# Privacy Policy **Updated 16 October 2026 · version 2026-10-16** ## Controller and processor roles Sales Robots s.r.o., Company ID 09586563, Generála Šišky 2082/26, 143 00 Prague, Czech Republic, info@salesrobots.cz, is controller of its customer accounts, billing, support correspondence and presentations of its own products. For a client's product presentation, that client is controller of conversations, contacts and consent evidence. Sales Robots is its processor under documented instructions and the [DPA](/en/data-processing-agreement). The client's policy linked from the presentation provides controller information; contact us if the identity is unclear. Exercise rights primarily with that client; requests to info@salesrobots.cz are forwarded without undue delay. This policy does not replace the client's policy. ## Data and legal bases We process account and business contact details, invoices, support messages, security information and evidence of contract acceptance. Our own presentations also process transcripts, topics and voluntarily supplied contact information. Do not enter sensitive information or other people's data without a reason. - Account and service: contract, Article 6(1)(b) GDPR; for representatives of legal entities, legitimate interest in business communication, Article 6(1)(f). - Requested presentation, enquiry or summary: legitimate interest in responding, Article 6(1)(f), or pre-contractual steps requested by a natural person, Article 6(1)(b), where applicable. - Later contact beyond your request: separate optional consent, Article 6(1)(a), where required. A requested summary does not depend on this consent. - Accounting: legal obligation, Article 6(1)(c). - Security and necessary operational diagnostics: legitimate interest, Article 6(1)(f), not model training or cross-client reuse of conversations. - Contract evidence and legal claims: legitimate interest, Article 6(1)(f). - Optional analytics and marketing cookies: consent and applicable device-storage rules. Acknowledging a privacy notice is not marketing consent. Consent may be withdrawn without affecting past lawful processing. Lead scores support human review; we do not use them for solely automated decisions with legal or similarly significant effects. ## Voice processing Current voice mode sends microphone audio through our server interface to Google Gemini for recognition, answers and voice. It is not merely browser transcription. Microphone permission is required and typing is available instead. The application stores a text transcript, not a microphone recording archive. Temporary Google security retention under its terms is not excluded. Customer-uploaded videos and generated narration are separate from visitor recordings. ## Recipients and international transfers - Supabase: database, authentication and server functions, primary project database Frankfurt (eu-central-1). - Vercel: app.salesrobots.cz hosting, global infrastructure and possible processing outside the EEA. - Google Gemini: AI answers, live voice and TTS, under business terms excluding training on inputs and outputs. We do not promise zero security retention or EU-only processing. - Resend: service emails, summaries and notifications. Its DPA states primary processing in the USA; an EU sending region does not guarantee EU storage. - Cloudflare: public salesrobots.cz website hosting and security, distinct from application hosting. - Google Analytics and Google Ads, Meta, X and Seznam: website measurement and advertising; this does not automatically make them subprocessors of client conversations. CookieScript manages cookie choices. Embedded YouTube video is also subject to its provider's rules; see the Cookie Policy. We do not sell data. Non-EEA transfers require an adequacy decision, including the US DPF only for the particular certified recipient, or standard contractual clauses and necessary supplementary measures. A European database does not mean all supplier processing occurs in Europe. Contact us for applicable safeguards. ## Retention Current operation automatically removes transcripts and detailed events after 90 days and clears selected identifying fields from session records. This process does not itself delete a contact (lead) or all session-related data; we therefore do not automatically classify the remaining records as anonymous. For processing under the new DPA, the contractual upper limit is the end of the contract or 12 months from the session, whichever is earlier. A controller may instruct a shorter period at info@salesrobots.cz. This is not a claim that self-service retention settings or automatic contact deletion are already available. Contacts and remaining data must be deleted separately according to the instructions and agreed deadline. Our own product presentations use at most the same 12-month limit unless a requested subsequent service requires further retention on a separate legal basis. At the end of processing, production data is returned or deleted within 14 days under the accepted DPA, with restricted backup cycles. Account information is kept during the account. Necessary contract evidence is normally retained for three years afterwards, longer only for specific disputes or legal requirements. Accounting/tax records are generally retained for five or ten years depending on type. Technical logs are normally kept at most 12 months unless a specific incident requires longer evidence. Consent records are not an unlimited permission to contact. ## Security, cookies and rights We use access controls, server-side customer separation, encrypted transport and infrastructure security. Technical login and anti-abuse services differ from optional analytics: we do not claim that the entire website and its security providers never store device information. Optional tracking follows the cookie banner choice. See the [Cookie Policy](/en/cookies). Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent. Contact info@salesrobots.cz or the named client controller. We may reasonably verify identity to protect other people's conversations. You may complain to the [Czech data protection authority](https://uoou.gov.cz/) or another competent supervisory authority. [Terms](/en/terms) · [DPA](/en/data-processing-agreement) · [Version archive](/en/legal-documents)