Inquesta · Legal

Privacy Policy

Effective date: August 2026 · Controller: Sofia, Bulgaria ("Inquesta", "we") · Contact: legal@inquesta.ai

1. Scope

This policy explains how we process personal data when you visit inquesta.ai, hold an account, submit an error flag or a right of reply, or contact us — and how personal data of people named in our AI-generated reports is handled. It is incorporated into our Terms of Service. We process personal data under the EU General Data Protection Regulation (GDPR) and Bulgarian law.

2. Data we process, purposes, and legal bases

a) Visitors

When you visit the site we process technical data — IP address, browser and device information, pages requested, timestamps — in server logs, to deliver the site securely and defend against abuse (Art. 6(1)(f) GDPR, legitimate interest in operating a secure service). With your consent, we also process analytics data via cookies — see Section 5 (Art. 6(1)(a) GDPR).

b) Account holders

If you register an account we process the data you provide — email address, name, credentials — to create and operate your account (Art. 6(1)(b) GDPR, performance of a contract). If paid plans are offered, billing data is processed for the same basis and for legal accounting obligations (Art. 6(1)(c) GDPR).

c) Error flags, right of reply, and correspondence

If you report an error, submit a right of reply, or write to us, we process your name, contact details, and the content of your submission to operate our corrections & right of reply process (Art. 6(1)(f) GDPR — legitimate interest in accurate, correctable reporting; and, where you are exercising a legal right, Art. 6(1)(c)). Note that right-of-reply responses are, by design, appended verbatim to the published report — submit only what you are prepared to see published. The submission itself and the resulting re-check are logged in the report's evidence record.

3. No advertising, no profiling of readers

We do not sell personal data, we do not run third-party advertising, and we do not build behavioral profiles of readers. No decisions producing legal or similarly significant effects on you are made by automated means based on your visitor or account data.

4. Personal data appearing in reports

Inquesta reports are produced by automated AI systems from publicly available sources and may name living persons. This processing is based on our legitimate interest, and the public's, in access to source-transparent information on matters of public interest (Art. 6(1)(f) GDPR), subject to strict safeguards:

Reports draw on published sources, each cited and linked; adverse claims about named living persons are always attributed to their source and never graded above the strength of that attribution (see Grade definitions).
Any named person may use the right-of-reply channel; responses are appended verbatim within 72 hours and trigger a mandatory automated re-check.
Complaints alleging GDPR violations or defamation go to legal@inquesta.ai; the disputed passage is annotated as DISPUTED immediately upon a facially credible complaint, pending re-check. Claims that cannot be adequately resolved are removed.
You may object to the processing of your personal data in a report (Art. 21 GDPR) and request erasure (Art. 17 GDPR) via the same channel; we balance each request against the public-interest and freedom-of-information grounds recognized by the GDPR and respond within one month.

5. Cookies and analytics

The site uses two kinds of storage: strictly necessary storage, which works without consent, and analytics cookies, which are set only if you accept them in the cookie banner. You can decline analytics entirely and the site works identically; you can withdraw consent at any time via Cookie settings, which reopens the banner.

Strictly necessary

Name	Type	Purpose	Duration
authjs.*	Cookie	Signing you in: keeping your session, returning you to the page you were on, and protecting sign-in against cross-site request forgery	Session
inq_analytics_consent	Cookie	Remembering whether you accepted or declined analytics cookies	180 days
inquesta-ai-disclosure-seen	Local storage	Remembering that you dismissed the AI-disclosure banner	Until you clear site data

Analytics — consent required

With your consent, we use Google Analytics 4, a web-analytics service of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland), to understand in aggregate how the site is used — pages visited, approximate region, device type — so we can improve it. IP addresses are not logged or stored by Google Analytics 4. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable at any time.

Name	Provider	Purpose	Duration
_ga	Google	Distinguishes visitors (random client ID)	2 years
_ga_GVQ74WMQ0G	Google	Maintains session state for this site	2 years

Google may transfer analytics data to Google LLC in the United States. Such transfers rely on the EU–US Data Privacy Framework and, where applicable, Standard Contractual Clauses (Art. 45–46 GDPR). Details: Google's privacy policy; you can additionally block Google Analytics with the browser opt-out add-on.

6. Recipients and processors

We share personal data only with processors bound by Art. 28 GDPR data-processing agreements: hosting and infrastructure providers, e-mail delivery providers, and — with your consent — Google as our analytics provider. Report-generation AI providers process report content (which may include published information about named persons, per Section 4), not your visitor or account data. We disclose data to authorities only where legally required.

7. Retention

Server logs are kept up to 12 months for security. Account data is kept for the life of the account and deleted or anonymized within 3 months of closure, except where accounting law requires longer. Error-flag and right-of-reply records are kept as long as the related report is published, as part of the public corrections record. Analytics data is retained in Google Analytics for 14 months.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21), and the right to withdraw any consent at any time with effect for the future. Contact legal@inquesta.ai — we respond within one month. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg) or the supervisory authority of your habitual residence.

9. Changes

We may amend this policy; the effective date above always reflects the current version, and material changes are announced on the site before they take effect.