Rotozoom — Privacy Policy
Version 2026-10 (effective on publication)
This policy explains what personal data Rotozoom handles on rotozoom.com and in the Rotozoom WordPress plugins: what we collect, why, on what legal basis, where it is processed, how long we keep it, and what your rights are.
1. Who we are
LEDLIGHTINGS EOOD (LEDLIGHTINGS LTD.) ("Rotozoom", "we", "us"), str. Stefan Stambolov 1, Zlatograd, Bulgaria, VAT No. BG204173724. Contact for privacy and data-protection questions: dpo@rotozoom.com. This address is our privacy contact point; we have not designated a Data Protection Officer under Art. 37 GDPR. For general support, write to support@rotozoom.com.
2. Our two roles
- We are the controller for: your Rotozoom account; purchases, invoices and VAT records; the rotozoom.com website; plugin downloads, licensing and updates; support we give you; error reports and usage statistics; reviews.
- We are a processor for the shop owner when a plugin's cloud feature handles data about the shop's own visitors or customers. Today this is the Sales Assistant; when it is released, also Rotozoom Reviews PRO (AI moderation, summaries, translation and photo checks of the shop's product reviews). The shop owner is the controller for that data and decides whether to use the feature. If you are a shopper, please send requests about that data to the shop. We help the shop answer them. The terms are in our Data Processing Agreement (/dpa), which forms part of our agreement with the shop owner (see §12).
3. The rotozoom.com website
| What | Data | Purpose | Legal basis | Kept | Where |
|---|---|---|---|---|---|
| Delivering the site | IP address and request headers (handled by our host, Cloudflare). We read only the country Cloudflare derives from the IP. | deliver the page, protect it from attacks | legitimate interest (security and operation of the site) | not kept by us; Cloudflare keeps its own logs under its own retention policy | Cloudflare global network |
| Cookies | language choice, cookie choice, and, when signed in, the session cookies that keep you logged in. No advertising or analytics cookies, no tracking pixels. Details: Cookie Policy. | site function | strictly necessary | see Cookie Policy | your browser |
| Button click counts | event (e.g. "Download", "Buy"), product, page path, language, referring site's domain, country. No IP address, cookie, account or browser fingerprint. | see which pages lead to downloads and purchases | legitimate interest | 60 months, then deleted automatically by a daily job | Supabase, EU (Ireland) |
| Download log | plugin, time, country, browser user-agent, referring page, and a pseudonymised value made from your IP address with a secret key (the IP itself is not stored) | count real downloads, filter bots, stop abuse | legitimate interest | 60 months, then deleted automatically by a daily job | Supabase, EU (Ireland) |
4. Your Rotozoom account
| Data | Purpose | Legal basis | Kept | Where |
|---|---|---|---|---|
| Email address; password (stored only as a hash by our sign-in provider); optionally name and company | create and secure your account; give you downloads, licences, billing | contract | while the account is active, without a time limit, or until you delete it. An account with no sign-in, no licence and no payment for more than 24 months is deleted; we e-mail you 30 days before. Your licences and installations are deleted with the account. Invoices and accounting records are kept as described in §5. | Supabase, EU (Ireland) |
| If you use "Continue with Google": email, name, profile picture, Google account ID (basic profile only, never your Gmail, Drive or contacts, never your Google password) | sign-in | contract | as the account | Google → Supabase EU |
| Record of acceptance: which version of the Terms and the Data Processing Agreement you accepted, and when (at sign-up and at each checkout) | prove what was agreed | contract; legal obligation (accountability, Art. 5(2) and 28 GDPR) | as long as the account exists, then 5 years after the account is closed (the general limitation period for claims under Bulgarian law) | Supabase, EU (Ireland) |
| Account emails (confirmation, password reset) | sign-in | contract | in Mailjet's delivery logs, under Mailjet's retention policy | Mailjet, EU |
5. Purchases, invoices and VAT
- Payment is handled by Stripe. We never see or store your card number. Stripe tells us the country of your card and gives your account a customer reference.
- Invoices. We store your billing name, company, address, VAT number, the items bought and the amounts, and we issue the invoice.
- VAT evidence. EU VAT law requires us to establish where you are and to keep the proof. For each purchase we record the billing country you declared, the card's country, the country of your IP address (the country only, not the address), and, if you entered a VAT number, the result of the check in the European Commission's VIES system.
- Legal basis: contract (to sell to you) and legal obligation (Bulgarian accounting and VAT law; EU VAT Implementing Regulation 282/2011, Art. 24b).
- Kept: for the period Bulgarian accounting and tax law requires, even if you close your account: 10 years.
