Privacy Policy
Effective Date: 01/09/2026
AIRDEC LTD (EIK 207392456), a limited liability company incorporated in Bulgaria, operates the Airdec platform and is responsible for the personal data described in this policy. We provide services exclusively to businesses and professional organisations.
1. Who We Are
Airdec is operated by AIRDEC LTD, registered in Bulgaria at г.к. Стрелбище, ул. Енос 6, 1404 Sofia. For privacy-related questions, contact us at contact@airdec.com.
2. What This Policy Covers
This policy explains how we collect and use personal data across two environments:
- Our marketing website (airdec.com) — where we act as data controller for visitors, prospects, and anyone who submits a demo or enquiry form.
- Our product platform — where we act as data controller for account and billing data of our business customers, and as a data processor for data our customers process through the platform on behalf of their own users.
Where we process personal data as a processor on behalf of a business customer, that processing is governed by our Data Processing Agreement, not this policy.
3. What Data We Collect and Why
We collect and use personal data for the following purposes, each with a lawful basis under GDPR:
Service delivery and account management — we process account data and usage data to provide and maintain the platform. Legal basis: contract performance (Art. 6(1)(b)).
Billing and subscription management — we process billing email, VAT number, and billing address to manage subscriptions and payments. Legal basis: contract performance (Art. 6(1)(b)).
Demo bookings and sales enquiries — when you submit a demo request on our website, we use your name, email, phone, and company name to respond to your enquiry and manage our sales process. Legal basis: pre-contractual steps at your request (Art. 6(1)(b)).
Transactional emails — we send account, billing, security, and legal notices to your email address as necessary to operate the service. Legal basis: contract performance (Art. 6(1)(b)).
Security monitoring and platform integrity — we process IP addresses, usage data, and application logs to detect abuse and maintain platform security. Legal basis: legitimate interest (Art. 6(1)(f)).
Legal records — we retain records of agreement acceptance, including IP address, user agent, and timestamp, as evidence of contractual consent. Legal basis: legitimate interest (Art. 6(1)(f)).
Legal, tax, and accounting compliance — we retain financial reference data as required by Bulgarian law. Legal basis: legal obligation (Art. 6(1)(c)).
We also collect browser type, device information, approximate location, and cookie identifiers automatically when you use our website or platform.
4. Cookies
We use cookies on our marketing website to operate and secure the site, analyse traffic, and measure campaign performance. The tools we use on the marketing website — Google Analytics, Meta Pixel, Google Ads, TikTok Pixel, and LinkedIn Insight Tag — are not active inside the authenticated product environment.
Non-essential cookies are set only with your consent. You can manage your preferences through our cookie consent banner or your browser settings.
5. Third-Party Services
We work with third-party service providers who process personal data on our behalf as sub-processors. These include providers for cloud hosting, AI-assisted features, email delivery, and payment processing. A current list of our sub-processors is available at console.airdec.com/legal/spl.
We do not use customer or user content to train third-party AI foundation models.
Google Analytics: when a customer connects their Google Analytics property via OAuth, we access GA4 metrics (traffic, engagement, and conversions) using the analytics.readonly scope solely to display reports in their Airdec dashboard. This data is retrieved on demand, may be cached temporarily on Google Cloud Platform in the EU, and is not stored permanently, used for advertising, or shared with any third party. Access can be revoked at any time from the dashboard settings or at myaccount.google.com/permissions. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
6. Data Retention
We keep personal data only as long as necessary for the purpose it was collected. Lead contact data is wiped after 12 months. Operational account data is retained for the duration of the relationship and up to 12 months after cancellation. Financial and legal records are kept for up to 10 years as required by Bulgarian law. Application and security logs are retained for 90 days. Anonymised records may be kept indefinitely.
7. International Transfers
Where personal data is transferred outside the EEA — for example, to AI providers located in the United States — we ensure an appropriate transfer mechanism is in place, including EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) where applicable.
8. Your Rights
You have the right to access, correct, delete, restrict, or port your personal data, to object to processing, to withdraw consent where processing is consent-based, and to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP — cpdp.bg).
To exercise your rights, contact us at contact@airdec.com. We will respond within one month and may verify your identity before processing a request.
Where we process personal data as a processor on behalf of a business customer, requests from that customer's end users should be directed to the relevant customer. We will assist as set out in our Data Processing Agreement.
9. How We Protect Your Data
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include encryption in transit (HTTPS/TLS), encrypted storage of sensitive credentials and access tokens, access controls, audit logging on sensitive records, and secure cloud hosting in the European Union. Google Analytics data accessed via OAuth is subject to the same security measures.
10. Changes to This Policy
We will notify you by email at least 30 days before any material changes to this policy take effect. Where a change requires consent for a new processing purpose, we will obtain that consent before the processing begins. The current version is always available on our website.
11. Contact
contact@airdec.com airdec.com