Privacy Policy

Last updated: 4 October 2026

This is an English translation of the Bulgarian original. In case of any discrepancy, the Bulgarian version prevails.

This Privacy Policy explains how Paveta processes personal data when you use the app and the related services.

1. Data controller

Paveta is currently provided by:

Ivo Ivanov Stoyanov
Individual established in Bulgaria
E-mail: paveta.app@gmail.com

For questions about privacy, the processing of personal data or the exercise of your rights, you can contact us at:

paveta.app@gmail.com

2. What data we process

Paveta is designed to work without traditional registration and without a user profile with a name, password or e-mail.

Depending on the features you use, we may process the following categories of data.

2.1. Pseudonymous identifier

When you use the app, an anonymous identifier (UID) is created.

This identifier:

does not contain a name or e-mail;
is not used for advertising;
is not used to track behavior for advertising purposes;
serves the technical operation of certain features.

Because the identifier allows certain actions to be linked to the same user, we treat it as a pseudonymous identifier and not as fully anonymous data.

3. “Like” / “Dislike” features

When you use the “Like” or “Dislike” buttons on a specific bill, we may process:

the pseudonymous UID;
the identifier of the respective bill;
the choice made — “Like” or “Dislike”;
the date and time of the action.

This data is used to:

provide the “Like” / “Dislike” functionality;
remember the choice made by the user;
allow the choice to be changed or removed;
prevent or limit abuse;
keep the aggregated result working correctly.

The app may display only aggregated results, for example the total number of users who chose “Like” or “Dislike”. The individual choice of a specific user is not publicly available.

Paveta does not use this data for advertising profiling or for tracking users’ behavior for advertising purposes.

A “Like” or “Dislike” choice relates to a specific bill or legislative text and is not, in itself, used by Paveta to determine or profile the user’s political views, party affiliation or political position. Paveta does not collect information about party affiliation and does not derive political profiles of users from their choices.

Nevertheless, to the extent that the content of a choice could in certain circumstances be linked to a political opinion, Paveta takes a cautious approach to processing this information. The individual choice is linked only to a pseudonymous technical identifier, is not publicly available, and is processed only as far as necessary to provide and protect the respective feature.

4. Push notifications

When push notifications are enabled, we may process:

a push notification token;
a pseudonymous technical identifier;
the categories selected by the user;
the statuses selected;
the bills selected by the user.

This data is used solely to deliver the notifications selected by the user.

The user can turn off push notifications through the settings of the app and/or the operating system.

Paveta does not use the history of push notifications for advertising profiling.

5. Contact form

If you use the “Suggestions and questions” form, we may collect:

first name;
last name;
e-mail address;
the reason for the message;
the content of the message;
technical information needed to limit spam and abuse.

This data is used to:

respond to the inquiry;
communicate with the user;
process suggestions;
prevent abuse.

We do not use the name and e-mail provided through the form for advertising campaigns.

6. IP address

To limit spam on the contact form, information derived from the IP address may be used.

The application logic uses a cryptographic HMAC with a secret key that is stored separately, so that the IP address is not stored as a direct value for this purpose.

These records are kept only as long as necessary to limit abuse and are not used for any other purpose.

Regardless of this, Google Cloud/Firebase, which we use, may process IP addresses and other technical information in standard system and infrastructure logs under their own technical policies and retention periods.

7. Data we do not collect for advertising or analytics purposes

Paveta does not use:

Advertising ID;
Firebase Analytics;
Google Analytics;
PostHog;
Amplitude;
Sentry;
Crashlytics;
advertising SDKs;
behavioral advertising tracking.

Paveta does not sell users’ personal data.

8. Data the app does not access

Paveta does not use for its features:

GPS/precise location;
approximate location;
contacts;
camera;
microphone;
photos and photo library;
phone calls;
SMS;
Advertising ID.

If a new feature is added that requires access to additional categories of data, this Policy will be updated before or when the feature is introduced, where required.

9. Locally stored data

The following may be stored locally on the device:

consent to the Terms;
notification settings;
display settings;
saved bills;
the date of the last support reminder.

This data can be removed by uninstalling the app or through the data-clearing functions available, where provided.

10. Legislative data

Paveta processes and stores information from public official sources (parliament.bg and dv.parliament.bg) related to Bulgarian legislation.

This information may include:

title;
number;
status;
status history;
sponsors;
votes;
votes by parliamentary group;
texts of acts;
explanatory memoranda;
documents;
data from the State Gazette;
other publicly available data.

This data is not users’ personal data when it is processed as public legislative information.

11. AI processing

Paveta uses external AI services to process public legislative documents and to generate summaries and structured information.

Paveta does not send to these AI services the personal data of users collected through the app.

AI processing may be carried out through infrastructure outside the European Economic Area.

