Privacy Policy
This is a translation for convenience. The Czech-language version is the legally binding one.
1. Data controller
The data controller is: Fluxsoft Cloud s.r.o., Company ID (IČO): 29741939, with its registered office at Zenklova 24/54, Libeň (Praha 8), 180 00 Praha. Contact: [email protected]. A Data Protection Officer (DPO) has not been appointed, as the GDPR does not require it.
2. What data we process, the purpose and the legal basis
| Personal data | Purpose | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|---|
| Email, name, language, Google ID | Account management, login, communication | Performance of a contract (b) | Until the account is deleted |
| Login codes and sessions (hashes only) | Secure login, protection against misuse | Performance of a contract (b), legitimate interest (f) | Codes 15 minutes, sessions 30 days |
| Data from the input (texts, names, descriptions, questionnaire) | Generation of the Result, corrective Generations, complaints | Performance of a contract (b) | 90 days from completion of the Result (clause 6.4 of the Terms), then automatic deletion; drafts 90 days without change |
| Photographs and materials uploaded by the User | Insertion into an AI scene / illustration | Performance of a contract (b) | Deleted immediately after the order is completed, at the latest within 7 days of upload. In the film configurator, photographs do not leave the User's device until payment. |
| Resulting files (videos, audio, images, PDFs) | Delivery, storage in the account, sharing via link | Performance of a contract (b) | 90 days from completion, email notification 7 days in advance, then automatic and irreversible deletion (clauses 6.4–6.7 of the Terms) |
| Payment data (amount, currency, Stripe payment ID — without the card number) | Payments, refunds, accounting | Performance of a contract (b), legal obligation (c) | For the period required by accounting and tax regulations |
| Communication with support, complaints, rating of the Result | Handling requests, improving quality | Performance of a contract (b), legitimate interest (f) | Until the account is deleted; in case of a dispute, until the limitation period expires |
| Logs of orders and API requests (status, errors, time, costs) | Evidencing performance, examining complaints and chargebacks | Legitimate interest (f) | Up to 3 years |
| Visitor statistics without cookies (page, language, referral source, UTM, country/city derived from the IP address via Cloudflare, device type) — the IP address is not stored, the visitor is counted using a daily irreversible hash | Statistics and improvement of the Website | Legitimate interest (f) | 13 months |
| Technical error logs (page address, error text, browser) | Stability and security | Legitimate interest (f) | 12 months |
| Reports of illegal content (DSA) | Handling the report, protection of rights | Legal obligation (c), legitimate interest (f) | 3 years |
3. Data of third parties (recipients of greetings)
The User enters data of third parties (e.g. a photograph of the person celebrating). Under our Terms, the User must have the consent of the person concerned for this step. We process this data only as a technical tool for the User on the basis of legitimate interest (or, from the User's perspective, as a processor). The person concerned may request immediate deletion of the data at [email protected].
4. Transfers of data to third parties and outside the EU
For the service to function, we pass the necessary data to AI Providers. The data is not used by these parties to train their own models (according to their B2B terms of business).
- Google LLC / OpenAI / ElevenLabs / Anthropic (USA / EU) – transfers to the USA are covered by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC).
- Stripe (Ireland) for payments.
- Cloudflare, Inc. (USA, DPF) — CDN, protection of the Website, determining country/city from the IP address.
- Resend (processing in the EU region – Ireland) — sending emails (login, order confirmation, deletion notifications, support replies).
- Hosting provider (servers in the EU) — operation of the Website and the database.
5. Rights of data subjects
Under the GDPR you have the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, portability and the right to object to processing. You can carry out a complete export of your data (a JSON file) and delete your account yourself in your account (Settings); we handle other requests at [email protected] within 1 month. You may lodge a complaint with the Úřad pro ochranu osobních údajů (Czech Data Protection Authority), Pplk. Sochora 27, 170 00 Praha 7 (www.uoou.gov.cz).