Politika zasebnosti
1. Upravljavec
WOOLAB, marketing in oglaševanje d.o.o., Stari trg 2, 3320 Velenje, Slovenija (matična številka 9737634000, davčna številka 77581539). Za vprašanja o zasebnosti in uveljavljanje pravic pišite na info@woolab.si.
2. Katere podatke obdelujemo
- Račun: ime, e-poštni naslov, podjetje, vloga, nastavitve; pri prijavi z Googlom tudi osnovni Google profil.
- Vsebina, ki jo vnesete: stranke in povpraševanja, e-pošta, dokumenti, datoteke, dogodki, sporočila asistentu.
- Povezane storitve: ko jih povežete, žetoni za dostop (shranjeni šifrirano) in podatki, ki jih prikazujemo: npr. statistika Google Analytics, Search Console, Google Ads, Facebook strani, Instagrama in Meta oglasov, leadi iz Meta obrazcev.
- TikTok: ko povežete TikTok račun, prejmemo osnovne podatke profila (open ID, uporabniško ime, prikazno ime, avatar, povezava do profila), statistiko profila (sledilci, všečki, število videov) in seznam vaših javnih videov s statistiko (ogledi, všečki, komentarji, deljenja). Za objavo uporabimo podatke ustvarjalca (vzdevek, dovoljene nastavitve vidnosti) in video, ki ga izberete. Podatke uporabimo samo za prikaz v Analitiki in poročilih ter za objave, ki jih potrdite. Podatkov TikTok ne prodajamo in jih ne uporabljamo za oglaševanje.
- Obiskovalci javne strani: opis podjetja v oknu »Opišite svoje podjetje« in vprašanja v klepetu »Vprašajte nas« shranimo kot pogovor, da lahko odgovorimo in izboljšamo odgovore. Če pustite kontakt, shranimo še e-naslov, telefon in ime. Za omejitev zlorab hranimo psevdonimizirano oznako IP naslova (zgoščena vrednost).
- Tehnični podatki: dnevniki strežnika in napak, potrebni za varnost in delovanje.
- AI pomočniki (ChatGPT, Claude): ko prostor povežete z aplikacijo Woolab AI v ChatGPT ali drugim AI pomočnikom, hranimo povezavo (uporabnik, izbrana podjetja, izbrana dovoljenja, ime aplikacije, čas povezave in zadnje uporabe) ter žetone za dostop samo kot zgoščene vrednosti. Pomočnik od nas prejme samo rezultate orodij, ki jih na vašo zahtevo pokliče (npr. seznam povpraševanj ali vsebino dokumenta), in v platformo zapiše samo to, kar zahtevate in dovoljujejo vaša dovoljenja. Celotnega pogovora ne prejmemo. Vsak klic zapišemo v revizijsko sled (orodje, vrsta dejanja, oznaka zapisa, izid, trajanje, razlog zavrnitve) brez vsebine in jo hranimo 12 mesecev; vidijo jo uporabnik ter lastnik in skrbniki podjetja. Za omejevanje zlorab pri povezovanju začasno uporabimo IP naslov (števec, izbrisan najkasneje po enem dnevu). Pogovore v ChatGPT obdeluje OpenAI po svojih pogojih in politiki zasebnosti. Povezavo kadarkoli prekličete v Aplikacije in integracije → AI pomočniki ali v nastavitvah ChatGPT; žetoni takoj prenehajo veljati.
- Plačila: podatki za račun; podatke kartice obdela ponudnik plačil Stripe, mi jih ne hranimo.
3. Nameni in pravne podlage
Podatke obdelujemo za izvajanje pogodbe (zagotavljanje platforme), za izpolnjevanje zakonskih obveznosti (računovodstvo) in iz zakonitega interesa (varnost, preprečevanje zlorab). Povezave z Googlom, Meto in TikTokom temeljijo na vaši privolitvi, ki jo kadarkoli prekličete z odstranitvijo povezave.