Therefore, depending on the specific infrastructure and the service used, data may be processed outside the EU/EEA.

12. Service providers and data transfers

To operate Paveta, we use external providers that may process data from the app:

Google (Firebase and Google Cloud) — anonymous identification, database, backend functions and push notifications; Gmail — receiving messages from the contact form;
Apple — Apple Push Notification service for delivering notifications to iOS devices.

For voluntary financial support, the user is redirected to PayPal, which processes payment data independently and under its own terms. Paveta does not receive payment card data.

Google and Apple may also process data outside the EU/EEA, under their own terms and data transfer mechanisms.

13. What we use the data for

We process data only as far as necessary to:

provide the features of Paveta;
send selected push notifications;
store and manage the “Like” / “Dislike” features;
maintain saved bills;
handle questions and suggestions;
limit spam and abuse;
ensure technical security;
maintain and improve the service;
comply with legal obligations.

Paveta does not use users’ personal data to sell advertising.

14. Legal bases for processing

Depending on the specific processing, the applicable legal basis may be:

performance of the service/providing a feature — where the processing is necessary for a specific feature to work;
consent — where the processing requires consent, for example certain push notifications or processing for which the law requires consent;
legitimate interest — where the processing is necessary for security, prevention of abuse, technical support or protection of the service, and the user’s interests do not override it;
compliance with a legal obligation — where such an obligation applies.

The “Like” / “Dislike” features are not treated as data on political opinions within the meaning of the special categories of personal data (see section 3). If a competent authority decides otherwise, we will apply the additional requirements of the applicable legislation.

15. Retention periods

Paveta keeps personal data no longer than necessary for the purposes for which it was collected, unless the law requires a longer period.

The main principles are:

“Like” / “Dislike” data — until the user deletes it using the “Delete my data” function or until the processing is no longer needed;
push token and subscriptions — as long as they are needed for active notifications or until unsubscription/deletion;
contact form data — as long as it is needed to answer the inquiry and to support the service, or until a deletion request is received by e-mail;
IP information (HMAC) for the contact form — as long as it is needed to limit abuse;
local data — until the app is uninstalled or the respective setting is cleared;
system logs of external infrastructure providers — according to their applicable policies and retention periods.

16. Deleting data

Paveta provides a “Delete my data” function in the app settings.

When the function is used, the following are deleted or deactivated, as far as technically applicable:

the anonymous account (UID);
the related “Like” / “Dislike” records;
the push token;
topic subscriptions;
the related settings.

Data stored only locally can be removed by uninstalling the app or through the respective settings.

Messages sent through the contact form can be deleted at the user’s request by e-mail to:

paveta.app@gmail.com

Deletion does not affect information that must be retained by law or that may lawfully be retained for the establishment, exercise or defense of legal claims.

17. User rights

Depending on the applicable legislation, users may have the right to:

be informed about how their personal data is processed;
obtain access to their personal data;
request correction of inaccurate data;
request erasure;
request restriction of processing;
object to certain processing;
withdraw consent where the processing is based on consent;
data portability, where the legal conditions are met;
lodge a complaint with a competent supervisory authority.

For Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection (CPDP, КЗЛД).

18. How to exercise your rights

For questions or requests about personal data, you can write to paveta.app@gmail.com. You can also use the “Delete my data” function directly in the settings.

To protect data from unauthorized access, we may ask for additional information needed to confirm your identity or your connection to the specific data.

19. Security

We use reasonable technical and organizational measures to protect the data we process.

They include, depending on the specific service:

encrypted data transmission;
access control;
restricting access to user data;
use of pseudonymous identifiers;
limiting the data collected to what is necessary for the respective features.

No internet service can guarantee absolute security.

20. Children

Paveta is intended for persons aged 16 or over.

Paveta is not an app designed specifically for children under 16.

If we find that we have received personal data from a person who does not meet the applicable minimum age, we may take steps to delete it where necessary.

21. International availability

Paveta is available worldwide so that people outside Bulgaria can use it too.

The content of the app mainly relates to Bulgarian legislation.

When a user uses Paveta from a country outside Bulgaria or the European Union, local personal data protection rules may also apply to the processing, where applicable.

22. Changes to the Privacy Policy

We may update this Policy when there are changes in:

the app;
the services used;
the legislation;
the way we process data;
the technical infrastructure.

The current version is always published at:

https://paveta.web.app/privacy-en

The date of the last update is stated at the beginning of the document.

23. Contact

For questions about this Policy or the processing of personal data:

Ivo Ivanov Stoyanov
E-mail: paveta.app@gmail.com
Privacy Policy: https://paveta.web.app/privacy-en

Paveta is not an official application of the National Assembly of the Republic of Bulgaria.