- Where: Stripe (Stripe Payments Europe, Ireland, and Stripe, Inc., USA); our records in Supabase, EU (Ireland). The European Commission (VIES) receives your VAT number as a public authority, not as our service provider.
6. Reviews
If you publish a review of a plugin, it appears on rotozoom.com with your account name (or "Verified customer" if no name is set), your rating, your text and the plugin version. We email you when it is published or held back. We may email customers who bought a plugin from us to ask for a review of it. These emails are sent through Mailjet and every one carries a one-click unsubscribe link; after you unsubscribe we send no more of them. Legal basis: consent for publishing your review. Review-request emails: our legitimate interest in asking our own customers for feedback on what they bought, under the rules for e-mail to existing customers ("soft opt-in", Art. 13(2) of the ePrivacy Directive 2002/58/EC). You can object at any time by unsubscribing or by writing to dpo@rotozoom.com. Kept: reviews until you delete the review or your account. If you unsubscribe from review requests, we keep your address on our do-not-email list for as long as we need it to honour your choice.
7. What the plugins send to us
Plugins downloaded from wordpress.org do not contact Rotozoom servers. Their PRO features and Rotozoom Connect are removed. Exception: the Sales Assistant needs our servers in every edition (see §8).
Plugins downloaded from rotozoom.com add Rotozoom Connect, installed from a file inside the plugin (no download needed). We are the controller for this data.
| What | Data | Purpose | Legal basis | Kept | Where |
|---|---|---|---|---|---|
| Update checks | site address; plugin and version; the update download is logged as in §3 | deliver signed updates | contract / legitimate interest | as the download log | Supabase, EU (Ireland) |
| Sign-in and licence check (after you sign in) | your Rotozoom account sign-in; a random installation ID; site address, domain and site name; WordPress, PHP and plugin versions; which Rotozoom plugins are installed | licensing (one licence = one site), plan limits | contract | while the licence or installation is in use; deleted together with your account (§4) | Supabase, EU (Ireland) |
| Error reports, only if you allow them | error type and message, technical context, plugin and PHP version, installation ID. A message can include a file path or a value from your site. | fix bugs | consent | 12 months, then deleted automatically by a daily job | Supabase, EU (Ireland) |
| Anonymous usage statistics, only if you choose "Allow" | a separate random ID not linked to your account, plugin version, WordPress/PHP/WooCommerce versions, site language, multisite yes/no, country (derived from the server's IP at our edge; the IP is not kept). No site address or email. | product planning | consent | 60 months after the installation was last seen, then deleted automatically by a daily job | Supabase, EU (Ireland) |
| AI support chat (PRO) | your question; the email of the Rotozoom account the site is signed in with; site domain; plugin and version; only if you tick the diagnostics box: PHP/WordPress/WooCommerce versions, theme, active plugins, memory limit, debug mode | answer your support question | contract; diagnostics by consent | 24 months after the last message (including the improvement suggestions drawn from the conversation), then deleted automatically by a daily job | Supabase, EU (Ireland); replies by Anthropic (Claude), USA |
Support conversations are stored so we can follow up. Our team may review them, with help from Anthropic's Claude, to improve support and the documentation.
You can withdraw consent for error reports, usage statistics and diagnostics at any time in Rotozoom Connect's settings.
Plugins that send nothing to Rotozoom in their current versions (beyond Connect above): Product Filter, Conditions, B2B Manager, Warranty, Warehouse, Suppliers & Dropshipping, Image Optimizer. Image Optimizer's optional background removal runs in the admin's browser and downloads its AI model from jsDelivr and Hugging Face; no image is sent to them or to us.
Rotozoom Reviews (when released): the FREE edition and the wordpress.org edition send nothing to Rotozoom. Reviews PRO sends us the text, star rating, product name and language of a review (and its photos, if any) for AI moderation, summaries, translation and photo checks; it never sends the reviewer's name, e-mail, phone, address or order number. Review text can still contain personal data that a reviewer wrote into it. We act as the shop's processor (§2, §12). Review texts are not kept after processing (only the result and its cost); photos are kept at most 24 hours; translations are cached for 90 days. AI processing uses Google Gemini on Vertex AI in the EU region, reached through OpenRouter with zero data retention; photos are resized and their metadata (EXIF/GPS) removed on our own image servers in the EU.
Sell & Ship runs in your shop. Courier, VIES, company-register, exchange-rate, map, IP-country, translation and Bulgarian reputation-service requests go directly from your shop to those providers using your own accounts, not through Rotozoom. They are listed in the plugin's "External services" tab. Its two optional Rotozoom helpers, the address check and the reputation network, are off by default and send nothing until switched on; this policy will describe them before they can be switched on.