4. Obdelovalci
- Vercel (gostovanje aplikacije, strežniki v EU, Frankfurt)
- Supabase (baza podatkov in datoteke, EU, Frankfurt)
- Cloudflare (šifrirane nočne varnostne kopije) in GitHub (šifrirana kopija, hranjena 2 dni)
- Anthropic (AI modeli za asistenta in AI funkcije; vsebina se pošlje samo ob uporabi AI)
- OpenAI (ustvarjanje slik in glasovni pogovor; samo ob uporabi teh funkcij)
- Google Gemini in Perplexity (preverjanje vidnosti znamke v AI iskalnikih; pošljejo se samo vprašanja o znamki, ne osebni podatki)
- Google Firebase (potisna obvestila v mobilni aplikaciji)
- Daily.co (spletni sestanki), Stripe (plačila naročnine)
- Google, Meta, TikTok, ponudniki e-pošte in druge storitve samo, kadar jih sami povežete
- Google Analytics (Google Ireland) in Meta Pixel (Meta Platforms Ireland) na javni strani, samo z vašo privolitvijo
Kjer se podatki prenašajo izven EGP, prenos temelji na standardnih pogodbenih klavzulah ali drugih ustreznih zaščitah.
5. Hramba in izbris
Podatke hranimo, dokler je račun podjetja aktiven. Šifrirane varnostne kopije baze hranimo 60 dni; izbrisane datoteke se iz varnostnih kopij trajno odstranijo najpozneje v 60 dneh. Ko odstranite povezan vir (npr. TikTok), izbrišemo njegove žetone in shranjene podatke, pri TikToku pa prekličemo dovoljenje. Po prenehanju naročnine podatke podjetja na zahtevo naročnika izvozimo in izbrišemo, razen tistih, ki jih moramo hraniti po zakonu.
6. Varnost
Povezave so šifrirane (HTTPS), žetoni in gesla povezanih storitev so v bazi dodatno šifrirani, dostop do podatkov je omejen na uporabnike posameznega podjetja in njihove pravice.
7. Vaše pravice
Imate pravico do dostopa, popravka, izbrisa, omejitve obdelave, prenosljivosti in ugovora ter pravico do pritožbe pri Informacijskem pooblaščencu RS (ip-rs.si). Zahtevo pošljite na info@woolab.si.
8. Piškotki
Platforma (prijavljeni del) uporablja samo nujne piškotke in lokalno shrambo brskalnika za prijavo, varnost povezav in vaše nastavitve.
Na javni strani platform.woolab.si z vašo privolitvijo uporabljamo tudi analitične in oglaševalske piškotke: Google Analytics 4 (statistika obiska, piškotki _ga, hramba do 14 mesecev) in Meta Pixel (merjenje oglasov na Facebooku in Instagramu, piškotek _fbp, do 3 mesece). Brez privolitve Meta Pixel ni naložen, Google Analytics pa deluje v načinu soglasja: ne nastavi piškotkov in Googlu pošlje le anonimne signale brez identifikatorjev. Izbiro shranimo v brskalnik za 6 mesecev, spremenite jo s povezavo »Piškotki« v nogi javne strani.
9. Spremembe
Politiko lahko posodobimo; datum veljavnosti je na vrhu strani.
Privacy Policy
1. Controller
WOOLAB, marketing in oglaševanje d.o.o., Stari trg 2, 3320 Velenje, Slovenia (registration no. 9737634000, tax no. 77581539). For privacy questions and requests write to info@woolab.si.
2. Data we process
- Account: name, email address, company, role, settings; with Google sign-in also the basic Google profile.
- Content you enter: clients and leads, email, documents, files, events, messages to the assistant.
- Connected services: when you connect them, access tokens (stored encrypted) and the data we display, e.g. statistics from Google Analytics, Search Console, Google Ads, Facebook Pages, Instagram and Meta Ads, and leads from Meta lead forms.
