Privacy Policy for ZaHrani

Last Updated: September 8, 2026

Data Controller: Ariadna Net Ltd., UIC: 207161182, with its registered office and business address at:

19 Hristo Smirnenski Residential Complex, Block 19, Entrance A, Floor 1, Apartment 2

Slatina District

1574 Sofia

Bulgaria

(hereinafter referred to as "ZaHrani", "we", "our", or the "Data Controller").

Contact

Email: contact@zahrani.bg

1. INTRODUCTION

ZaHrani respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, process, store, and protect personal data when you use the ZaHrani mobile application, the website zahrani.bg, and any related services (collectively, the "Service").

This Privacy Policy has been prepared in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);
• the Bulgarian Personal Data Protection Act;
• and other applicable European Union and Bulgarian legislation.

2. WHO MAY USE THE SERVICE

The Service is intended exclusively for individuals who are at least eighteen (18) years of age.

By creating an account, the User represents and warrants that they are the child's parent, legal guardian, or another legally authorized caregiver and are entitled to provide information relating to the child.

ZaHrani does not knowingly collect personal data directly from children.

3. WHAT PERSONAL DATA WE COLLECT

3.1 Account Information

When creating an account, we may collect:

• name;
• email address;
• Google Sign-In identifier;
• Apple Sign-In identifier;
• subscription information;
• language and regional preferences.

3.2 Child Profile Information

Users may voluntarily provide information relating to a child, including:

• name or nickname;
• date of birth;
• age;
• gender (optional);
• allergies;
• food reactions;
• introduced foods;
• notes;
• dietary preferences and restrictions.

All such information is provided voluntarily by the User.

3.3 Usage Information

We may collect technical information relating to your use of the Service, including:

• date and time of access;
• features used;
• device information;
• operating system;
• application version;
• IP address;
• technical logs.

3.4 Payment Information

Payments are processed exclusively through the Apple App Store or Google Play.

ZaHrani does not collect or store:

• payment card numbers;
• CVV/CVC security codes;
• bank account information;
• other payment credentials.

We receive only subscription status information necessary to provide Premium features.

4. HOW WE USE YOUR PERSONAL DATA

We use personal data to:

• create and manage user accounts;
• provide the functionality of the Service;
• generate personalized meal plans;
• track complementary feeding progress;
• provide customer support;
• improve our products and services;
• analyze how the Service is used;
• prevent fraud, abuse, and unauthorized access;
• comply with applicable legal obligations.

5. AI PROCESSING OF DATA

ZaHrani uses artificial intelligence ("AI") technologies to generate personalized meal plans and recommendations.

For this purpose, certain information provided by the User may be processed by carefully selected third-party AI service providers.

Only the information necessary to generate the requested meal plan or recommendation is processed.

Our AI systems do not make automated decisions that produce legal or similarly significant effects concerning Users within the meaning of Article 22 of the GDPR.

All AI-generated recommendations are provided for informational purposes only and do not constitute medical, nutritional, or professional healthcare advice.

6. LEGAL BASIS FOR PROCESSING

We process personal data on one or more of the following legal bases under the General Data Protection Regulation (GDPR):

• performance of a contract for providing the Service (Article 6(1)(b) GDPR);
• compliance with legal obligations (Article 6(1)(c) GDPR);
• our legitimate interests, provided that such interests are not overridden by your rights and freedoms (Article 6(1)(f) GDPR);
• your consent, where consent is required by applicable law (Article 6(1)(a) GDPR).

7. SHARING OF PERSONAL DATA

ZaHrani does not sell Users' personal data.

We may share personal data only where necessary with carefully selected third-party service providers, including:

• cloud infrastructure providers;
• database providers;
• analytics providers;
• artificial intelligence technology providers;
• authentication service providers;
• push notification providers;
• payment platform providers;
• governmental authorities or public bodies where required by applicable law.

All third-party providers process personal data only on our behalf or as independent controllers where applicable, and in accordance with applicable data protection laws.

