Privacy policy

1. Responsibility for your data

The operator identified on this page controls processing for ZUKKO accounts, the catalogue, security and platform support.

A shop, service provider or employer is separately responsible for data it receives to sell goods, provide a service or consider an application. Authorised staff have access within their assigned permissions. Access to the built-in CRM does not authorise unrelated marketing.

2. Data collected and its sources

Data comes from you, participants in your orders and appointments, authorised business staff, and the sign-in and payment services you use. Required fields are needed for the selected function; without them an account, order or appointment may not be possible. Optional fields can be left blank.

• Account: name, verified email, phone and verification status, city, language and sign-in identifier. Google sign-in supplies the profile information you authorise.
• Publications: descriptions, photos, prices, categories, location and chosen public contacts; business details, logos and banners.
• Communication and transactions: messages, price offers, bids, orders, collection or delivery arrangements, payment status, returns, reviews and support requests.
• Appointments and CRM: service, date, time, customer name, phone, email, operational notes and payment records. Applications and CVs are processed if you use the jobs section.
• Technical data: request IP address, its hash used for rate limiting, browser information, errors, request times and security events.
• AI: your request, supplied conversation history, selected images and additional product information.

3. Purposes and legal grounds

Registration, publication, messaging, orders and appointments are processed to perform our contract with you or take steps at your request before a contract (GDPR Article 6(1)(b)).

Preventing abuse, protecting accounts, investigating complaints and defending claims rely on the legitimate interests of the operator and users, balanced against your rights (Article 6(1)(f)). Statutory records and mandatory authority requests rely on applicable legal obligations (Article 6(1)(c)).

Where a feature requires consent, such as optional publication of a contact phone, that consent applies to the stated purpose (Article 6(1)(a)). You can withdraw it without affecting earlier lawful processing. Marketing consent is not required for ordinary use of ZUKKO.

4. Public and restricted information

Listings, storefronts, portfolios, reviews, seller names, cities and selected public contacts can be viewed by visitors and indexed by search engines. Do not put documents, a precise home address or other people’s contacts in a public description unless you intend and are entitled to disclose them.

Messages, orders and appointments are available to their participants, authorised staff of the relevant business, and administrators to the extent needed for support or security. They are not public catalogue entries. Messaging is not end-to-end encrypted.

A PDF CV is intended for the selected employer and its authorised team. Withdrawing an application removes access through ZUKKO, but cannot delete copies lawfully retained by a recipient. Merely entering a phone number does not transfer another person’s listings to you.

Do not upload medical records, diagnoses, card details or other sensitive information into listings, AI prompts or general CRM notes. ZUKKO is not a medical records system.

5. External listing sources

Some catalogue entries may originate from external sources, including SS.lv / SS.com, or import files. They may contain listing text, photos, price, city, seller contacts and a source link.

Public availability alone does not authorise unrestricted republication. Import and contact display require an appropriate basis and the necessary rights. An imported listing does not establish that its author registered with ZUKKO or endorsed a partnership.

If an entry concerns you, you can request source information, correction, restricted display or removal by supplying its URL. Transferring management requires verification of your connection to the listing. You do not need a ZUKKO account to make a request about your personal data.

6. Providers and recipients

Cloudflare and Sites infrastructure provide hosting, data and file storage, and technical protection. Supabase provides sign-in and account verification. Resend sends notifications. Stripe processes online payments, refunds and recipient onboarding when those functions are available.

Payment details and identity-verification documents are entered directly into Stripe. ZUKKO receives necessary transaction identifiers, amounts and statuses; card numbers and CVCs are not stored in the ZUKKO database.

AI requests, selected images and product details are transmitted through the Iluvora integration to an AI provider. The payload depends on the chosen function; ordinary catalogue viewing does not send photos for AI analysis. Only submit information needed for your request.

When you choose Google sign-in or follow a WhatsApp link, those services process information under their own policies. The selected shop, professional or employer also receives relevant order, appointment or application data. Disclosure to public authorities requires a legal basis.

7. AI and automated processing

AI assists search, descriptions, translations, indicative prices and images. Results can be wrong; you review the facts, publication and price.

Automated checks limit requests, verify access, match verified phones, calculate availability and prevent duplicate operations. ZUKKO does not make employers’ hiring decisions or provide medical or credit decisions.

If an automated check blocks account use or matches your information incorrectly, contact the operator for human review. This policy does not promise that third-party AI services never retain requests; you can ask the operator for the applicable processing arrangements.

8. Cookies and browser storage

ZUKKO uses technical cookies for sign-in, security and returning to the chosen page after authentication. Your selected language is stored in localStorage under zukko-language. This is not an advertising profile.

With your consent, ZUKKO collects first-party analytics: random browser and visit identifiers, page paths without search parameters, referrer and campaign UTM labels, device and browser category, country, language and action types. Successful account creation and listing submission are used for the conversion funnel. Analytics does not store message content, search phrases, phone numbers or IP addresses. Reports are administrator-only. No advertising pixels are used.

The visitor cookie lasts up to 180 days; the visit cookie lasts up to 30 minutes after activity. Your analytics choice is stored in localStorage for up to 180 days. Change it through Analytics preferences in the footer of the main ZUKKO pages. Declining stops future traffic collection and removes analytics cookies; it does not delete previously collected statistics. Account, listing and order totals also use operational site records. Technical sign-in and payment cookies are managed separately.

9. Retention, security and international transfers

Account and publication data is retained while necessary to operate them. Transaction, appointment and support histories are retained while needed for obligations, disputes and claims. Payment and accounting records may have longer statutory retention. Purpose, applicable duties and claim periods determine retention.

Hiding a listing or cancelling an appointment does not erase its full history. Erasure requests are assessed separately; necessary records may be restricted rather than immediately destroyed. Independent recipients and search engines handle their copies under their own rules.

Safeguards include HTTPS, authorisation checks, role-based access and request limits. No internet service can guarantee absolute security.

Provider infrastructure may process data outside the EEA. Transfers must rely on an applicable adequacy decision or GDPR safeguards, such as standard contractual clauses. Ask the operator for recipient details, the safeguards used and how to obtain a copy.

10. Your rights and requests

Where GDPR applies, you can request access and a copy, correction, erasure, restriction and portability; object to legitimate-interest processing; and withdraw consent.

Write to the operator email shown above, identifying the account or listing and your request. Do not send passwords, sign-in codes or a full ID scan without a specific need. Any identity check should request only proportionate information.

A response is normally provided within one month. A lawful extension will be explained within that period. You can complain to Datu valsts inspekcija (www.dvi.gov.lv) or another competent supervisory authority.

11. Policy changes

The version date appears at the top. Material changes in purposes or processing are explained before the new processing starts, with fresh consent where required. Updating this policy does not authorise unrestricted new uses of existing data.