Privacy Policy

This Privacy Policy explains how Super Easy EOOD ("we", "us", "our"), a company registered in Bulgaria (EIK 207122172, str. Iskurska 14, s. Negovan, Sofia), collects, uses, and protects your personal data when you use GenReady (genready.ai).

We take your privacy seriously. We collect only what we need, we don't sell your data, and we give you full control over your information.

1. Who we are

For the purposes of the EU General Data Protection Regulation (GDPR), Super Easy EOOD is the data controller for the personal data described in this policy.

2. What data we collect

2.1 Account information

When you create an account, we collect:

• Email address - to identify your account and send service-related communications
• Username - to personalize your experience
• Password (hashed) - if you register with email/password
• Google account ID - if you sign in with Google OAuth
• Profile avatar - if you upload one

2.2 Scan and analysis data

When you scan a website, we collect and store:

• The URL you submitted for analysis
• Extracted text and HTML content from the scanned page
• Analysis results, including AI readiness scores, recommendations, and metadata (author, publish date, schema markup)
• Page screenshot captured during analysis

This data is stored in your account so you can review your scan history and track improvements over time.

2.3 Support messages

When you submit a support ticket, we collect your name, email address, and the content of your message. This is sent to us via email and used solely to respond to your inquiry.

2.4 Website analytics

We use Umami, a privacy-focused, cookie-less analytics tool that we self-host. It collects anonymous, aggregated usage data such as page views, referral sources, and device types. No cookies are set, no personal data is stored, and we do not share the analytics data with anyone. Individual visitors cannot be identified. The analytics script and its page-view requests travel through Cloudflare's network, so Cloudflare handles your IP address and browser details to deliver them (see section 5).

2.5 Product analytics

We also record how GenReady itself is used, so we can see which features work and what people cannot find. These records stay in our own database and are not shared with anyone. We record:

• The pages and features you use, such as page views, scans started, reports viewed, PDF downloads and requests to our API
• Help center activity: what you type into the help search, which result you open, and your answer to "Was this article helpful?"
• Errors in your browser while you use GenReady: the error message, the technical trace and the page path. We remove web address parameters, email addresses and long numbers before we store them.

With each of these events we store:

• The time, and your browser's user agent string
• Your IP address with the last part removed (for example 203.0.113.0), so it no longer points to a single connection
• Your account ID, if you are signed in
• A visitor code made from a one-way hash of your IP address and browser, using a secret that changes every day. It lets us count visitors without recognising the same person from one day to the next.

Nothing is stored on or read from your device for this: no cookies and no local storage. For help searches we remove email addresses and long numbers and keep at most 100 characters, but please do not type personal information into the search box.

We keep these records for 12 months and then delete them automatically. If you delete your account, the events linked to it are deleted straight away. You can object to this processing at any time by emailing us (see section 8).

2.6 Security data

To protect the service from abuse, we may log IP addresses in connection with rate limiting and automated attack detection. This data is used solely for security purposes.

2.7 WordPress plugin

The GenReady WordPress plugin sends data to GenReady only when a site administrator uses it. It sends the site address and the plugin and WordPress versions. When the administrator asks for a fix, it also sends the current robots.txt or llms.txt, the titles, addresses, and types of published pages and posts, or the title, author name and dates of one post. If the administrator agrees, it sends their email address to fill in the sign-in form. The plugin sets no cookies and sends no data about site visitors.

3. How we use your data

We use your personal data to:

• Provide the service - run scans, generate reports, and display your history
• Authenticate you - verify your identity when you log in
• Communicate with you - respond to support requests and send essential service notifications (e.g. password resets)
• Protect the service - detect and prevent abuse, fraud, and security threats
• Improve the service - understand how GenReady is used and what our help center is missing, through the analytics described in sections 2.4 and 2.5

We do not use your data for advertising, profiling, or automated decision-making that produces legal effects.

4. Legal basis for processing (GDPR)

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)) - processing necessary to provide the service you signed up for
• Legitimate interest (Art. 6(1)(f)) - security, fraud prevention, and improving the service through the analytics described in sections 2.4 and 2.5
• Consent (Art. 6(1)(a)) - where you voluntarily provide data, such as when submitting a support ticket

5. Third-party services

We use the following third-party services to operate GenReady:

We do not sell, rent, or trade your personal data to anyone.

6. International data transfers

Our servers are hosted in the United States by Hetzner, a European company headquartered in Germany. Some third-party services may also process data outside the European Economic Area (EEA).

Where data is transferred outside the EEA, we rely on:

• The EU-U.S. Data Privacy Framework (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission

7. Data retention

We retain your personal data indefinitely for as long as your account is active. When you delete your account, we delete all associated personal data, including scan reports and analysis history.

Product analytics (section 2.5) are kept for 12 months and then deleted automatically.

Security logs (IP-based rate limiting data) are retained for up to 90 days and then automatically purged.

8. Your rights

Under the GDPR, you have the right to:

• Access - request a copy of the personal data we hold about you
• Rectification - ask us to correct inaccurate data
• Erasure ("right to be forgotten") - ask us to delete your data
• Portability - receive your data in a structured, machine-readable format
• Restriction - ask us to limit how we process your data
• Objection - object to processing based on legitimate interest
• Withdraw consent - where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, email us at kris@genready.ai. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP) at cpdp.bg.

9. Cookies and local storage

GenReady sets up to three cookies. All three are strictly necessary for the site to work securely, so they don't require your consent:

• sessionId - a random identifier set on your first visit. We use it to protect against cross-site request forgery (CSRF) by checking that requests sent to GenReady come from your browser and not from another site. It expires after 7 days.
• x-csrf-token - a security token that works with sessionId for the same CSRF protection. It's set the first time your browser sends something to GenReady, such as starting an analysis, logging in or opening a report, and is deleted when you close your browser.
• auth-token - keeps you logged in. It's set when you log in and removed when you log out, or after 7 days.

We also keep a small amount of data in your browser's local storage, only to make features you use work: a random identifier that lets you return to a report you ran without an account, and an API key you choose to enter in the API playground. Neither is used for analytics or advertising.

We do not use tracking cookies, advertising cookies, or any third-party cookies. None of our analytics (sections 2.4 and 2.5) store or read anything on your device, which is why we do not show a cookie consent banner.

10. Age requirement

GenReady is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data, please contact us and we will promptly delete it.

11. Security

We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords, rate limiting, and automated attack detection. However, no method of electronic transmission or storage is 100% secure.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by posting a notice on the site or sending you an email. The "Last updated" date at the top reflects the latest revision.

13. Contact

If you have any questions about this Privacy Policy or how we handle your data, contact us:

• Email: kris@genready.ai
• Support page: genready.ai/support
• Company: Super Easy EOOD (Супер изи ЕООД), EIK 207122172, str. Iskurska 14, s. Negovan, Sofia, Bulgaria