8. Sales Assistant (we act as the shop's processor)
The Sales Assistant uses Rotozoom servers in every edition, FREE included.
What is sent to our servers
- Chat messages typed by shoppers, and the conversation so far.
- Short shopping context: the product being viewed, titles of recently viewed pages, items in the cart.
- Shop details: installation ID, site address, the store profile and assistant rules the shop wrote.
- Product catalogue (only after the shop turns indexing on): name, categories, attributes, SKU, tags, a description excerpt, price, stock status, image link.
- No shopper names, e-mails, phone numbers, payment data or orders are sent by the chat. A message contains personal data only if the shopper types it. The order-status card is built inside the shop from WooCommerce and never sent to us.
- Version 1.9.11 also includes the shopper's IP address in each request. Our server neither reads nor stores it.
Who writes the replies. Our servers are in the EU (Ireland). AI replies are generated by providers in the USA and globally (Google, Z.ai GLM, Anthropic). None of them trains its models on the data. Google and GLM do not keep the data; Anthropic may keep it for a limited period under its standard commercial data policy. Our server sends the conversation to one AI model, in this order:
- Google Gemini on Google Vertex AI (global region), reached through OpenRouter, with zero data retention and no training on the data;
- if that fails, Z.ai GLM, reached through OpenRouter and run by Together AI in the USA, with zero data retention;
- as the last fallback, Anthropic Claude in the USA, under Anthropic's standard commercial data policy (no training on API data; inputs and outputs may be kept for a limited period).
The AI step is processed outside the EU. Transfers rely on the European Commission's Standard Contractual Clauses, or on the EU–US Data Privacy Framework where the provider is certified (§9). Search vectors for products and for the shopper's question are made by Voyage AI (USA). Automatic translation and reply drafts for the shop's staff (PRO) are made by Anthropic Claude.
What we keep on our servers, and for how long (deleted automatically every hour since 11.10.2026):
| Data | Kept |
|---|---|
| Reply buffer (the reply while it is delivered) | 1 hour |
| Live-chat conversations between shoppers and shop staff (PRO) | 12 months |
| Leads (name, e-mail, phone, request) — only if the shop turns on "Keep leads on Rotozoom servers" (off by default; otherwise leads are e-mailed by the shop and stay in the shop) | 24 months |
| Sales attributed to the assistant ("Assisted revenue"), with identifiers stored as hashes | 24 months |
| The shop server's IP address | cleared after 12 months |
| Product catalogue and search vectors | while the product is indexed; deleted with the product |
| Usage counters (no message text) | 60 months, then deleted automatically |
| Credit balances | while the account exists |
| Industry-pool queue: personal data is removed BEFORE a conversation is stored; a conversation that could not be cleaned is never stored, and any uncleaned row is deleted within 1 hour | none kept unredacted |
| Industry-pool anonymised excerpts (no personal data) | no fixed retention period; kept until Rotozoom decides to delete them |
Ordinary chats (without live chat) are stored in the shop's own WordPress database, not on our server.
Industry knowledge pools. A shop can choose an industry knowledge pool in the Sales Assistant settings (no pool is the alternative).
- Purpose: to improve the answers the assistant gives to all shops in the same industry (for example, which questions shoppers ask and how products are compared).
- How it works: if the shop has chosen a pool, conversations of 8 or more messages are considered for the pool. Before a conversation is stored at all, we remove personal data — names, e-mail addresses, phone numbers, addresses, order numbers and other identifiers — automatically (pattern rules plus an AI check run with zero data retention). If the removal fails, nothing is stored. The remaining text is analysed with Anthropic's Claude to extract general knowledge. Only anonymised excerpts are kept and shared with shops in the same industry. They have no fixed retention period: we keep them until we decide to delete them. Nothing unredacted is kept; any row that was not cleaned is deleted within an hour.
- Roles and legal basis: removing personal data and preparing the excerpts is done on the shop's instruction as its processor, under the Data Processing Agreement (the shop's legal basis towards its customers is its legitimate interest in a better assistant). The resulting anonymised excerpts are no longer personal data; Rotozoom keeps them as its own. If an excerpt were found to still relate to an identifiable person, we would delete or correct that excerpt; to that extent we rely on our legitimate interest in improving the service, and you can object (§11).
- Switching off: the shop can choose no pool at any time. No new conversations are added; anonymised excerpts already made are not affected.
Bot protection. In guest mode the shop can add Cloudflare Turnstile with its own key. Turnstile is loaded by the shop from Cloudflare.
