Privacy Policy

This is a translation for convenience. The Czech version is the governing text; in case of any discrepancy, the Czech wording prevails.

This Privacy Policy describes how Kulatá kostka s.r.o., as the controller of personal data, processes the personal data of users of the online application Alfrédové.com — your marketing assistant (the „Service“). It supplements the Terms and Licence Conditions.

1. Who processes your data (controller)

• Controller: Kulatá kostka s.r.o., Company ID: 10731041
• Registered office: Rudolfovská tř. 1965/29, 370 01 České Budějovice 3, Czech Republic
• Contact: info@alfredove.com, +420 777 055 069

2. What data we process

• Identification and contact data: first name, surname, e-mail, and phone where provided.
• Billing data: company name, company ID, VAT ID, billing address, amounts paid and invoices.
• Account and usage data: account settings, tariff type, information about credits and their consumption, technical logs (sign-in time, IP address, device/browser identifiers).
• Content and history of your work in the Service: your shop profile, the content of the shop website you enter, saved prompts, generated texts and their history.
• Payment data: card payments are processed through the Stripe payment gateway; we do not store card numbers on our servers.

3. Purposes and legal bases

• Creating and maintaining the user account, providing the Service, customer support and communication. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Invoicing and accounting, records of payments and compliance with tax obligations. Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Security and abuse prevention (anomaly detection, protection against attacks). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Improving the Service and internal statistics (aggregated or pseudonymised analysis of feature usage and credit consumption). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Marketing communication about our own similar services. Legal basis: legitimate interest; you can opt out at any time.
• Voluntary consents (e.g. a newsletter beyond the legitimate interest, non-essential cookies). Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.

4. Retention periods

• Account data and work history: for the duration of the account and then for a maximum of 24 months after cancellation, unless a longer period is required.
• Invoicing and accounting documents: for the period set by law (typically up to 10 years from the end of the accounting period).
• Communication and technical logs: usually 6–24 months depending on the nature of the record and security needs.
• Marketing based on consent: until consent is withdrawn or you unsubscribe.

5. Recipients and processors

Your data may be passed on, to the extent necessary, to the following processors:

• Supabase — database, authentication and file storage (EU, Frankfurt).
• Vercel — hosting and operation of the application.
• OpenRouter — routing to AI models; your inputs are sent to AI providers in order to generate texts. Providers that train on submitted data are disabled.
• Firecrawl — reading your shop website during onboarding and auto-fill.
• Ecomail — transactional e-mails and e-mail marketing.
• Cloudflare — Turnstile bot protection on the registration form.
• Sentry — error monitoring.
• Google — Google Tag Manager and traffic measurement, only with your consent.
• Stripe — payment gateway and antifraud, once paid tariffs are launched.
• Accountants and tax advisors, to meet statutory obligations.
• Public authorities, where required by law.

We have data processing agreements in place with our processors in accordance with GDPR.

6. Transfers to third countries

Some recipients (e.g. Stripe, Vercel, OpenRouter, Sentry, Google) may process data outside the EU/EEA. We ensure appropriate safeguards under GDPR, in particular standard contractual clauses and a transfer impact assessment. Details are available on request.

7. How we protect your data

We apply appropriate technical and organisational measures: encryption in transit, access control, audit logs, backups, and the principles of minimisation and pseudonymisation wherever possible.

8. Cookies and similar technologies

• Essential cookies: required for signing in, running the account and security (used without consent).
• Analytics, preference and marketing cookies: used only with your consent, which you can change at any time in the cookie bar or in your browser settings.

9. Automated processing and profiling

The Service performs automated processing in the form of calculating and consuming credits (1 credit = 1 generated word) and technical analyses of feature usage. We do not make decisions with legal effects without human review (Art. 22 GDPR).

10. Your rights

You have the right:

• of access to your personal data,
• to rectification of inaccurate or incomplete data,
• to erasure („right to be forgotten“) in the cases set by law,
• to restriction of processing,
• to data portability,
• to object to processing based on a legitimate interest,
• to withdraw consent at any time where processing is based on consent.

You can exercise your rights at info@alfredove.com. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection.

11. Cancelling your account and deleting data

Write to us at info@alfredove.com and we will close your account. We keep account data and work history for the period stated in section 4; after that it is securely deleted or anonymised, unless another legal ground requires longer retention.

12. Payments and invoicing

During the beta the Service is free, no payments are collected and no payment details are requested. Once paid tariffs launch: moving from the free tariff to a paid one triggers an invoice immediately and starts a recurring payment at the chosen interval; payments are made by card through Stripe and we do not store card details; the subscription renews automatically unless the account is cancelled before the end of the cycle.

13. Data minimisation

We only ask for the data needed to conclude and perform the contract and to meet legal obligations. Data processed on the basis of consent is provided voluntarily and consent can be withdrawn at any time.

14. Changes to this policy

We may update this policy from time to time, in particular following changes to the Service or to legislation. We will inform you of significant changes in an appropriate way (e.g. by e-mail or by a notice in the Service). We always state the effective date and the date of the last update.

15. Contact

For questions about the processing of personal data contact us at info@alfredove.com or +420 777 055 069.

Controller: Kulatá kostka s.r.o., Company ID: 10731041, Rudolfovská tř. 1965/29, 370 01 České Budějovice 3.