Privacy Policy

The supervisory authority for personal data protection in Bulgaria is the Commission for Personal Data Protection.

Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., Bulgaria

Phone: +359 2 915 3 518

Website: www.cpdp.bg

We collect and process your personal data pursuant to Article 6(1) of Regulation (EU) 2016/679 (GDPR), specifically:

• Performance of a contract or taking steps to enter into a contract.

• Compliance with a legal obligation.

• Legitimate interests of the Controller (communication, service improvement).

• Your explicit consent (for marketing communications).

Personal information from contact forms: first and last name, email address, phone number (optional), website URL (optional), budget information, selected services, message/inquiry.

Technical information: IP address, browser type and operating system, visit time and pages visited, server log data.

Data entered into our AI tools: the text, URLs and parameters you submit to a tool, and the generated output.

• Lawfulness, fairness, and transparency.

• Purpose limitation.

• Data minimization.

• Accuracy and currency of data.

• Storage limitation.

• Integrity, confidentiality, and security.

At present the website only sets strictly necessary cookies and local storage. We do not use analytics, marketing or tracking cookies, and we do not load third-party scripts before consent.

Essential cookies: required for the website to function properly (stored cookie choice, language preference, technical form protection). Cannot be disabled.

Analytics and marketing categories: available in the consent banner but currently inactive. If we introduce such tools in the future, they will only load after your prior consent.

You can change your cookie settings at any time via the "Cookie Settings" button in the website footer.

• Respond to your inquiries.

• Provide the services you requested.

• Improve our website and services.

• Send you marketing communications (only with consent).

• Website audits for potential clients to provide relevant offers.

• Statistical purposes and user behavior analysis.

• Comply with legal obligations.

The Company uses the following data processors (sub-processors):

• Supabase Inc. (database hosting and authentication, EU region) — storage of form submissions, leads and tool results.

• Cloudflare, Inc. (Turnstile) — protecting our forms from spam and automated abuse.

• Google LLC (Gemini via the Lovable AI Gateway) — processing the text you enter into our AI tools in order to generate a result. Your inputs are not used to train models.

• Lovable Labs Incorporated — website hosting and delivery.

• Resend — sending email notifications and GDPR request confirmations.

International transfers: Cloudflare, Inc., Google LLC, Lovable Labs Incorporated and Resend are established outside the EEA (primarily in the United States). Transfers to them are made on the basis of the European Commission's Standard Contractual Clauses and/or certification under the EU-US Data Privacy Framework, together with supplementary technical measures (encryption in transit and at rest). A copy of the applicable safeguards is available on request at the email address below.

All above-mentioned data processors comply with GDPR requirements. The Company does not sell or share your personal data with third parties for marketing purposes without your explicit consent.

• Contact form inquiries: up to 24 months from last communication.

• Client and partner data: 5 years after contract termination.

• Accounting documents: up to 11 years as required by law.

• Job applicants: 6 months after recruitment completion.

These periods are enforced automatically: a nightly job anonymises or deletes form submissions, leads, tool results and resource downloads older than 24 months, so no manual action is required.

To protect our website and forms we process your IP address, user agent (browser/device) and request timestamp. This data is used to: protect against spam and automated submissions (Cloudflare Turnstile), rate-limit requests to our AI tools and forms, and investigate technical incidents and abuse attempts.

Legal basis: legitimate interest under Article 6(1)(f) GDPR - protecting our infrastructure and preventing abuse.

IP addresses are not used for profiling, advertising or behavioural analysis. Server logs and technical abuse-prevention records are kept for a short period (up to 12 months) and then deleted or anonymised; form data follows the general 24-month period.

The free tools on this website use generative artificial intelligence. The text, URLs and parameters you enter are sent for processing to Google LLC (Gemini models) via the Lovable AI Gateway in order to generate a result.

Your inputs are not used to train the models. Please do not enter personal data about third parties, or sensitive or confidential information.

Outputs are AI-generated and may contain inaccuracies. They are informational only, do not constitute professional, legal, financial or tax advice, and should be reviewed by a human before use. No automated decision-making with legal effect on you takes place.

Tool usage records (input, output and technical metadata) are retained for up to 24 months for abuse prevention and service improvement.

Right to access: request a copy of your personal data.

Right to rectification: request correction of inaccurate data.

Right to erasure ("right to be forgotten"): request deletion of your data. Submit a request at /en/data-deletion.

Right to restriction of processing.

Right to portability: request transfer of your data in a readable format.

Right to object, including to direct marketing.

Right to withdraw consent at any time by emailing info@fourpillars.bg.

If the Controller identifies a security breach of your personal data that may pose a high risk to your rights and freedoms, we will notify you without undue delay about the breach and the measures taken.

The Company does not collect or process special categories of personal data, such as data revealing racial or ethnic origin, political, religious or philosophical beliefs, genetic or biometric data, health data, or sexual orientation.

The Company does not perform automated decision-making and does not collect data from individuals under 14 years of age without explicit consent from their parents or legal guardians.

In case of violation of your rights, you have the right to file a complaint with the Commission for Personal Data Protection (address and contacts in section 1).

Four Pillars Ltd. (trade name: 4 Pillars Digital)

UIC: 207344664

Address: Ruse 7015, 35 Gotse Delchev Blvd., Bulgaria

Phone: +359 877 215 749

Email: info@fourpillars.bg

Website: https://fourpillars.bg/

The Company may amend this Privacy Policy. The latest version will always be available at https://fourpillars.bg/privacy/.