by default, subject to applicable exceptions and choices. Anthropic's standard API retention is generally up to 30 days, with exceptions for particular services, abuse prevention, legal requirements or other agreements. Zero retention and EU-only AI processing are not promised. Review AI outputs before relying on them.
4. Service providers and transfers
We use these providers for the specified purposes; only information relevant to their services is involved:
- Anthropic — AI requests and responses.
- Railway — backend, application database and temporary file processing; our production backend and volume are configured in an EU region.
- Vercel — frontend hosting, content delivery and associated request data.
- Google Fonts / Google — optional font delivery after you expressly accept it; browser requests for fonts can disclose IP address and device information to Google.
- OVHcloud — domain and email infrastructure, including messages sent to our contact address.
Authorised advisers or public authorities may receive data where legally necessary. Some providers or their subprocessors may access data outside the European Economic Area, including in the United States. Depending on the transfer, safeguards include the European Commission's standard contractual clauses or an applicable adequacy decision. See the published data-processing terms of Anthropic, Railway and Vercel. Ask us at info@zovanion.com about the mechanisms applicable to your data and how to obtain available safeguards. Business customers can also request subprocessor information.
5. Storage, security and deletion
Account data and saved work are held while your account is active or until you delete the relevant items. Account deletion removes associated records from the live application database; residual backups, provider records and logs are deleted according to the applicable technical retention schedules or legal obligations. Temporary uploaded working files are deleted after processing. Anthropic retains API data according to the terms linked above. Support and security records are retained only as long as needed for their purpose or applicable obligations.
We use HTTPS, hashed passwords, access controls and rate limits to help protect data. No internet service can guarantee absolute security. We do not use AI-generated documents to make solely automated decisions with legal or similarly significant effects on individuals.
6. Browser storage and external fonts
The application uses localStorage for a login token (normally valid for 30 days), theme settings and your optional-font preference. It does not use advertising or behavioural-tracking cookies. Across the landing page and application, Google-hosted fonts are not requested before you consent, and are not requested if you reject them. If you accept optional font delivery, your browser requests the font stylesheets and files from Google, potentially disclosing your IP address and device information. Without consent, system fonts are used and the site's functionality remains available. Your choice is saved in this browser for future visits on the same website origin. You can change or withdraw your font preference at any time; rejecting stops further optional font requests from future page loads. Browser storage can be cleared in your browser settings; removing the login token signs you out.
7. Your GDPR rights
Subject to legal conditions, you may request access, correction, erasure, restriction, portability and objection, and withdraw consent where consent is used. You also have rights relating to qualifying solely automated decisions. Email info@zovanion.com. We ordinarily respond within one month, subject to legally permitted extensions, and may verify your identity. The service also offers account export and deletion options.
You may complain to the Slovenian Information Commissioner or another competent EU supervisory authority. You do not need to contact us first.
8. Updates and contact
We update this notice when our data practices change and provide further notice or seek consent where required. For questions or requests, contact info@zovanion.com.
Privacy contact
info@zovanion.com · Slovenia, European Union