This Privacy Policy explains how HNK CZ s.r.o., Company ID 10719008, Piletická 486, 503 41 Hradec Králové, Czech Republic ("we", "us"), processes personal data when you visit aivisibility.niftyminds.cz or use the aivisibility service (the "Service"). For data that you and your organisation put into the Service (brands, prompts, connected Google data), we act as a processor on your behalf under the Data Processing Agreement; this Policy describes the processing for which we are the controller.
The controller is HNK CZ s.r.o. (brand nifty — minds). Contact for privacy matters: aivisibility@niftyminds.cz. We have not appointed a data protection officer because we are not required to.
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: e-mail address, name, Google account identifier (if you sign in with Google), sign-in timestamps, role in an organisation. | Creating and securing your account, signing you in, sending transactional e-mails (sign-in links, invitations, measurement finished, quota and trial notices, payment issues). | Performance of the contract (Art. 6(1)(b) GDPR). |
| Organisation and billing data: company name, country, VAT ID, billing e-mail, Stripe customer and subscription identifiers, invoice numbers and amounts. | Billing, invoicing and accounting. | Contract (Art. 6(1)(b)); legal obligation to keep accounting records (Art. 6(1)(c)). |
| Usage and audit data: measurements started, credits used, settings changed, who did what and when in your organisation. | Operating the Service, enforcing quotas, showing an activity log to organisation owners, preventing abuse. | Contract (Art. 6(1)(b)); legitimate interest in security and fair use (Art. 6(1)(f)). |
| Technical data: IP address, browser type, requested pages and errors in server logs. | Security, debugging and availability of the Service. | Legitimate interest (Art. 6(1)(f)). |
| Support correspondence: e-mails you send us. | Answering your request. | Contract / legitimate interest. |
We do not send marketing e-mails without your consent and we do not use the data for automated decision-making with legal effects. Payment card details are entered directly with Stripe and never reach our systems.
We use the following service providers, who process data on our behalf under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Railway Corp. | Hosting of the application and database | EU (Amsterdam, Netherlands); provider based in the USA |
| Stripe Payments Europe, Ltd. | Payment processing, tax calculation, customer billing portal | Ireland / EU; Stripe, Inc. (USA) as sub-processor |
| Fakturoid s.r.o. | Issuing and delivering tax documents (invoices) | Czech Republic |
| Resend, Inc. | Sending transactional e-mails | USA (EU data-residency region used where available) |
| Google LLC / Google Ireland Ltd. | Sign in with Google; Search Console and Analytics APIs when you connect them; Gemini API as an Engine | EU / USA |
| OpenAI, L.L.C. | ChatGPT Engine (receives prompt text only) | USA |
| Perplexity AI, Inc. | Perplexity Engine (receives prompt text only) | USA |
| Anthropic, PBC | Claude Engine (receives prompt text only) | USA |
The Engines receive only the text of the prompts you define and the country and city you set for the project; they never receive your account data. We may also disclose data where required by law or to protect our rights.
Where a provider processes data outside the European Economic Area (in particular in the USA), the transfer is based on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
The website and the Service use only strictly necessary cookies: a session cookie that keeps you signed in (30 days), short-lived cookies that protect the sign-in and Google connection flows against forgery, and a browser setting that remembers you dismissed the cookie notice. We do not use analytics, advertising or tracking cookies, and we do not load third-party trackers. Because these cookies are strictly necessary, no consent is required; you can delete them in your browser at any time, which signs you out.
Data is encrypted in transit (TLS). Google refresh tokens are encrypted at rest with a key held separately from the database. Access to production systems is limited to authorised staff and protected by multi-factor authentication; every administrative action inside a customer organisation is recorded in an audit log. The database is backed up regularly. Payment data is handled exclusively by Stripe (PCI DSS Level 1).
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to processing, and to data portability. You can view and change your account data, export your results (CSV, PDF) and delete your account or organisation directly in the Service. For anything else, write to aivisibility@niftyminds.cz; we respond within one month. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz) or the supervisory authority of your residence.
We may update this Policy when the Service or the law changes. The current version is always available at aivisibility.niftyminds.cz/privacy; material changes are announced by e-mail to organisation owners.
HNK CZ s.r.o., Piletická 486, 503 41 Hradec Králové, Czech Republic · aivisibility@niftyminds.cz