Privacy policy
Last updated 2 November 2026
Zelvai is operated by Gjorgji Grgovski, Skopje, North Macedonia (“Zelvai”, “we”). Zelvai gives businesses such as real-estate agencies and beauty salons an assistant that answers enquiries and books appointments. This page explains what personal data we process, why, and what rights you have. It is written in plain language on purpose. Questions: hello@zelvai.net.
1. Visitors to zelvai.net
We do not run analytics or advertising trackers on this site. The only cookie we set is zelvai_lang, which remembers the language you chose; it holds no personal data and expires after one year. The site is served by Cloudflare, which processes your IP address and request data to deliver pages and protect against abuse (legal basis: legitimate interest in running a secure website). The site’s fonts are loaded from Google Fonts, which receives your IP address when the page loads. Cloudflare and Google keep these logs briefly under their own policies.
2. When you contact us or book a call
If you email us or book a call through our booking page (cal.com), we keep your name, email address, company, and what we discussed, to reply and to follow up on a possible pilot (legal basis: steps taken at your request before entering into a contract). We keep this for 12 months after our last exchange, or until you ask us to delete it. Our own email is hosted by Zoho in the EU.
3. Market research emails
As part of market research we occasionally write to businesses at their published business addresses. We do this under legitimate interest, we identify ourselves, we send at most one follow-up, and we stop immediately if you ask. We only record whether and when a reply arrived, and we never publish results that identify an individual business.
4. Businesses that use Zelvai, and their clients
When a business uses Zelvai (during a pilot or as a paying customer), we process two kinds of data:
- The business’s own team — names, work email addresses, profile photos, roles, calendar connections, alert settings and an activity log of who approved, edited or sent what, so the service can run. We are the controller for this data (legal basis: performance of the contract).
- The business’s clients — the names, contact details and messages of people who write to the business by email, through its website form or website chat, or on Instagram or Messenger, plus the replies, bookings and reminders made through Zelvai and their answer to a calendar invitation. Here the business is the controller and Zelvai is its processor: we act only on the business’s instructions under a data processing agreement, and the business remains responsible for informing its clients.
Clients always see that they are talking to the business’s digital assistant, and during a pilot every reply is approved by a person at the business before it is sent. We do not sell client or business data or share it for advertising. For businesses’ real client messages we use only AI providers whose terms do not allow them to train their models on that data.
5. Using the Zelvai app
People who work at a business sign in to the app at app.zelvai.net with a one-time link sent to their email address; there are no passwords. The app sets one cookie, zelvai_session, which keeps you signed in for 14 days. If you turn on alerts, your browser gives us a push address, which we use only to send you alerts about your business’s conversations; the push services of Google, Apple or Mozilla deliver them and see only encrypted content. The website chat that a business can place on its own site sets no cookies; it keeps a random visitor number in the browser’s local storage so the conversation can continue.
6. Service providers we use
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Website and app hosting, DNS, protection against abuse | Global network; operator in the US, with standard contractual clauses |
| Neon | The service’s database | EU (Frankfurt) |
| Resend | Sending and receiving the service’s email (sign-in links, replies, confirmations, reminders) | EU (Ireland); operator in the US, with standard contractual clauses |
| AI model providers (currently Groq and Google Gemini; Anthropic planned) | Reading enquiries and drafting replies | US, with standard contractual clauses |
| Google Calendar, Zoho Calendar, Microsoft 365, iCloud | Calendar connections a business chooses to enable: reading free times and writing bookings | Depends on the provider the business uses; EU/US, with standard contractual clauses |
| Meta (Instagram, Messenger) | Messaging channels a business chooses to connect | EU/US, with standard contractual clauses |
| Push services of Google, Apple and Mozilla | Delivering alerts to the team’s phones and computers (encrypted content only) | EU/US |
| Zoho Mail | Our own email | EU (Netherlands / Ireland) |
| cal.com | Booking a call with us | EU/US, with standard contractual clauses |
| Google Fonts | Fonts of this website | Global network; operator in the US |
Where data leaves the EU/EEA we rely on the European Commission’s standard contractual clauses with the provider.
7. How long we keep data
Business and client data is kept for the duration of the contract and deleted within 30 days of termination, unless the business asks for an export first or a legal obligation requires longer retention. A business can also ask us to delete a single client’s data at any time. Server logs: 3 days. Contact data: 12 months after the last exchange. Research logs: 12 months.
8. Your rights
Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw any consent you gave. Write to hello@zelvai.net; we answer within 30 days. You can also complain to the data-protection authority of your country. If your request concerns data a business holds about you as its client, please contact that business; we will help them respond.
9. Changes
We will update this page when the service changes and note the date at the top.