Privacy Policy

Your stories are personal. Protecting your privacy is essential to us.

Effective from 2 November 2026. Version 2.2.

1. Data controller

Lukáš Stuchlík, company ID (IČO): 03185311, registered at Nad Řekou 3005, 390 02 Tábor, Czech Republic (operator of the Vzpomínkář service).

Data protection contact: info@mujvzpominkar.cz, +420 775 183 735

We have not appointed a data protection officer; the law does not require one.

2. Categories of personal data

Account data

• name,
• e-mail address,
• sign-in and security data.

User content

• audio recordings,
• transcripts and story texts,
• photographs,
• data about people appearing in the stories,
• location data (Travel Diary only).

Payment data

• the fact of payment, amount, currency and date,
• payment identifiers issued by the payment gateway,
• consents given in connection with the order.

We neither process nor store card numbers.

Technical data

• IP address,
• device and browser information,
• system and security logs.

3. Purposes and legal bases

• Providing the Service, processing recordings and generating outputs — performance of a contract (Art. 6(1)(b) GDPR).
• Handling orders and payments — performance of a contract (point b).
• Accounting and tax records — legal obligation (point c).
• Securing the Service, preventing misuse and defending legal claims — legitimate interest (point f).
• Processing voice recordings and stories that may contain sensitive data — explicit consent (Art. 9(2)(a)).

We use no marketing tracking. Should we ever introduce it, it would only follow a separate consent.

4. Voice recordings and special categories of data

Life stories may contain data about health, religion, political opinions or other special categories under Art. 9 GDPR, including about people other than you.

That is why we require explicit consent before the first recording, and, where the story is about someone else, confirmation that they agree to being recorded. We store the consent together with its wording and date.

We do not create a voice print or a model for imitating a voice, and we do not process biometric data for identification.

5. Recipients and processors

The following providers process data on our behalf:

• Supabase — database, file storage and authentication; data is stored in the European Union (Frankfurt).
• Vercel — running the web application and traffic measurement (aggregate statistics, no cookies).
• OpenAI — speech-to-text, language refinement, question suggestions and illustration generation. Audio and text you process in the Service are sent there.
• Stripe — payment processing and payment receipts.
• Brevo — sending operational e-mails (sign-up confirmation, password reset).
• Mapbox — map display; used only in the Travel Diary.

We have a data processing agreement with each of them. Data may also be disclosed to our accountant or to public authorities where the law requires it. We never sell data.

6. Transfers outside the EU and EEA

Some of the providers listed process data outside the European Economic Area, mainly in the United States. This applies above all to OpenAI; with others a transfer may occur depending on their infrastructure.

In such cases GDPR safeguards apply, in particular the European Commission's standard contractual clauses or an adequacy decision. The specifics depend on our current supplier agreements.

7. Retention

• Content and account data — for as long as the account exists; after deletion it is removed from active systems without undue delay and then from backups, within 30 days at the latest.
• Accounting and tax documents — for the period required by law, typically 5 to 10 years depending on the document.
• Records of consents and orders — for the term of the contract and then for the limitation periods, to defend legal claims.
• Technical and security logs — a matter of months, for as long as operations and security require.

8. Your rights

As a data subject you have the right to:

• access your personal data,
• rectify inaccurate data,
• erasure,
• restriction of processing,
• data portability,
• object to processing based on legitimate interest.

You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out beforehand.

We handle requests at info@mujvzpominkar.cz, usually within one month. Some rights you can exercise directly in the app — individual recordings and the whole account can be deleted in settings.

If you disagree with how we handle your data, you may lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, https://www.uoou.gov.cz.

9. Cookies and similar technologies

We use the technical means necessary to run the service and keep you signed in, in particular browser storage. For traffic measurement we use Vercel Web Analytics: it stores no cookies or other data in your browser and tells visits apart by a temporary hash derived from the request rather than a persistent identifier. It collects aggregate page view counts, where the visit came from and the device type; project identifiers and tokens are stripped from page addresses before anything is sent. We deploy no advertising tools. Because nothing is stored on your device, there is no consent banner.

10. Automated decision-making

We carry out no automated decision-making or profiling with legal effects for you. Artificial intelligence processes content but does not decide about your rights.