Privacy policy

1. Controller

TODO: company name, registered office, company ID, contact, DPO if any

2. Data we process

• Account data: name, e-mail, password (hash only), language, role and team size from onboarding.
• Content you or your AI add: notes, tasks, files, time entries.
• Technical data: sign-ins, IP address, MCP token usage logs.
• Billing data via Stripe (we never store card numbers).
• E-mail from the Agents waitlist or the Enterprise contact form.

3. Purposes and legal bases

• Providing the service: contract (Art. 6(1)(b) GDPR).
• Billing and accounting: legal obligation (Art. 6(1)(c)).
• Security and abuse prevention: legitimate interest (Art. 6(1)(f)).
• Waitlist and launch notice: consent or legitimate interest TODO: decide.

4. Where the data is

The application and database run on our own server in the EU. See the Subprocessors page for the list of subprocessors.

When you connect an AI (e.g. Claude, ChatGPT), the data your AI reads is processed by its provider under your agreement with them. That provider is not our subprocessor.

5. Retention

TODO: retention periods for account, content, backups, invoices, logs, waitlist

6. Your rights

Access, rectification, erasure, restriction, portability (data export in the app) and objection. You can lodge a complaint with the Slovak Data Protection Office.

TODO: contact for exercising rights

7. Cookies

We use strictly necessary cookies only: sign-in (pm_session) and language choice (kapsa_locale). TODO: analytics, if added