9. Service providers (sub-processors)
| Provider | What for | Where data is processed | Transfer mechanism |
|---|---|---|---|
| Supabase, Inc. | database, sign-in, our server functions | EU — Ireland (eu-west-1) | Supabase DPA with SCCs for support access from outside the EU |
| Cloudflare, Inc. | website hosting, security, country detection, inbound e-mail routing | global network; company in USA | SCCs; DPF where the provider is certified |
| Stripe | payments, card country | EU (Stripe Payments Europe, Ireland) and USA | SCCs; DPF where the provider is certified |
| "Continue with Google"; a copy of our support mailbox (Gmail); Gemini on Vertex AI (global region), reached through OpenRouter with zero data retention, for Sales Assistant replies; Gemini on Vertex AI (EU region), zero data retention, for Reviews PRO (when released) | USA / global (Vertex AI global region); EU (Reviews) | SCCs; DPF where the provider is certified | |
| OpenRouter, Inc. | routes Sales Assistant requests to Gemini and GLM, and Reviews PRO requests to Gemini (EU); zero data retention | USA | SCCs; DPF where the provider is certified |
| Together AI | runs Z.ai GLM (Sales Assistant fallback), reached through OpenRouter; zero data retention | USA | SCCs; DPF where the provider is certified |
| Anthropic, PBC | Claude — support chat, Sales Assistant last fallback, translation and staff reply drafts, analysis of redacted industry-pool conversations; standard data policy (no training on API data; data may be kept for a limited period) | USA | SCCs; DPF where the provider is certified |
| Voyage AI | search vectors for products and questions | USA | SCCs; DPF where the provider is certified |
| Mailjet (Sinch) | account and review e-mails | EU | none needed (EU) |
| Purelymail | our support mailboxes | USA | SCCs; DPF where the provider is certified |
Where a provider is outside the EU/EEA, transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. No AI provider we use trains its models on the data we send.
10. Legal bases, in summary
- Contract: account, downloads, licences, updates, support, paid features.
- Legal obligation: invoices, VAT evidence, accounting records.
- Legitimate interest: site security, download and bot statistics, click counts, abuse and fraud prevention, plan limits, review-request e-mails to customers who bought a plugin (soft opt-in, §6). You can object (§11).
- Consent: error reports, anonymous usage statistics, support diagnostics, publishing a review. You can withdraw consent at any time; this does not affect processing before the withdrawal.
- Shop data (Sales Assistant): we process it only on the shop owner's instructions, under the Data Processing Agreement (/dpa), including the removal of personal data for industry pools (§8).
- Anonymised industry-pool excerpts: not personal data; to the extent an excerpt could still relate to a person, legitimate interest (§8).
11. Your rights
You can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. You can withdraw consent at any time. Write to dpo@rotozoom.com. We answer within one month (extendable by two months for complex requests; we will tell you if so). We may ask you to confirm your identity. Some data, such as invoices, must be kept by law even after a deletion request.
You can complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg, or to the authority in the EU country where you live or work.
Shoppers of a shop that uses Rotozoom: the shop is the controller of your data. Please contact the shop first. If you contact us, we will pass your request to the shop.
12. For shop owners
When you use a cloud feature that handles your customers' data, you are the controller and we are your processor. Mention the feature in your shop's privacy policy (the "What is sent" note on each plugin page gives a ready sentence). Our Data Processing Agreement (/dpa) covers this processing and forms part of our agreement with you. You accept it together with the Terms of Service when you create your Rotozoom account and again at each checkout (a checkbox / notice next to the button). We store on your account which version you accepted and when. Nothing needs to be signed separately; you can download the current version at any time from /dpa. Accounts that existed when this version was published were notified, and their acceptance of this version was recorded with the version, the date and the basis of acceptance. If you use a cloud feature without a Rotozoom account (for example the Sales Assistant from wordpress.org), the Data Processing Agreement applies to that processing from the moment you switch the feature on.
13. Security
Data travels over encrypted connections. Our database and server functions are hosted in the EU. Passwords are stored as hashes by our sign-in provider. Each site's data is kept separate by its installation ID. Plugin updates are signed, and Rotozoom Connect installs only signed packages. Access to administrative tools is restricted to named authorised persons and protected by an access gateway. Retention periods for the Sales Assistant are enforced by automatic deletion jobs. We review our security measures at least once a year.
14. Children
Our services are business tools and are not aimed at children.
15. Changes
When we change this policy we update the version label at the top. For material changes we also tell account holders by e-mail or in the dashboard at least 14 days before the change applies.
16. Contact
Privacy and data protection: dpo@rotozoom.com. General support: support@rotozoom.com. Post: LEDLIGHTINGS EOOD, str. Stefan Stambolov 1, Zlatograd, Bulgaria.