Privacy Policy
Privacy & Data Protection (GDPR)
This policy explains how we process your personal data on the website ludekkvapil.cz and when using our services (AI chatbot, contact form, email). We comply with Regulation (EU) 2016/679 (GDPR) and applicable data protection laws.
We describe only what actually happens. If you find a discrepancy between this text and how the website behaves, please let us know — we will correct the text.
Data Controller
Luděk Kvapil (data controller)
Email: info(zavinac)ludekkvapil.cz
Location: Prague, Czech Republic
1. What data do we collect and why?
Chat & AI Assistant
When you use the AI chatbot on the website:
| Data | Collected | Retention | Purpose |
|---|---|---|---|
| Your message/question | ✅ Yes | 30 minutes from last activity (Redis) | Answering your question |
| Session ID | ✅ Yes | Until you close the browser tab | Linking your conversation |
| IP address | ✅ Yes | In server operational logs | Security & operations |
Legal basis: Legitimate interest (answering you and running the service)
⚠️ Important: Do not enter sensitive data (passwords, payment card numbers, health information) into the chat. The chatbot is a public interface without special protection, and the content of your message is not altered or masked — it goes to the language model exactly as you wrote it, including any email address or phone number.
The chat is anonymous — you create no account and do not log in.
Consent to forward a conversation in chat
The chatbot may offer to forward your enquiry to the operator. You give consent by typing “yes” into the chat (or “ok”, “sure”, “send it”). There is no checkbox in the chat.
After you confirm, the following is sent to the operator’s email:
- the full history of your conversation,
- a summary of the conversation generated by a language model,
- the contact detail you provided in the conversation (email, possibly phone).
If you do not confirm, the conversation is not sent anywhere and expires after 30 minutes of inactivity.
Legal basis: Your consent
Contact Form
When you contact us via the form:
| Data | Required | Retention | Purpose |
|---|---|---|---|
| ✅ Yes | Until handled + email archive | To reply to you | |
| Phone | ❌ Optional | Until handled + email archive | Alternative contact |
| Message | ✅ Yes | Until handled + email archive | Understanding your request |
The form has no name field and no consent checkbox. By submitting the form you are asking us for a reply — we do not use your data for any other purpose (such as offering additional services).
Legal basis: Steps taken at your request prior to entering into a contract, or legitimate interest in answering your enquiry
When you email us directly:
- Email content and metadata – processed to reply and for record-keeping
- The email stays in a mailbox with an email service provider in the EU
Legal basis: Legitimate interest (communication), or performance of a contract
Server operational logs
The website and API run on a server in the EU that keeps standard operational logs:
- IP address, request time, URL, browser type (user-agent), status code
Logs rotate by file size (not by date), so in practice they are kept for a matter of weeks — depending on traffic volume. They are not used for profiling or for tracking individual visitors.
Legal basis: Legitimate interest (operations, diagnostics and security)
What this website does NOT do
For the record, because it is commonly assumed:
- ❌ No analytics — there is no Google Analytics, Matomo, Plausible or any other analytics tool on this site
- ❌ No advertising or tracking scripts, no Facebook Pixel
- ❌ No external font CDN — fonts are served from our own server, so neither Google nor anyone else learns about your visit
- ❌ No profiling or automated decision-making with legal effects
- ❌ No selling or sharing of data with third parties for marketing purposes
2. Third Parties & International Transfers
OpenAI (USA)
The chatbot uses the OpenAI API to generate responses (GPT-family models and an embedding model for searching the knowledge base):
- ✅ No training on your data — under its terms, OpenAI does not train models on API data
- ⚠️ The USA is a third country — the transfer is governed by Standard Contractual Clauses (SCCs)
- ⚠️ Message content is not anonymised — if you type an email address or phone number into the chat, it reaches OpenAI as-is
Calls to OpenAI are made from the server, not from your browser — OpenAI therefore does not see your IP address and sets no cookies for you.
Email server (SMTP)
Messages from the contact form and from the chat are sent via the SMTP server of an email service provider in the Czech Republic. The transfer is encrypted (TLS/STARTTLS); the message then remains in a mailbox outside this website.
