Privacy Policy

Privacy Policy

Version: 1.0 Effective from: [DATE — e.g. 1 July 2026] Controller: Ing. Tomáš Dejmek

This Privacy Policy explains how the Operator, as controller (správce), processes personal data of Users and visitors of the KonstrukThor platform ("Platform"), in accordance with Regulation (EU) 2016/679 ("GDPR") and Act No. 110/2019 Coll., on the processing of personal data.

Important distinction. This Policy covers personal data for which the Operator is the controller — i.e. account, billing, support and website data. It does not cover the personal data that Visitors enter into Users' calculators ("Tools"), nor the Tool content and AI Agent conversations stored as part of a Tool: for that data the User is the controller and the Operator is only the processor, governed by the separate Data Processing Agreement.

1. Controller identification

| | | |---|---| | Controller | Ing. Tomáš Dejmek | | Address | Habarticka 503, Prague, Czech Republic | | IČO | 06798713 | | E-mail | dejmektomas@gmail.com | | Phone | +420 601 126 032 |

The Operator has not appointed a Data Protection Officer; appointment is not mandatory for the scope of processing described here (čl. 37 GDPR). For all data-protection matters contact dejmektomas@gmail.com.

2. What data we process, why, and on what legal basis

| # | Category of data | Purpose | Legal basis (čl. 6 GDPR) | Retention | |---|---|---|---|---| | A | Account data — name, billing e-mail, organisation name, login identifier, Google account identifier | Create and manage the account/Organisation; authenticate the User | Contract performance — čl. 6(1)(b) | For the duration of the account + the deletion timeline below | | B | Member data — name and e-mail of invited Members, role (admin, team leader, member) | Operate the Organisation's team features | Contract performance — čl. 6(1)(b); for Members, the legitimate interest of the Organisation — čl. 6(1)(f) | While the Member is part of the Organisation | | C | Billing data — billing e-mail, transaction records, invoices, the number of active Tools | Process payments; issue invoices; meet accounting duties | Contract — čl. 6(1)(b); legal obligation — čl. 6(1)(c) (accounting/tax) | Up to 10 years where required by accounting and tax law | | D | Operational metrics — Tool views, Tool executions, number of active Tools, member count, counts of AI generations/edits, AI input/output token counts (aggregated per Organisation/Tool, without reading Tool content) | Bill the service; size and secure infrastructure; improve service quality; assess eligibility for future offerings | Contract — čl. 6(1)(b); legitimate interest in operating and improving the service — čl. 6(1)(f) | While the account is active + up to 24 months aggregated | | E | Support data — correspondence, and, only with the User's one-time consent, the specific Tool content needed to reproduce a reported issue in a test environment | Provide support; resolve reported issues | Legitimate interest in supporting Users — čl. 6(1)(f); for accessing Tool content, the User's consent — čl. 6(1)(a) | For the duration of the support case + reasonable records; Tool content accessed for support is deleted promptly after resolution | | F | Communication / e-mails — transactional e-mails (registration, billing, security, service notices) | Operate the service and fulfil the contract | Contract — čl. 6(1)(b); legal obligation for certain notices | While the account is active | | G | Marketing e-mails (if any) | Send news and offers about the Platform | Consent — čl. 6(1)(a), or legitimate interest for similar-service messages to existing customers with opt-out (§ 7 of Act No. 480/2004 Coll.) | Until consent is withdrawn / opt-out | | H | Website & cookie data — IP address, device/browser data, analytics identifiers (Google Analytics) | Operate, secure and analyse the website; see the Cookie Policy | Necessary cookies: legitimate interest — čl. 6(1)(f); analytics cookies: consent — čl. 6(1)(a) | Per the Cookie Policy | | I | Backups — encrypted daily backups containing the above as stored | Disaster recovery, data integrity | Legitimate interest in service continuity — čl. 6(1)(f) | Rolling, purged within 30 days |

The Operator does not read the content of Users' Tools and does not use it for any purpose beyond hosting and operating it, except support access under row E.

3. How we obtain data

Most data is provided directly by the User (registration, billing, support). Some is generated automatically by using the Platform (operational metrics, website/cookie data). Member data may be provided by the Organisation that invites the Member.

4. Recipients and sub-processors

The Operator shares personal data only with the following categories of recipients, under appropriate safeguards:

| Recipient | Role | Location | Transfer safeguard | |---|---|---|---| | Amazon Web Services EMEA SARL (AWS) | Infrastructure, storage, daily backups — region eu-north-1 (Stockholm, Sweden) | EU/EEA | Data stored within EU/EEA; AWS GDPR Data Processing Addendum; SCC / EU-U.S. DPF for any ancillary transfers | | Anthropic, PBC | AI Agent (generation of Tools from text prompts) | USA | EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses (čl. 46 GDPR) | | Google Ireland / Google LLC | OAuth login; Google Analytics | EU / USA | EU-U.S. Data Privacy Framework / Standard Contractual Clauses | | [PAYMENT PROVIDER] | Payment processing, invoicing (acts as an independent controller of payment data) | [EU / USA] | [Within EU / DPF or SCC — to be confirmed when provider is selected] | | Public authorities | Where required by law | Czech Republic / EU | Legal obligation |

The Operator does not sell personal data and does not transfer it other than as described.

⚠️ Third-country transfer notice. When a User uses the AI Agent, the text the User submits is transmitted to Anthropic in the USA and may there be processed to generate the Tool. Users should not submit unnecessary personal data into AI Agent prompts. Likewise, Google Analytics may transfer website data to the USA; this occurs only if the User consents to analytics cookies.

5. Automated decision-making

The Operator does not carry out automated decision-making with legal or similarly significant effects within the meaning of čl. 22 GDPR. The AI Agent generates Tools at the User's request and does not make decisions about the User.

6. Your rights as a data subject

Under čl. 15–22 GDPR you have the right to:

To exercise any right, contact dejmektomas@gmail.com. The Operator responds within one month (čl. 12(3) GDPR).

You also have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

7. Security

The Operator applies appropriate technical and organisational measures to protect personal data, including access controls, encryption of backups, network and application security in a sandboxed execution environment, and the principle of data minimisation. The Operator does not access Tool content except as described in the Terms.

8. Children

The Platform is not directed at children under 16. The Operator does not knowingly process the personal data of children. (For Tools that Users build, responsibility for any child-directed processing lies with the User as controller.)

9. Changes to this Policy

The Operator may update this Policy. Material changes will be notified by e-mail and/or in the Platform. The current version is always available at the Platform.

⚠️ Legal notice: This is a template reflecting the Operator's described data flows. Complete the payment provider and its transfer safeguard (Article 4) once selected, and have the third-country transfer wording reviewed by a qualified Czech lawyer before publication. The transfer safeguards referenced here (DPF / SCC) must actually be concluded or verified with each US provider — accepting Anthropic's Commercial Terms incl. DPA, AWS's Data Processing Addendum, and Google's data-processing terms.