Where required, we enter into appropriate Data Processing Agreements (DPAs) with our processors.

8. GOOGLE SIGN-IN AND APPLE SIGN-IN

If you choose to sign in using Google Sign-In or Apple Sign-In, we may receive:

• your name;
• your email address;
• a unique account identifier provided by the authentication service.

We receive only the information that you authorize the provider to share with us.

Your authentication credentials (such as your Google or Apple password) are never accessible to ZaHrani.

9. ANALYTICS SERVICES (GOOGLE ANALYTICS FOR FIREBASE)

To understand how the app is used and to improve it, we use Google Analytics for Firebase, a service provided by Google Ireland Limited.

What is collected:

• which screens are opened and how often;
• general events — sign-in, registration, a weekly menu generated, a meal logged, the subscription screen opened;
• session duration, app version, device model and operating system;
• approximate country, derived from the IP address;
• an anonymous installation identifier generated by Firebase, which is not linked to your account;
• whether the account has an active subscription (yes/no).

What is not collected: names, email addresses, phone numbers, any data about the child (name, date of birth, feeding diary, allergies, reactions) or any other personal data. That data stays solely on our own server.

Legal basis: legitimate interest (Article 6(1)(f) GDPR) — the statistics are anonymous and do not allow a user or a child to be identified.

Opting out: at any time from the app — Profile → "Anonymous statistics". Once switched off, nothing is sent to Google.

Retention by Google: event data for up to 14 months; aggregated reports for the lifetime of the project. The data may be processed outside the EU under the safeguards described in section 14.

10. DATA RETENTION

We retain personal data only for as long as necessary to:

• provide the Service;
• comply with legal obligations;
• establish, exercise, or defend legal claims;
• protect our legitimate business interests.

When personal data is no longer required for these purposes, it will be securely deleted, anonymized, or otherwise disposed of in accordance with applicable laws and our internal data retention procedures.

11. ACCOUNT DELETION

Users may request the deletion of their account at any time.

An account may be deleted by:

• using the account deletion feature available within the Application; or
• sending a request to contact@zahrani.bg.

Following verification and processing of the request, personal data will be deleted or irreversibly anonymized unless we are required or permitted by applicable law to retain certain information.

12. YOUR RIGHTS UNDER THE GDPR

Subject to applicable law, you have the following rights regarding your personal data:

• the right of access;
• the right to rectification;
• the right to erasure ("right to be forgotten");
• the right to restrict processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent at any time where processing is based on consent;
• the right not to be subject to a decision based solely on automated processing where applicable;
• the right to lodge a complaint with a competent data protection authority.

We will respond to requests concerning your rights within the time limits established by the GDPR.

13. DATA SECURITY

ZaHrani implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, destruction, or accidental loss.

Such measures include, where appropriate:

• encrypted communications (TLS/HTTPS);
• access control mechanisms;
• secure server infrastructure;
• regular backups;
• security monitoring;
• logging and auditing;
• internal access restrictions.

While we strive to protect your personal data using commercially reasonable security measures, no method of electronic transmission or storage can be guaranteed to be completely secure.

14. INTERNATIONAL DATA TRANSFERS

Some of our service providers may process personal data outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, ZaHrani ensures that appropriate safeguards are implemented in accordance with Chapter V of the GDPR, including, where applicable:

• the European Commission's Standard Contractual Clauses (SCCs);
• adequacy decisions;
• or other legally recognized transfer mechanisms.

15. CHANGES TO THIS PRIVACY POLICY

ZaHrani may update this Privacy Policy from time to time.

Where material changes are made, Users may be notified through:

• the Application;
• email;
• the website;
• or other appropriate communication channels.

The "Last Updated" date at the top of this Privacy Policy indicates when it was most recently revised.

16. CONTACT INFORMATION

Data Controller

Ariadna Net Ltd.

UIC: 207161182

Registered Address:

19 Hristo Smirnenski Residential Complex, Block 19, Entrance A, Floor 1, Apartment 2

Slatina District

1574 Sofia

Bulgaria

Email:

contact@zahrani.bg

Website:

www.zahrani.bg

17. COMPLAINTS

If you believe that your rights under applicable data protection laws have been violated, you have the right to lodge a complaint with the competent supervisory authority.

