Privacy Policy
This Privacy Policy describes how Legasibild EOOD (“we”, “us”, or “our”) processes personal data in connection with the LEOREXA website and its B2B artificial intelligence sales operating system software-as-a-service (SaaS) application (the “Service”).
1. Information We Process
Depending on how you interact with the Service, we may process the following categories of data:
- Account & Authentication Data: Full name, business email address, corporate password hashes, and security logs.
- Corporate & Representation Data: Legal entity name, Unified Identification Code (UIC/EИК), VAT number, registered office address, and versioned compliance checkmarks.
- Workspace & Campaign Data: Sales pipeline inputs, target prospect contacts, custom parameters, lead lists, file uploads, and operational draft logs.
- Billing & Transaction References: Stripe customer tokens, subscription status, invoice history, tax locale metadata, and transaction logs. Full payment card details are securely processed directly by Stripe and are never stored on our servers.
- Connected Mailbox Metadata (Optional Integration): Email addresses, authentication tokens, message identifiers, sender/recipient headers, and up to 20,000 characters of incoming textual reply payloads extracted solely to verify outbound campaign conversions and delivery failures.
2. Legal Bases for Processing
We process data in strict accordance with the GDPR under the following legal grounds:
- Performance of a Contract (Art. 6(1)(b) GDPR): To provision workspaces, manage account access, manage top-up Credits, and host user-directed workflows.
- Legitimate Interests (Art. 6(1)(f) GDPR): To execute AI-assisted research queries, calculate conversion scores, generate outreach outlines, monitor infrastructure security, and prevent service abuse.
- Compliance with a Legal Obligation (Art. 6(1)(c) GDPR): To compile corporate tax statements, enforce statutory VAT rules, and retain transaction histories under Bulgarian accounting laws.
3. Service Providers and International Processing
The Service utilizes trusted cloud hosting, database architecture, AI language inference APIs, and billing engines. Where these sub-processors handle data outside the European Economic Area (EEA), such transfers are fully secured by European Commission-approved Standard Contractual Clauses (SCCs), active corporate registrations under the EU-U.S. Data Privacy Framework, or equivalent statutory adequacy mechanisms.
4. Google API Services Limited Use Disclosure
LEOREXA’s use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. Data derived from connected Google mailboxes is strictly utilized to provide client-facing analytics, automate outreach sequences, and flag delivery statuses. This data is explicitly barred from being sold, shared with advertising networks, or transmitted to external entities for the purpose of training generalized large language models (LLMs).
5. Data Retention and Deletion
- Account Data: Maintained throughout the lifespan of the active business relationship.
- Workspace Content & Mailbox Synchronization Records: Stored exclusively to support active operational campaigns and will be queued for absolute technical erasure upon explicit workspace termination or account closure.
- Tax & Financial Records: Archived for the mandatory statutory duration of 10 years in compliance with Bulgarian accounting and fiscal regulations.
6. Data Subject Rights and Contact
Eligible individuals retain full rights to request access, rectification, structural portability, processing restrictions, or permanent erasure of their personal data under GDPR thresholds. Inquiries must be routed to: support@leorexa.com.
If you believe your data has been handled unlawfully, you have the right to lodge a formal complaint with the competent supervisory authority: Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria (www.cpdp.bg).