Privacy policy
Last updated 5 November 2026
Zelvai is operated by Gjorgji Grgovski, Skopje, North Macedonia (“Zelvai”, “we”). Zelvai gives businesses such as real-estate agencies and beauty salons an assistant that answers enquiries and books appointments. This page explains what personal data we process, why, and what rights you have. It is written in plain language on purpose. Questions: hello@zelvai.net.
1. Visitors to zelvai.net
We do not run analytics or advertising trackers on this site. The only cookie we set is zelvai_lang, which remembers the language you chose; it holds no personal data and expires after one year. The site is served by Cloudflare, which processes your IP address and request data to deliver pages and protect against abuse (legal basis: legitimate interest in running a secure website). The site’s fonts are loaded from Google Fonts, which receives your IP address when the page loads. Cloudflare and Google keep these logs briefly under their own policies.
2. When you contact us or book a call
If you email us or book a call through our booking page (cal.com), we keep your name, email address, company, and what we discussed, to reply and to follow up on a possible pilot (legal basis: steps taken at your request before entering into a contract). We keep this for 12 months after our last exchange, or until you ask us to delete it. Our own email is hosted by Zoho in the EU.
With your permission, asked at the start of the call, we may record it for our own notes. The recording and its transcript stay on our own computer, are made without any outside service, and are deleted within 90 days; we keep only written notes of what we discussed. If you say no, we take notes by hand.
3. Market research emails
As part of market research we occasionally write to businesses at their published business addresses. We do this under legitimate interest, we identify ourselves, we send at most one follow-up, and we stop immediately if you ask. We only record whether and when a reply arrived, and we never publish results that identify an individual business.
4. Businesses that use Zelvai, and their clients
When a business uses Zelvai (during a pilot or as a paying customer), we process two kinds of data:
- The business’s own team — names, work email addresses, profile photos, roles, calendar connections, alert settings and an activity log of who approved, edited or sent what, so the service can run. We are the controller for this data (legal basis: performance of the contract).
- The business’s clients — the names, contact details and messages of people who write to the business by email, through its website form or website chat, or on Instagram or Messenger, plus the replies, bookings and reminders made through Zelvai and their answer to a calendar invitation. Here the business is the controller and Zelvai is its processor: we act only on the business’s instructions under a data processing agreement, and the business remains responsible for informing its clients.
Clients always see that they are talking to the business’s digital assistant, and during a pilot every reply is approved by a person at the business before it is sent. We do not sell client or business data or share it for advertising. For businesses’ real client messages we use only AI providers whose terms do not allow them to train their models on that data.
5. Using the Zelvai app
People who work at a business sign in to the app at app.zelvai.net with a one-time link sent to their email address; there are no passwords. The app sets one cookie, zelvai_session, which keeps you signed in for 14 days. If you turn on alerts, your browser gives us a push address, which we use only to send you alerts about your business’s conversations; the push services of Google, Apple or Mozilla deliver them and see only encrypted content. The website chat that a business can place on its own site sets no cookies; it keeps a random visitor number in the browser’s local storage so the conversation can continue.
6. Google user data (Google Calendar)
A person at a business can connect their Google Calendar to Zelvai so the assistant can offer free times and put the bookings it makes into that calendar. Connecting is optional and done by that person through Google’s own consent screen. With that permission Zelvai:
- reads the busy and free times of the connected calendar (Google’s free/busy information: start and end times only — not the titles, descriptions, places or guests of your existing events), to know when an appointment can be offered;
- creates calendar events for the bookings that person makes in Zelvai (a viewing, an appointment, a charter week or a stay), with the client’s name and the booking details, so they appear in your calendar;
- reads the email address of the Google account, to show you which calendar is connected.
Zelvai stores only what it needs for this: the access granted by Google (a refresh token, encrypted with AES-256-GCM), the connected account’s email address and calendar, and the ids of the events Zelvai created. Free times are shown to the business’s team and may be offered to a client in a reply; to write that reply, the times (never your events) can be part of what is sent to the AI model provider that drafts it. Google user data is not sold, not used for advertising, not used to train or improve generalised AI or machine-learning models, and not read by people at Zelvai unless you ask us to (for support), it is needed for security, or the law requires it.
