Privacy Policy

This is an English translation provided for convenience. The Bulgarian version is the legally binding text; if the two differ, the Bulgarian version applies.

This Privacy Policy explains how we collect, use and protect your information when you use our AI legal assistant, Pravko.bg.

What information we collect

Public records are available without registration. Sending a question to the assistant needs you to sign in. If you decide to create an account (through Google or email), we store your email address and your chat history. We may store the requests and questions you send to our assistant, to improve the service.

How we use the information

We use the information we collect to:

• Improve the accuracy and usefulness of our AI assistant
• Analyse how the service is used and improve the user experience

Use of third-party services

To run Pravko.bg we use the following third-party services:

• OpenAI, for the AI language models that write the chat answers and documents
• Google, for the language models that understand the question, prepare the search, rank the sources found and suggest follow-up questions, and as a fallback model if OpenAI has a temporary fault
• Hetzner, for our server in Germany, where the legal sources are searched
• Supabase, for authentication and storing user accounts and chat history
• Vercel Analytics, for anonymous visit statistics, without personal information
• PostHog, for analytics on how the service is used. Once you sign in, events may be linked to your account

Sharing information

We do not share your information with third parties, except where this is necessary to run the service. Your questions, attached documents and the sources the answer is based on are processed by OpenAI and Google as part of the language models. For semantic search, the text of the question is turned into a numeric vector by an OpenAI or Google model, and the search itself, over the legal sources, runs on our server in Germany (Hetzner). OpenAI and Google do not use the data to train their models, but may keep it for a short period to detect abuse of their services.

OpenAI and Google may also process the data outside the European Union. This happens under the protections required by the General Data Protection Regulation (GDPR): a European Commission adequacy decision or standard contractual clauses.

Protecting the information

We take reasonable technical and organisational measures to protect the information from unauthorised access, loss or misuse.

Changes to this Privacy Policy

This policy may be updated when the way the service works changes, including future collection of information or the introduction of user identification systems. We recommend you review this page from time to time.

Documents you attach

Once you sign in, you can attach a document to the chat: a contract, a letter, a court act, a notice or a photo. We use it only to answer your questions about it, calculate deadlines and write the document you ask for.

The original file is kept only until it has been read, then deleted. We keep the extracted text and a short description of the document (kind, dates, amounts) linked to the conversation, so you can continue later. The text is deleted together with the conversation, or as soon as you remove the document from its preview. Attached but unsent files are deleted after 24 hours. Documents are not shown when a conversation is shared, and are not used for other users.

To be read and understood, the text (and, for a photo or a scanned document, the image too) is processed by the language model providers: OpenAI and Google. Documents often contain personal data, for example names, personal identification numbers (ЕГН) and addresses. Attach only documents you have the right to share, and where you can, hide data that is not needed for the question. We do not send file names, text or data from documents in analytics events.

Public company records

The company directory shows limited public data from the Registry Agency and the VAT bulletin of the National Revenue Agency (НАП). The aim is for visitors to recognise the company and check who represents it before a deal. Where these fields hold the names of individuals, they are shown only in their official capacity. We do not publish personal identification numbers, signatures, personal contact details or home addresses.

Pravko uses this limited data because visitors have an interest in checking their counterparties, and to maintain a useful company directory. We do not build profiles of individuals or reliability scores. The data is checked periodically, and every record shows its date and source. Old names are not kept in the public history of changes.

When you ask the assistant a question after signing in, the company’s ID number (ЕИК) and its limited record may be used as context. We measure visits, opening the source, questions started and questions sent, to understand whether the pages are useful. For this statistic we do not include the text of the question in company page events. Events after sign-in may be linked to the account.

To access, correct, object to, restrict or delete personal data, write to admin@pravko.bg and name the company’s ID number (ЕИК) and the relevant field. We review the request on its own facts. You can also file a complaint with the Commission for Personal Data Protection (CPDP).

API and connected apps

When you connect Pravko to ChatGPT, Claude or another app, or create an API key, we keep: the app’s name and when it was connected; keys and sign-in tokens only as an irreversible fingerprint (a hash), never the values themselves; for each request, its kind, time and result, without the text of the search. These records are used to track requests, guard against abuse and compile usage statistics. Connected apps and keys can be seen and stopped in your profile, under “ChatGPT, Claude and API”.

The searches apps send are processed to find the sources, including by OpenAI or Google, which turn the search text into a numeric vector for semantic search; the search itself runs on our server in Germany. Pravko does not write answers or documents through the API. The hosting’s technical logs are kept briefly. The app you use also processes the data under its own rules: read them in ChatGPT, Claude or the relevant provider.

In a team, the owner sees members’ email addresses and the team’s total request usage, but not their individual searches. Payments are processed by Stripe.

Cookies

Cookies are small files the site saves in your browser. We use the browser’s local storage for the same purposes. On your first visit, we ask whether you accept statistics cookies. Necessary cookies work without consent, because without them the service you asked for does not work.

Necessary

• Sign-in (sb-…-auth-token): keeps you signed in to your account until you sign out.
• Chat before sign-in (pravko_anon_sid): links a chat started before you sign in with your account once you do. 12 months.
• Your choice (pravko_consent): remembers whether you accept statistics cookies. 12 months.
• Browser settings (local storage): theme, answer style, chosen sources, open tabs in the chat and unfinished drafts. These stay until you delete them.

Statistics, only with your consent

• PostHog (cookie ph_…_posthog and an entry in local storage): recognises your browser between visits, so we can see which pages and buttons help. 12 months. We do not send the text of questions and documents. Once you sign in, events may be linked to your account. The data is processed by PostHog and may reach servers outside the European Union, including the United States, under the protections required by the General Data Protection Regulation (GDPR): a European Commission adequacy decision or standard contractual clauses.

Temporary test

While we compare two versions of the home page, the cookie pravko_home_exp remembers which version we show you, so you keep seeing the same one. It holds no data about you and sends nothing. We remove it once the test ends; otherwise it expires after 60 days.

If you decline, PostHog only counts visits, with no cookies and no entry in your browser. Instead of an identifier, PostHog’s server uses a fingerprint that changes every day, and visits are not linked to your account. Vercel Analytics counts visits without cookies. Payments happen on Stripe’s own page, which uses its own cookies.

You can change your choice at any time from “Cookies” in the menu or at the bottom of the page, or here: Cookie settings. You can also delete cookies from your browser’s own settings.

Contact us

If you have questions about this Privacy Policy, you can contact us by email: admin@pravko.bg.

Last updated: 31 October 2026