Privacy Policy

Effective 5 October 2026

This is an English translation. If there is any difference between versions, the Bulgarian version prevails.

1. Who controls your data

The data controller is RIZN LTD, company ID (EIK) 131425705, VAT No. BG131425705, Sofia, Bulgaria ("Orjo", "we"). We process data under the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act. For any question, email info@orjo.com.

2. What we collect

• Account: name, email, password (stored only as a secure hash, never in plain text), language.
• Billing: invoice details (company, company ID, VAT number, address) and payment history. Card details are entered directly with Stripe. We only see the card brand and last 4 digits.
• Your website: its address and the public content of its pages (texts, categories, products) that Orjo reads to understand your business, plus the brand description and settings you enter.
• Connected platforms: access keys and permissions for WordPress, Shopify or Google Search Console, stored encrypted. From Search Console we read your website's search and ranking data.
• Technical data: IP address, browser, login times and system logs needed for security and troubleshooting.
• Correspondence: emails you send us.

We do not collect data about your website's customers or visitors.

3. How we use it

We do not sell data. We do not use your content to train artificial intelligence models, and the AI model providers we work with do not use it for training under their API terms. Orjo makes no automated decisions with legal effects on you.

4. The WordPress plugin (Orjo Connector)

The plugin generates an access key that is stored in your WordPress database. Using this key, Orjo sends articles, featured images, meta descriptions and structured data to your website, and the plugin publishes them. Images are downloaded from Orjo's servers. The plugin does not send any personal data about your website's visitors or users to Orjo. When uninstalled, the plugin deletes its key and settings. Published articles remain.

5. The Shopify app

When you install the app, Shopify gives us your store's name, domain and email, read access to products and collections, and write access to the blog (read_products and write_content scopes). We have no access to your store's customers or orders and do not store them. When you uninstall the app, we stop all work for the store. When Shopify sends us a request to erase the store's data, we delete it within 30 days, except data we are legally required to keep (such as invoices).

6. Who we share it with

We work with carefully selected service providers (processors) who handle data only on our instructions and under data processing agreements that require confidentiality, security and GDPR compliance:

The current list of processors is available on request at info@orjo.com.

We send AI providers the website content and brand description needed for your articles. We do not send them your account or payment details. We may also disclose data to public authorities where required by law, or to a buyer if the business is sold (this policy continues to apply).

7. Transfers outside the EU

Where a provider processes data outside the European Economic Area (for example in the USA), the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

8. How long we keep it

• Account, website and articles: while your account is active. After your subscription ends we keep them so you can come back. If you don't log in for 12 months, we will warn you and delete them 30 days later.
• Minimal domain record (for the "one trial per domain" rule): up to 3 years.
• Invoices and accounting records: 10 years, as required by the Bulgarian Accountancy Act.
• System logs: up to 12 months.
• Correspondence: up to 3 years.

If you ask for deletion earlier, we delete everything the law does not require us to keep.

9. Cookies

We use only cookies that the website and app cannot work without: login, session and form protection. We do not use advertising or tracking cookies. If we ever add analytics cookies, we will ask for your consent first.

10. Security

All connections are encrypted (HTTPS). Passwords are stored as hashes, and the access keys to your websites are encrypted. Access to data is limited to the people who maintain the service. If a breach puts your rights at risk, we will notify the Bulgarian Commission for Personal Data Protection within 72 hours, and you where the law requires.

11. Your rights

You have the right to:

• access your data and get a copy;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict processing;
• receive your data in a machine-readable format (portability);
• object to processing based on legitimate interest;
• withdraw consent at any time.

Email us at info@orjo.com. We reply within 30 days. You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, or with the supervisory authority in your country.

12. Changes

We may update this policy. For material changes we will notify you by email or in the app before they take effect. The date at the top shows the latest revision.

13. Contact

RIZN LTD, Sofia, Bulgaria
Email: info@orjo.com