You can disconnect the calendar at any time in the Zelvai app (Settings → Connections → Disconnect): Zelvai deletes the stored access and revokes it at Google. You can also remove Zelvai at myaccount.google.com/permissions. Events Zelvai already created stay in your calendar as yours.
Zelvai’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we protect Google user data and other sensitive data
- Encryption in transit: all traffic to zelvai.net, app.zelvai.net and our API, and all our calls to Google, are encrypted with HTTPS (TLS).
- Encryption at rest: Google refresh tokens and other access tokens are encrypted with AES-256-GCM before they are stored, with a key kept outside the database. The database itself (Neon, EU) is encrypted at rest. Nightly database backups are encrypted (AES-256) before they leave the database and are deleted after 30 days.
- Minimum access: we request only the Google permissions the features need (free/busy times and creating events), never full calendar read access. Access tokens are used only on our servers and are never sent to the browser or to AI model providers.
- Separation between businesses: every record belongs to one business, and every request is checked so that a person sees only the data of the business they belong to.
- Sign-in: no passwords; one-time sign-in links valid for 15 minutes, and session cookies that are HttpOnly, Secure and SameSite. Zelvai’s own team uses a separate admin sign-in.
- People: only Zelvai’s own team can reach the production systems, with personal accounts and two-step verification, and only for support, security or legal reasons as described above. Secrets are kept in our hosting provider’s secret store, never in source code.
- Retention: free and busy times are read when times are offered and not stored on their own; the Google access (refresh token) and the connected account and calendar are kept until you disconnect; the ids of events Zelvai created are kept with their booking; times offered in a reply stay in that conversation. When a business leaves, all of it is deleted within 30 days.
- Deletion: disconnecting the calendar deletes the stored tokens and revokes them at Google; when a business leaves, its data is deleted within 30 days (section 8).
- Incidents: if a breach affects personal data, we inform the affected businesses without undue delay and the authorities within 72 hours, as the GDPR requires.
7. Service providers we use
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Website and app hosting, DNS, protection against abuse | Global network; operator in the US, with standard contractual clauses |
| Neon | The service’s database | EU (Frankfurt) |
| Resend | Sending and receiving the service’s email (sign-in links, replies, confirmations, reminders) | EU (Ireland); operator in the US, with standard contractual clauses |
| AI model providers (currently Groq; Anthropic planned) | Reading enquiries and drafting replies | US, with standard contractual clauses |
| Google Calendar, Zoho Calendar, Microsoft 365, iCloud | Calendar connections a business chooses to enable: reading free times and writing bookings | Depends on the provider the business uses; EU/US, with standard contractual clauses |
| Meta (Instagram, Messenger) | Messaging channels a business chooses to connect | EU/US, with standard contractual clauses |
| Push services of Google, Apple and Mozilla | Delivering alerts to the team’s phones and computers (encrypted content only) | EU/US |
| Zoho Mail | Our own email | EU (Netherlands / Ireland) |
| cal.com | Booking a call with us | EU/US, with standard contractual clauses |
| Google Fonts | Fonts of this website | Global network; operator in the US |
Where data leaves the EU/EEA we rely on the European Commission’s standard contractual clauses with the provider.
8. How long we keep data
Business and client data is kept for the duration of the contract and deleted within 30 days of termination, unless the business asks for an export first or a legal obligation requires longer retention. A business can also ask us to delete a single client’s data at any time. Server logs: 3 days. Contact data: 12 months after the last exchange. Research logs: 12 months.
9. Your rights
Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw any consent you gave. Write to hello@zelvai.net; we answer within 30 days. You can also complain to the data-protection authority of your country. If your request concerns data a business holds about you as its client, please contact that business; we will help them respond.
10. Changes
We will update this page when the service changes and note the date at the top.