Privacy policy
Who is responsible for your data
The data controller is Hercegovac, Mirza, a sole trader, Kvannegatan 18 lgh 1103, 256 67 Helsingborg, Sweden. The full company registration number is stated in the customer agreement and invoice. If you have questions, feel free to contact us at kontakt@zaai.se.
What we collect
We only process data that you choose to share with us:
- Name and contact details when you book a meeting
- What you write to us, whether via chat or email
How the data is used
We need this data to handle your booking, prepare for the meeting, answer your questions and get back to you about our services.
The chat assistant saves the conversation so it can reply in context and so we can improve the service. If you describe a need, the assistant may put together a summary for us, but that summary and the conversation are only passed on to our team if you say yes yourself and leave your contact details. We also get a simple notification that someone has used the chat, so we know a visitor has been here. That notification contains no contact details unless you provided them.
Your login details and connected accounts
In the Client Portal you can connect your own accounts, for example Google or Microsoft, so your automations can do what you've asked them to. Here's how it works:
We use OAuth wherever possible. You approve the connection with the provider yourself, in their own login box. Your password is entered with them and never passes through us. We never see it, and we never store it.
Access is exchanged and stored on our server. The token we receive from the provider is fetched server-side and stored encrypted in Google Secret Manager. It is never sent to your browser and never shown in the portal, either to you or to us.
Permissions are locked in advance. Every connection is bound to a permission level declared before you approve it. The scope cannot be quietly extended afterwards; any extension requires you to approve the connection again.
You can disconnect at any time. The portal only shows the action as complete once the backend has verified the disconnection. If the provider's revocation fails, the connection is left with an error status so it can be handled safely.
We log security events. Access logs contain metadata for traceability, not raw emails, attachments, prompts or tokens. Retention periods are governed by verified production policies; we do not state an automatic deletion deadline until it is technically enabled and checked.
We ask before the first connection. Before you can connect an account, we ask for your consent in the portal. The time of approval is logged using our server's clock, together with which version of the terms you approved.
Providers and data transfers
To run the site and the chat, we use external services that process data on our behalf. The chat currently runs on OpenAI, and bookings are handled via Google Calendar. Some of these providers process data outside the EU and EEA. Where that happens, we make sure the transfer is protected, either through the EU-US Data Privacy Framework or through standard contractual clauses. Your data is never sold and is not passed on for marketing purposes.
Retention
We keep data for as long as it's needed for the stated purpose, agreement or legal obligation. Operational closure, backups and legal retention duties can run on different timelines. When an exact retention period can't be verified, the portal shows this openly rather than stating a made-up deletion date.
Your rights
You have the right to request access, correction, data portability, restriction, deletion, and to object to processing. Portal customers use the privacy centre. If you cannot log in, use the public request page, which does not accept sensitive free text. You can also contact kontakt@zaai.se.
For the portal's more detailed processing, account connections and AI workflows, the Client Portal's privacy policy.