LEGAL INFORMATION
Privacy policy
What personal data Alphabite processes from enquiries, the chat, programme applications and visits to alphabite.io, why, and what your rights are. Last updated: 25 September 2026.
Who is responsible for your data
The controller of the personal data we collect through alphabite.io is VACHEV ENGINEERING EOOD („ВАЧЕВ ИНЖЕНЕРИНГ“ ЕООД), which works under the Alphabite brand. If you have questions about your personal data, write to info@alphabite.io. This policy explains what data we process, why and on what legal basis, who we share it with and how long we keep it. You are not obliged to give us any data, but without the required fields we cannot reply to an enquiry or review an application.
Enquiries through the contact form
The form asks for your name, email address, business stage and a description of your project; a phone number and a website or social profile are optional. We also record the language, the page you send the enquiry from and the time it was sent. We use this information to reply to you and to discuss a possible project with you. The checkbox on the form records that you ask us to use your details to reply to your enquiry; the legal basis for the processing remains taking steps at your request before entering into a contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR). The enquiry is saved in our database and sent by email to info@alphabite.io so that our team can see it. The form does not sign you up for a newsletter or add you to the brand development programme.
The chat with the AI assistant and our team
When you open the chat, we create a conversation that stores your messages and the replies, the language, the page you opened it on and its status. While the AI assistant is replying, the messages in the conversation, including any details you have written in them, are sent to OpenAI to generate a reply. The Alphabite team can read conversations, see whether your chat is open at the moment and take over, at which point the AI stops replying. If you leave contact details in the chat form (name, phone number, email address and a short note), they are saved in the conversation and our team uses them to contact you the way you chose; if you then keep chatting with the AI assistant, they are sent to OpenAI along with the other messages. Opening the chat does not send an enquiry: the assistant can only prepare a draft, which you check and send yourself. The legal basis is taking steps at your request before a possible contract (Article 6(1)(b) GDPR) and, for general questions, our legitimate interest in answering visitors (Article 6(1)(f)). If you would rather not use AI, use the enquiry form or write to info@alphabite.io.
Applications to the brand development programme
The application form asks for your store’s stage and a phone number; the brand name, email address and store address are optional. If you apply through the chat, you also send your name, your products and a description of the project. With the application we record where you came from (the campaign parameters in the link and the website that referred you), your device type and whether you allowed advertising measurement. If you give an email address, we send you a confirmation with a personal link, valid for 30 days, where you can confirm the address and answer further questions about your products, customers, orders and needs. On that personal page we record technical events such as opening, saving and errors, which do not include your answers, to find problems with the form (our legitimate interest, Article 6(1)(f) GDPR). Our team reviews applications, keeps notes and ratings, records its contacts with you and, if needed, corrects a mistyped email address or phone number, while the original application stays unchanged. The checkbox on the form records that you ask us to use your details to review your application and contact you; the legal basis for the processing remains taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
Research into public information about your store
When an application or a contact we add by hand includes a website or store address, we may collect public information about the business to prepare for our conversation with you: the text of the website’s public pages, estimates of its search visibility, speed test results with screenshots of its pages and public data from its Instagram profile. For this, the website address or Instagram profile is sent to providers of such data (DataForSEO, Google PageSpeed Insights and Instagram). Our team may also look up the business’s public Google Business Profile by its name. An OpenAI model prepares an internal overview and a design review from the website and Instagram information and from your answers about your products, stage, platform and needs. The model is not sent the email address or phone number from your application or contact record, or our internal notes. The overview and scores only support our team, which decides whether an application is selected. The legal basis is our legitimate interest in learning about a business from public information before talking to it (Article 6(1)(f) GDPR). You can object to this research at any time by writing to us.
Contacts we add by hand
If you contact us by phone, by email, with a message on Instagram, Facebook, WhatsApp or Viber, through the chat on our website, at an event, or through a partner or someone who recommended you, we may enter your details in the same system as applications: the brand name, your name, email address, phone number, website, products, a short description, where the contact came from and which team member added it. We do not send automatic emails to these contacts. The data comes from you, from the person or partner who recommended you, or from public sources. The legal basis is taking steps at your request before a possible contract (Article 6(1)(b) GDPR) when you contacted us, or our legitimate interest in contacting you about a possible collaboration (Article 6(1)(f)) when someone else gave us your details.
