Privacy Policy

1. Controller

The controller is Vaklin Stoynovski (natural person), Burgas, Bulgaria, trading under the auwo brand. Contact for questions and to exercise your rights: audit@auwo.ai. We have not appointed a data protection officer, as one is not required for our type and scale of processing (Art. 37 GDPR).

2. Data we process

• Uploaded documents: invoices (PDF or photo) and the data read from them — supplier/customer, company ID, number, date, articles, quantities, prices, totals. Invoices can contain personal data of individuals (names, addresses, phone numbers, bank accounts).
• Price lists and order lists you upload, and details of your suppliers and customers (name, company ID, email for letters).
• Findings the Service creates when comparing, and what you did with them (dismissed, letter sent).
• Account: email and password (only an irreversible hash of the password is stored) and a session cookie. The company details you enter in Settings.
• Technical data: IP address, browser and device type, technical logs and error reports.

3. Purposes and legal bases

We do not use the content of your invoices for advertising, we do not sell it, and we make no automated decisions with legal effects on you. Letters to suppliers are sent only by you, from your own mailbox — the Service sends nothing on your behalf.

• Reading invoices, comparing them with agreed prices and showing the result — performance of a contract (Art. 6(1)(b) GDPR).
• Security, abuse protection and free-plan limits — legitimate interest (Art. 6(1)(f)).
• Fixing errors — legitimate interest.
• Paid-plan requests — your consent / pre-contractual steps at your request.
• A morning summary email to the address on your account — performance of a contract; switch it off in Settings.

4. How reading works

The file is sent through the Vercel AI Gateway to a Google (Gemini) model, which returns structured data. Under Google’s terms for its paid APIs, submitted content is not used to train models. The original file is kept with us so you can open it from the invoice page until you delete it.

5. Retention

• Invoices, lines, findings, price lists and order lists — until you delete them in the Service or delete your account.
• Account and company details — until you ask for deletion.
• After an account deletion request we delete the data within 30 days; hosting-provider backups are overwritten in their normal cycle.
• Technical logs — briefly, typically up to 30 days.

6. Recipients and processors

These providers process data on our behalf, under contract and only on our instructions:

• Vercel Inc. — hosting and AI Gateway.
• Google Ireland Limited / Google LLC — document reading (Gemini API).
• Railway Corp. — database.
• Resend, Inc. — sending the morning summary email (company names, invoice numbers and amounts of invoices with differences).

Some of them may process data in the United States. Transfers are protected by GDPR safeguards: certification under the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

7. Security

• Encryption in transit (HTTPS/TLS).
• Passwords are stored only as scrypt hashes; sessions only as a hash of the cookie. Each account sees only its own data; file access requires sign-in.
• Restricted access to the database.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and to object to processing based on legitimate interest. You can delete invoices, partners and lists yourself in the Service; for everything else write to audit@auwo.ai — we reply within one month.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or with the supervisory authority where you live.

9. Changes

We may update this policy. The current version and its date are always on this page.