Privacy policy

1. Who is responsible

Zhivko Komarov, Vera Ciriviri 45, 2400 Strumica, North Macedonia, is the controller for the personal data described in this policy. Contact: support@adminsmith.com.

This policy covers our own users and visitors. When our customers use AdminSmith to process data about their customers (for example names on invoices, payments in a bank statement or messages sent to their AI receptionist), the customer is the controller and we process that data for them as a processor. If you are one of their customers, please contact the business you dealt with; we will help them answer you.

2. What we collect and why

Account data

Your name, email address, whether you signed up for a business or for yourself, your business name if you gave one, and a scrambled (hashed) password. Needed to provide your account (contract).

Service data

What you put into the tools: websites and check results, invoices and customers, statements (only payments out), AI receptionist settings and conversations, a record of each AI answer (time, model and amount of text used) for your usage reports, and the details of accounts you connect, which we store encrypted. Needed to provide the tools (contract); for your customers’ data we act as processor.

Billing data

Your plan and subscription status, and the Paddle customer, subscription and transaction IDs that link your account to your payments. Paddle, our reseller, collects your payment details and is a separate controller for them; we do not see your card number.

Emails we send

Account emails, alerts, notifications and reports you asked for (contract), and important notices about the service, such as changes to our terms, policies or prices (legal obligation and legitimate interest). We do not send newsletters or marketing emails.

Waiting list

If you join the waiting list for a tool that is not available yet, we note it in your account and email you once when it launches.

Security and logs

To limit repeated attempts, such as failed logins, your IP address is held in the server’s memory for up to one hour. Our application logs record errors, payment events and security events such as failed logins (with a scrambled form of the email address), not IP addresses. We do not log which pages you visit. When our web server cannot handle a request, its error log may record the IP address involved. Logs help us keep the service secure and stop abuse (legitimate interest).

Free website check

The address you enter and the result. No account is needed. To enforce the daily limit of free checks, we keep a scrambled (hashed) form of your IP address with the check for 24 hours, then remove it (legitimate interest).

Contact form

Your name, email address and message, to answer you (legitimate interest). We keep them for up to 12 months after the conversation ends.

Website analytics

Only if you agree: which of our public pages you visit, how you found our site, your device and browser, and your approximate location (country or city), collected by Google Analytics. We use it to see which pages help people and which need work (consent). It is never collected inside the app, on admin pages, on private links such as free check results or your customers’ pages, or used for advertising.

3. Cookies

We use only cookies that are strictly necessary: sid keeps you logged in (for 30 days, or until you log out) and bid protects forms against cross-site attacks (for 1 year). Both can be read only by our server, are sent only to our own site and, over HTTPS, only on secure connections. Google Analytics cookies (_ga and _ga_…) are set only after you select Accept analytics in the banner on your first visit, and the consent cookie remembers your answer. If you select No thanks, nothing is loaded from Google. Google signals and ad personalisation are switched off, and Google Analytics does not store IP addresses. Change your choice any time under Cookie settings, linked at the bottom of every page.

On the pages where you pay (Plan and billing), we load Paddle’s checkout from cdn.paddle.com and pass it your email address and account number so the payment is linked to your account. A payment link from Paddle, for example to pay an invoice, opens our Payment page, which loads the same checkout for that payment and passes it nothing else. Paddle may set its own cookies there for checkout and fraud prevention, under Paddle’s privacy policy. Apart from Google Analytics after you have agreed to it, no other page loads anything from another website.

The chat widget on our customers’ websites sets no cookies; it remembers the open conversation in the visitor’s browser tab only.

4. Who helps us

• Hosting: servers in a data centre in Cologne, Germany, which we manage ourselves. The data centre is run by DATACENTRE_OPERATOR=GoDaddy.com, LLC.
• Payments: Paddle.com (Merchant of Record), for checkout, tax and invoices.
• Email delivery: EMAIL_PROVIDER=GoDaddy.com, LLC, through its mail relay, for account emails and notifications. Notifications can include your customers’ messages, for example a new enquiry from the AI receptionist.
• Website analytics, only if you agree: Google Ireland Limited (Google Analytics). Google may process the data in the US, under the EU–US Data Privacy Framework and Google’s standard contractual clauses.

When you connect your own email, AI, Twilio or WhatsApp account, the data needed for that tool goes to that provider on your instruction, under your agreement with them. For the AI receptionist, this means the conversation and your business information go to the AI provider whose key you connected.

We do not sell personal data and do not use your data or your customers’ data to train AI models.

5. Transfers outside the EU and UK

Our servers are in a data centre in Cologne, Germany, inside the EU, and we manage them ourselves from North Macedonia. Where personal data leaves the EU, EEA or UK, we protect it with the European Commission’s standard contractual clauses (and the UK addendum) or an adequacy decision, plus technical measures such as encryption.

6. How long we keep data

• Account and service data: while your account exists. Deleting your account deletes it straight away from the live system; backups are overwritten within 30 days.
• AI receptionist conversations: deleted automatically after the period the business chooses (30 days to 1 year). Test chats: after 2 days.
• Free website checks: the scrambled IP address after 24 hours, the check itself after 30 days.
• Sessions and password reset links: removed once they have expired.
• Billing records: as long as tax law requires (Paddle keeps the invoices).
• Server logs, including web server error logs: up to 30 days.
• Contact form messages: up to 12 months after the conversation ends, in our support mailbox.
• Website analytics: Google keeps the data for up to 14 months; its cookies expire after 13 months, and your choice in the consent cookie after 6 months.

7. Security

Connections use HTTPS. Passwords are hashed with scrypt, and keys and passwords for your connected accounts are encrypted with AES-256-GCM. Access to production systems is limited to the people who need it. If a personal data breach affects you, we will tell you and the authorities as the law requires.

8. Your rights

Under the GDPR and UK GDPR you can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and object to processing based on legitimate interest. You can withdraw consent at any time. Most of this you can do yourself in your account; otherwise email support@adminsmith.com and we will answer within one month.

You can complain to your data protection authority, for example where you live or work. In the UK this is the ICO. We would appreciate the chance to sort it out first.

9. Changes

We will post changes here and email you about important ones.