For Users in Bulgaria, the competent authority is:

Commission for Personal Data Protection (CPDP)

Address:

2 Prof. Tsvetan Lazarov Blvd.

1592 Sofia

Bulgaria

Website:

https://www.cpdp.bg

You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work, or the place where the alleged infringement occurred, as provided under Article 77 of the GDPR.

18. COOKIES AND SIMILAR TECHNOLOGIES

When you use the ZaHrani website or certain features of the Service, we may use cookies and similar technologies to improve functionality, enhance security, analyze usage, and personalize your experience.

These technologies may include:

• essential cookies required for the operation of the Service;
• analytics cookies;
• performance monitoring technologies;
• authentication technologies;
• similar technologies provided by third-party service providers.

Where required by applicable law, we will obtain your consent before placing non-essential cookies or similar tracking technologies on your device.

You may manage your cookie preferences through your browser settings or, where available, through the cookie preferences available on our website.

19. CHILDREN'S PRIVACY

Protecting children's privacy is particularly important to us.

ZaHrani is intended for use only by adults who are parents, legal guardians, or other legally authorized caregivers.

We do not knowingly collect personal data directly from children.

Any information relating to a child is provided voluntarily by an adult User who confirms that they have the legal authority to provide such information.

If we become aware that personal data has been collected directly from a child without appropriate authorization, we will take reasonable steps to delete such information as soon as practicable.

20. PRIVACY CONTACT

If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact us at:

Email: privacy@zahrani.bg

We will make reasonable efforts to respond to your request without undue delay and, where applicable, within the time limits established by the GDPR.

21. AI SERVICE PROVIDERS

Certain AI-powered features of the Service rely on trusted third-party artificial intelligence providers.

When AI functionality is used, only the information reasonably necessary to generate the requested meal plan, recommendation, or response is processed.

ZaHrani carefully selects service providers that maintain appropriate security and privacy standards and, where required, enters into contractual arrangements to ensure compliance with applicable data protection laws.

We do not intentionally use personal data submitted through the Service to train publicly available AI models unless explicitly stated and permitted by applicable law or with the User's consent.

22. AUTOMATED DECISION-MAKING

ZaHrani does not make decisions based solely on automated processing that produce legal effects concerning Users or similarly significantly affect them within the meaning of Article 22 of the GDPR.

Artificial intelligence is used solely as a decision-support tool to generate informational recommendations.

All decisions relating to a child's nutrition, feeding, and wellbeing remain entirely under the control and responsibility of the User.

23. DATA RETENTION PERIODS

Personal data is retained only for as long as necessary to fulfill the purposes described in this Privacy Policy.

Typical retention periods include:

• Account information: for as long as the account remains active and for a limited period thereafter where necessary to comply with legal obligations or resolve disputes.
• Child profile information: until deleted by the User or upon account deletion, unless retention is required by law.
• Technical logs: retained only for the period necessary to ensure the security, maintenance, and proper functioning of the Service.
• Subscription records: retained for the period required by applicable accounting, tax, and financial regulations.
• Customer support communications: retained only for as long as reasonably necessary to respond to inquiries, improve our services, or establish, exercise, or defend legal claims.

Where retention is no longer necessary, personal data will be securely deleted or irreversibly anonymized.

24. DATA BREACH NOTIFICATION

ZaHrani maintains procedures designed to detect, investigate, and respond to personal data breaches.

Where required by applicable law, we will notify the competent supervisory authority and affected Users without undue delay in accordance with the GDPR.

25. CHANGES TO OUR PROCESSING ACTIVITIES

As the Service evolves, we may introduce new features or technologies that require the processing of additional categories of personal data.

Where such changes materially affect your privacy rights or the way we process your personal data, we will update this Privacy Policy and, where required by law, provide appropriate notice or obtain your consent before the changes take effect.