Security and abuse prevention
The website is delivered through Cloudflare, which processes your IP address and the technical details of each request to protect the website from attacks and load it quickly. The forms and the chat use Cloudflare Turnstile, a browser check that tells people apart from automated programs. We limit the number of enquiries and applications from one email address or phone number and the number of new chat sessions from one IP address. For this limit we keep the IP address only temporarily in the server’s memory and do not save it in our database. When you open an address without a language, we use the country Cloudflare determines from your IP address and your browser’s language settings to show you a suitable language. The legal basis is our legitimate interest in keeping the website and data secure and showing the website in a suitable language (Article 6(1)(f) GDPR).
Analytics and advertising, only with your consent
If you accept analytics cookies, we use Google Tag Manager, Google Analytics and Microsoft Clarity to understand how the website is used. These tools collect data about your visit, such as the pages you view, where you came from, your device and browser and your approximate location. Clarity records visits (clicks, scrolling and movement on the page), with form fields and the chat hidden in the recordings. On the brand development programme page, if you allow advertising measurement and personalisation, advertising pixels (Meta’s and, when we advertise there, TikTok’s and Google Ads’) measure which ads lead to visits and applications and are used to personalise the ads you see. GA and Clarity events contain technical values such as form steps, error codes and random application IDs, never your contact details or written answers. If you consent to advertising measurement when submitting an application, we also send Meta a server-side Lead event. It includes the application ID and time, the page address, browser information, available Meta browser and ad-click identifiers, and SHA-256 hashes of your phone number and optional email address for matching. Hashing does not make this data anonymous. We do not send the content of your application to Meta. This delivery retries independently if Meta is unavailable; applications without advertising consent are not sent. The legal basis is your consent (Article 6(1)(a) GDPR). You can change or withdraw your consent at any time with “Cookie settings” at the bottom of every page or by clearing this website’s data in your browser. Withdrawing it does not affect the lawfulness of processing before the withdrawal. Clarity can also use Microsoft/Bing third-party cookies (CLID, MUID, MR, SM and ANONCHK), including browser identifiers used across Microsoft domains. These support analytics and operational functions; Microsoft also describes advertising uses for MUID. We pass your analytics and advertising consent choices separately to Clarity. Our cookie policy lists these cookies and explains how to manage them. Cookies already stored on Microsoft or Bing domains cannot be deleted directly by alphabite.io. You can remove or block them in your browser’s cookie settings.
Cookies and browser storage
The website uses a few necessary cookies and browser storage entries without which some features do not work. They do not track you across other websites. Analytics and advertising cookies are set only after you consent, as Article 4a(1) of the Bulgarian Electronic Communications Act requires.
Emails and team notifications
Our info@alphabite.io mailbox and the emails the website sends (notifications to our team about new enquiries and applications, including their content, and confirmations to applicants) run on Google Workspace. Our team gets notifications in Discord about new and reopened chats, contact details left in the chat and requests to talk to a person, and on its devices also about new messages, enquiries and applications. They only say what happened, for example a new chat, and include an internal link; in Discord they also show the language and page. They contain no message text and no contact details. The legal basis for these emails and notifications is the same as for the enquiry, conversation or application they relate to.
Who receives your data
The data is available to the Alphabite team members who work with enquiries and applications. We share data only with providers that help us run the website and work with you, only as far as necessary, and with public authorities when the law requires it. Google, Microsoft, Meta and TikTok also process the data from the analytics and advertising tools under their own policies. For collecting and transmitting data through the Meta pixel, we and Meta are joint controllers (Article 26 GDPR); after that, Meta processes the data under its own policy.
Transfers outside the EEA
Some of these providers, such as OpenAI, Google, Microsoft, Meta, TikTok, Cloudflare and Discord, may process data outside the European Economic Area, including in the United States. Such transfers rely on a European Commission adequacy decision (for the United States, the EU–US Data Privacy Framework for providers certified under it) and otherwise on standard contractual clauses approved by the European Commission. You can ask us for information about the safeguards that apply by writing to info@alphabite.io.
How long we keep data
We keep data only for as long as we need it for the purpose it was collected for, and delete it when the periods below end. Deleted data may remain in the database’s daily backups for up to 14 days.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing and to receive the data you have given us in a portable format. You can object at any time to processing based on our legitimate interest, for example to the research into public information about your business. Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. To exercise your rights, write to info@alphabite.io. We will reply within one month and may ask you to confirm that the data is yours. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection.
Changes to this policy
We will update this policy when we change how we process data or when the law changes. The current version is always on this page. Last updated: 25 September 2026.