- TikTok: when you connect a TikTok account we receive basic profile info (open ID, username, display name, avatar, profile link), profile statistics (followers, likes, video count) and the list of your public videos with their statistics (views, likes, comments, shares). For posting we use creator info (nickname, allowed privacy options) and the video you select. This data is used only to show it in Analytics and reports and to publish posts you confirm. We do not sell TikTok data or use it for advertising.
- Public site visitors: the business description in the “Opišite svoje podjetje” box and questions in the “Vprašajte nas” chat are stored as a conversation so we can reply and improve answers. If you leave contact details we also store email, phone and name. To limit abuse we keep a pseudonymised (hashed) IP marker.
- Technical data: server and error logs needed for security and operation.
- AI assistants (ChatGPT, Claude): when you connect a workspace to the Woolab AI app in ChatGPT or another AI assistant, we store the connection (user, selected companies, selected permissions, app name, time of connection and last use) and keep access tokens only as hashes. The assistant receives from us only the results of the tools it calls at your request (e.g. a list of leads or a document’s content), and writes to the Platform only what you ask for and your permissions allow. We do not receive the full conversation. Every call is recorded in an audit log (tool, action type, record reference, outcome, duration, denial reason) without content and kept for 12 months; it is visible to the user and to the company’s owner and admins. To prevent abuse during connection we temporarily use the IP address (a counter deleted within one day). ChatGPT conversations are processed by OpenAI under its own terms and privacy policy. You can revoke the connection at any time in Apps and integrations (Aplikacije in integracije) → AI assistants or in ChatGPT settings; the tokens stop working immediately.
- Payments: billing details; card data is processed by Stripe and never stored by us.
3. Purposes and legal bases
We process data to perform the contract (providing the Platform), to meet legal obligations (accounting) and on legitimate interest (security, abuse prevention). Connections to Google, Meta and TikTok are based on your consent, which you can withdraw at any time by removing the connection.
4. Processors
- Vercel (application hosting, EU servers in Frankfurt)
- Supabase (database and file storage, EU, Frankfurt)
- Cloudflare (encrypted nightly backups) and GitHub (encrypted copy kept for 2 days)
- Anthropic (AI models for the assistant and AI features; content is sent only when you use AI)
- OpenAI (image generation and voice conversations; only when you use these features)
- Google Gemini and Perplexity (brand visibility checks in AI search; only questions about the brand are sent, no personal data)
- Google Firebase (push notifications in the mobile app)
- Daily.co (online meetings), Stripe (subscription payments)
- Google, Meta, TikTok, email providers and other services only when you connect them yourself
- Google Analytics (Google Ireland) and Meta Pixel (Meta Platforms Ireland) on the public site, only with your consent
Where data is transferred outside the EEA, the transfer relies on standard contractual clauses or other appropriate safeguards.
5. Retention and deletion
We keep data while the company account is active. Encrypted database backups are kept for 60 days; deleted files are permanently removed from backups within 60 days. When you remove a connected source (e.g. TikTok), we delete its tokens and stored data and, for TikTok, revoke the authorization. After a subscription ends, we export and delete the company’s data at the customer’s request, except data we must keep by law.
6. Security
Connections are encrypted (HTTPS), tokens and passwords of connected services are additionally encrypted in the database, and access is limited to the users of each company according to their permissions.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to complain to the Slovenian Information Commissioner (ip-rs.si). Send requests to info@woolab.si.
8. Cookies
The platform (signed-in area) uses only essential cookies and browser local storage for sign-in, connection security and your settings.
On the public site platform.woolab.si we also use analytics and advertising cookies with your consent: Google Analytics 4 (visit statistics, _ga cookies, kept up to 14 months) and Meta Pixel (ad measurement on Facebook and Instagram, _fbp cookie, up to 3 months). Without consent Meta Pixel is not loaded, and Google Analytics runs in consent mode: it sets no cookies and sends Google only anonymous signals without identifiers. Your choice is stored in the browser for 6 months; change it with the “Piškotki” link in the public site footer.
9. Changes
We may update this policy; the effective date is shown at the top.