Privacy Policy

1. Controller

The controller of the personal data of Jedro+ users is Sonja Žužek s.p., Prešernova cesta 21A, 1234 Mengeš, Slovenia, registration number 9323228000. Tim Kogej is responsible for data protection. Contact for all questions and requests: tim.kogej@jedroplus.com.

For the data of clients, staff and callers that businesses (e.g. salons) keep in the app, that business is the controller; the Provider processes it only on its behalf (see section 8).

2. Data we process

• Account data: name, email address, password (stored as a hash), team role, app language.
• Business data: name, industry, address, country, tax number, contact phone and email, logo, opening hours, settings.
• Subscription and payment data: plan, add-ons, message usage, invoices. Card data is processed by Stripe; the Provider does not see it.
• Technical data: IP address and time of requests (for security and abuse prevention), server error logs.
• Communication: messages the User sends the Provider (e.g. enquiries, support).

3. Purposes and legal bases

• Performance of the contract (Art. 6(1)(b) GDPR): creating the account, providing features, billing, support, service notices (e.g. allowance used up, failed payment).
• Legal obligations (Art. 6(1)(c) GDPR): keeping invoices and accounting records.
• Legitimate interests (Art. 6(1)(f) GDPR): security and abuse prevention, fixing errors, improving the service based on aggregated, non-personal statistics.

We do not sell data and do not use it for third-party advertising.

4. How long we keep data

• Account and business data: for the duration of the contract and 90 days after it ends, then deleted.
• Invoices and accounting records: as long as the law requires (10 years for invoices).
• Technical data for abuse prevention: short term; error logs: at most 30 days.

5. Who we share data with

Data is processed by carefully selected processors (hosting, database, email, SMS, payments, telephony, AI models) under data processing agreements. The list is published on the "Sub-processors" page.

We may disclose data to public authorities where the law requires it.

6. Transfers outside the EU

The database, app hosting, email and automation server are in the EU. Some providers (AI language and voice models, telephony, part of the payment system) also process data in the USA. Such transfers are protected by the European Commission's Standard Contractual Clauses and, where the provider participates, the EU-US Data Privacy Framework.

7. Cookies

The app uses only strictly necessary cookies and local storage: for sign-in (session), the chosen language and the chosen business. We use no analytics, advertising or tracking cookies, so no cookie consent is needed.

8. Salons' client data

If you are a client of a business that uses Jedro+ (e.g. a salon), that business controls your data. The Provider processes it only on the business's instructions, for bookings, reminders, notices and the other features the business uses. To exercise your rights, contact the business directly; the Provider will help it.

• Data that may be processed: first and last name, email, phone number, gender, language, notes, appointment history, payments, marketing consent.
• News and offers: every such message contains an unsubscribe link. After unsubscribing you no longer receive them; appointment reminders are still sent.
• Calls to Receptionist+: the call is recorded and transcribed so the AI assistant can book an appointment or pass on a message. You are told this at the start of the call. Recordings and transcripts are kept for 90 days.
• The log of sent SMS (number, time, delivery status) is kept for 12 months.

9. Automated decision-making

AI features prepare answers and suggestions; they do not make decisions with legal or similarly significant effects on individuals.

10. Security

Data is encrypted in transit (HTTPS/TLS) and stored with certified providers. Access is limited by roles and database-level rules; each business's data is kept separate. Only an authorised person at the Provider has access, when needed for operation or support.

11. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Send requests to tim.kogej@jedroplus.com; we reply within one month.

You may lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or with the supervisory authority in your country.

12. Changes

We may update this policy. We inform users of material changes by email; the effective date is shown at the top.