3. How We Protect Your Data
✅ Encryption: TLS/SSL for all communication (https://ludekkvapil.cz)
✅ Automatic deletion: conversations in Redis expire 30 minutes after the last activity
✅ CSRF protection: both the contact form and the chat are protected by a token against CSRF attacks
✅ Spam protection: the form uses a hidden field (honeypot), not a tracking captcha
✅ Restricted access: only the administrator has access to the server and logs
4. Your Rights
You have the following rights under GDPR:
| Right | Description | How to Exercise |
|---|---|---|
| Right of Access (Art. 15) | Get a copy of the data we hold about you | Email: info(zavinac)ludekkvapil.cz |
| Right to Rectification (Art. 16) | Correct inaccurate data | Email: info(zavinac)ludekkvapil.cz |
| Right to Erasure (Art. 17) | Request deletion of your data | Email: info(zavinac)ludekkvapil.cz |
| Right to Restrict Processing (Art. 18) | Pause processing | Email: info(zavinac)ludekkvapil.cz |
| Right to Data Portability (Art. 20) | Receive data in a standard format | Email: info(zavinac)ludekkvapil.cz |
| Right to Object (Art. 21) | Object to processing | Email: info(zavinac)ludekkvapil.cz |
| Right to Withdraw Consent (Art. 7) | Withdraw consent given in the chat | Email: info(zavinac)ludekkvapil.cz |
How to exercise: Send an email to info(zavinac)ludekkvapil.cz stating:
- which right you wish to exercise,
- what data it concerns,
- your contact details for verification.
We will respond within one month (this can be extended by a further two months for complex requests; we will inform you of any extension).
Note: Chat conversations are anonymous and disappear after 30 minutes of inactivity. Unless you had the conversation forwarded by email, we generally have no way to identify you — in that case we cannot fulfil an access or erasure request, because we hold no data we could link to you.
5. Data Retention Periods
| Category | Retention | Reason |
|---|---|---|
| Chat conversation (Redis) | 30 minutes from last activity | Technical necessity (running the conversation) |
| Chat session ID (in your browser) | Until you close the tab | Linking the conversation |
| Chat history (in your browser) | Until you delete it | Showing the conversation when you return |
| Server operational logs | Rotated by size, a matter of weeks | Operations and security |
| Conversation emailed after your consent | Per email archival | Handling your enquiry |
| Contact form | Until handled + email archive | Communication |
6. Cookies & Browser Storage
Cookies
During normal browsing the website sets no cookies at all. A single cookie appears only once you use the contact form or the chat:
| Cookie | Type | Purpose | When it appears |
|---|---|---|---|
csrf_token | Security (strictly necessary) | Protects the form and chat against CSRF attacks | Only on first use of the form or chat |
This cookie is set by our API domain api.ludekkvapil.cz. It is not used for tracking or for any other purpose.
Because the website uses no analytics or marketing cookies, we display no cookie banner — strictly necessary cookies do not require consent.
Browser storage (chat)
The chat window stores data directly in your browser, not on our server:
| Storage | Contents | Retention |
|---|---|---|
sessionStorage (ludekkvapil-chat-session) | Random chat session ID | Until you close the tab |
IndexedDB (ChatMessagesDB) | The text of your messages and the replies, time, language | No expiry — until you delete it |
You can delete the chat history with the “Clear chat” button inside the chat window, or by clearing site data in your browser settings. We cannot reach this data — it stays with you.
7. EU AI Act & Artificial Intelligence
ludekkvapil.cz uses an AI assistant in compliance with Regulation (EU) 2024/1689 (EU AI Act):
✅ Risk level: Low (information and customer support, no high-risk decisions)
✅ Transparency: The chatbot is labelled “AI sales assistant” in the interface — you know you are talking to a machine
✅ Purpose: The chatbot is informational; it is not a legal or medical advisor
AI limitations: The chatbot
- makes no legally binding decisions,
- is not the only way to reach us (you can email us or use the form),
- does not use biometric identification,
- does not use social scoring,
- can be wrong — please verify anything important.
8. Security Incidents
If a breach of the security of your data occurs:
- We investigate the incident and determine its scope
- We notify the supervisory authority (ÚOOÚ) within 72 hours where required
- We alert you without undue delay if there is a high risk
Report a breach: If you suspect a security issue, email info(zavinac)ludekkvapil.cz.
9. Policy Changes
We may update this policy, in particular if the website’s functioning or the applicable law changes. Last updated: 7 August 2026.
We will announce material changes on this page.
10. Contact
Questions about your data protection?
📧 Email: info(zavinac)ludekkvapil.cz
📍 Location: Prague, Czech Republic
🌐 Website: https://ludekkvapil.cz
You also have the right to lodge a complaint with a supervisory authority. For the Czech Republic this is the Office for Personal Data Protection (ÚOOÚ), https://www.uoou.cz/. If you live in another EU country, you may contact your national supervisory authority instead.
This privacy policy is governed by Czech law and GDPR.