Privacy Policy

1. Data Controller

Ing. Petr Kadlec, DiS., Company ID (IČO): 00724149
Email: [email protected]

2. What Data We Process

• Registration data: name, email, password (stored as a bcrypt hash)
• Profile data: phone, signature, organization (optional)
• Voice recordings: audio files uploaded by the user, transcribed using AI
• Generated documents: transcripts, extracted fields, DOCX/PDF outputs
• Payment data: processed exclusively by Stripe, Inc. — we do not store card numbers
• Technical data: IP address (rate limiting), session cookie
• Invitation request: email, an optional note and the visit source (UTM link parameters) — used solely to process the invitation
• Product statistics and diagnostics: first-party service usage events (e.g. “document created”, in-app page views, use of the record button, technical error reports) tied to the account, collected without IP addresses and without browser fingerprinting, processed exclusively by us (no third-party analytics services) and retained for no longer than 13 months — to improve the service and resolve technical issues

3. Purposes of Processing

• Providing the service (transcribing voice notes, generating documents, sending emails)
• Managing the user account and subscription
• Protection against abuse (rate limiting, email verification)

4. Legal Basis

Processing is necessary for the performance of a contract (Art. 6(1)(b) GDPR) — providing the service you have ordered. For protection against abuse we rely on our legitimate interest (Art. 6(1)(f) GDPR).

5. Third Parties (Processors)

Service	Provider	Purpose
OpenAI API	OpenAI, Inc. (USA)	Audio transcription (Whisper), field extraction and style polishing (GPT-4.1). Under the OpenAI API terms, content is not used to train models.
TypeSafe API	TypeSafe AI, Inc. (USA)	Lektor Bot mode only: recognising the school from the beginning of the transcript (the first few sentences) and checking whether the transcript describes real risk behaviour (for this check, proper names in the middle of sentences, emails and phone numbers are masked before sending). Under the TypeSafe terms, inputs are not used to train models.
Stripe	Stripe, Inc. (USA)	Payment processing and subscription management
SMTP provider	Depends on configuration	Sending emails (verification, records)
Hetzner	Hetzner Online GmbH (DE)	Server and database hosting

For transfers to the USA we rely on Standard Contractual Clauses (SCC) and data processing agreements (DPA) concluded with the respective providers.

6. Data Retention

• User account and data: for the lifetime of the account
• Audio files: temporarily; deleted from the server after processing
• After account deletion, all data is irreversibly removed

7. Your Rights

Under the GDPR you have the right to:

• Access your data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure — deletion of the account and all data (Art. 17) — in Settings → Account
• Data portability — export of your data in a machine-readable format (Art. 20) — in Settings → Account
• Object to processing (Art. 21)
• Lodge a complaint with the supervisory authority — the Czech Office for Personal Data Protection (ÚOOÚ)

8. Cookies

We only use essential login cookies: the session cookie hlasovka.sid and — only if you tick “Keep me signed in” at login — the hlasovka.remember cookie (valid for 90 days, revocable at any time by logging out). We use no tracking, analytics or marketing cookies. Both cookies are httpOnly, SameSite=lax and secure in production.

9. Contact

For any questions regarding data protection, contact [email protected]. The public procedure for requesting account deletion is available on the Account deletion page.