Privacy Policy

1. Controller and contact

The controller is Martin Kučera, Družstevní 705/IV, 503 51 Chlumec nad Cidlinou, Czech Republic, Company ID 00959324. For questions or rights requests, use the controller’s postal address, +420 606 931 426, or Czech data box yui7vyc. No data protection officer has been appointed.

2. Processing roles

The Provider acts as controller for visitors to the service’s public website, accounts, orders, licences, payments, support, and security. For personal data in WordPress content that a customer expressly sends to the SaaS, the Provider generally acts as processor under the DPA and the customer’s instructions.

3. Data categories

• Identity, contact, billing, and account data, such as name, email, organisation, locale, and role.
• Order, payment, subscription, invoice, licence, entitlement, and service usage data. Stripe, not the Provider, processes full card numbers.
• Connected-site data, including URL, domain, WordPress, PHP and plugin versions, service status, audit findings, and publicly fetched content.
• Technical and security data such as hashed IP address, user-agent, time, URL, event type, diagnostics, and audit trail.
• When reCAPTCHA v3 protection is enabled, technical browser and interaction data from login or registration submitted directly to Google for abuse assessment.
• Customer communications, support requests, and information voluntarily supplied in a form or message.
• Agency-report branding settings, including a display name, contact line, colour, and an optional logo converted before storage to a bounded metadata-free PNG.
• Private WordPress content only after explicit opt-in for a feature that requires it.

4. Purposes and legal bases

• Contract performance: accounts, licences, sites, subscriptions, support, audits, and ordered features.
• Legal obligations: accounting, tax, consumer requests, and cooperation with authorised public bodies.
• Legitimate interests: security, fraud and abuse prevention, operational diagnostics, legal claims, and proportionate service improvement.
• Consent: only where required, such as optional marketing or explicit transmission of private content. Consent can be withdrawn for the future.

5. Recipients and providers

• ACTIVE 24, s.r.o. / WebSupport s.r.o. and their published subcontractors: hosting, infrastructure, backups, and system email delivery, mainly in the EU/EEA.
• Google LLC: only when reCAPTCHA v3 is enabled to protect public login and registration from automated abuse. Its script loads after form submission; Google may process device, browser, IP address, and interaction data and use related technologies.
• Stripe and its published subprocessors: the prepared integration for card payments, subscriptions, billing events, and fraud prevention if an approved sale is launched; Stripe may act as an independent controller for some activities. Public checkout is currently unavailable.
• Fio banka, a.s.: bank transfers and legally required banking records as an independent controller.
• Legal, accounting, security, and technical advisers only as necessary and subject to appropriate confidentiality.
• Public authorities where disclosure is required by law or a binding order.

6. AI and international transfers

The current production configuration does not use OpenAI, Anthropic, Gemini, or another external AI API. The internal aiv-template-v1 provider does not send inputs outside the service infrastructure.

Stripe, Google when reCAPTCHA is enabled, or approved subcontractors may process data outside the EU/EEA. A legally recognised mechanism, such as an adequacy decision or Standard Contractual Clauses, and supplementary safeguards where appropriate, must cover such a transfer.

7. Retention

• Raw hosted-generation input: 0 days and discarded after completion. Temporary asynchronous input is encrypted only until a job completes or fails.
• Stripe/provider webhook payloads and queue diagnostics: 30 days.
• WordPress plugin crawler logs: 30 days by default; the customer can select 1–365 days.
• SaaS crawler events: 90 days.
• Signed site-heartbeat history: 30 days; the newest evidence for each site remains as an explicit continuity exception. Site-sync idempotency digest and signed result: 8 days by default and never fewer than 7 days.
• Audit runs, usage events, LLM request accounting metadata, licence audit logs, and account-security audit events: 365 days; the open usage period remains until it closes.
• Closed support requests and messages: no more than 365 days after closure; open requests and records under an explicit legal hold are not automatically deleted.
• Account, organisation, sites, and licences: for the contract and afterwards only as needed for legal claims or obligations; following a verified request, operational data is deleted or identifiers anonymised unless a legal reason requires retention.
• Agency-report PDF and CSV files are streamed without retaining the generated file. Stored branding settings and the logo are removed during organisation erasure.
• Accounting and tax records: for the period required by applicable law. Websupport backups follow its limited rotation cycle, and deleted data expires when that cycle ends.

8. Individual rights

Subject to applicable law, you may request access, correction, erasure, restriction, and portability; object to legitimate-interest processing; and withdraw consent. Send requests to the controller’s postal address or Czech data box yui7vyc. The requester’s identity and authority may be reasonably verified first.

You may complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or another competent EU/EEA supervisory authority.

9. Cookies, profiling, and security

The public site uses no analytics or marketing cookies, and fonts are self-hosted. The SaaS uses only essential session and security cookies; theme preference is stored locally in the browser. See the Cookie Policy for details.

When reCAPTCHA v3 is enabled, submitting a login or registration form loads Google resources. Google may use its own cookies or similar technologies for security verification; details and links appear next to the form.

The service makes no decision based solely on automated processing that produces legal or similarly significant effects for a user. Safeguards include access control, encrypted transport, hashed tokens and IP addresses, tenant isolation, audit logs, limited retention, and encryption of temporary payloads.

10. Changes

This Policy will be updated when processing changes, particularly before enabling an external AI API or a new payment or analytics provider. The date and material changes will be published at the service’s public address.