Privacy policy

Effective from 21 Sept 2026 · version 1.2

This document explains how we handle personal data when running the PastierAI service (the “service”). It is written to be read, not to be impenetrable. If anything is still unclear after reading it, write to us and we will explain.

The processing is governed by Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. on personal data processing.

1. Who processes your data

The controller within the meaning of Art. 4(7) GDPR, the party that determines the purposes and means of processing, is:

Company: Czech Video Center a.s.
Registered seat: U garáží 1611/1, Holešovice, 170 00 Praha 7, Czech Republic
Company ID: 09839194
Registration: Municipal Court in Prague, section B, insert 26003 (company incorporated on 28 Jan 2021)
E-mail: assistant@fameplay.ai

In accordance with Article 37 of the GDPR, we have not appointed a Data Protection Officer (DPO). This is because we do not meet the mandatory criteria for such an appointment: we are not a public authority, our core business activities do not involve processing operations that require regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of personal data on a large scale. For any data protection-related inquiries, please contact us via the e-mail address provided above.

2. What data we process

We adhere strictly to the principle of data minimization, collecting only the information that is necessary for the proper operation and provision of our service. We do not acquire personal data from third-party sources, nor do we combine the information we collect with profiles obtained from external sources. The specific categories of data we process are detailed in the table below.

Category	Specific data
Registration data	Company name, e-mail address and password. The password is stored solely as a cryptographic hash, so we do not hold it in readable form and cannot recover it.
Data from Google sign-in	If you sign in with Google, we receive your e-mail address, name, language preference, a link to your profile picture and your account identifier. Your Google password never reaches us.
Conversation content	The audio recording of the call, its transcript, and the text messages you exchange with the service.
Uploaded documents	Files (PDFs and images) you place into the conversation, and the text read from them.
Usage data	Date, time and length of conversations, number of messages, sign-in events and technical error records.
Technical data	IP address, browser type and version, operating system and an approximate geographic region derived from the IP address. These arise automatically with every connection to the server.

We strongly discourage the input of special categories of personal data as defined in Art. 9 GDPR (including, but not limited to, health data, political opinions, religious or philosophical beliefs, sexual orientation, trade union membership, or genetic and biometric data). We do not seek or require such data, and we warn against it here and in Section 3. If you voluntarily input such data into the conversation or an uploaded document, it will be recorded as part of your conversation history; by doing so despite this warning, you provide explicit consent under Art. 9(2)(a) GDPR to its processing, limited to providing you the service. You may withdraw this consent and request deletion of the affected record at any time at assistant@fameplay.ai.

3. Recording and monitoring of conversations

We process the content of all interactions, including voice calls, their transcripts, and text messages, to ensure the provision, security, and quality of the service. Transparency is fundamental to our approach; notice of this processing is provided clearly in the site header, next to the agent panel, and in the footer.

Purposes of processing:

Service Quality: Evaluating and enhancing the accuracy and utility of our responses.
Technical Integrity: Diagnosing and resolving technical errors or system malfunctions.
Security: Protecting the service against unauthorized access, abuse, and automated overloads.
Evidence: Maintaining an accurate record of communications to resolve disputes and demonstrate compliance.

Access to these recordings is strictly restricted to authorized personnel under confidentiality obligations and takes place through protected administrator accounts with our providers, which keep technical access logs under their own security programmes.

Do not put national identification numbers, document numbers, payment details, login credentials, health information or confidential third party information you are not authorised to share into the conversation. If you upload a document containing other people's personal data, you are responsible for having a legal basis to do so.

4. Purposes and legal bases

We do not process data without a legal basis. Here is what we use which data for and what it rests on:

Purpose	Personal Data Categories	Legal Basis (GDPR)
Account management and service provision	Registration data, Google sign-in data	Performance of a contract (Art. 6(1)(b))
Processing of conversations and documents	Content of conversations, uploaded files	Performance of a contract (Art. 6(1)(b))
Quality assurance and service optimization (recording and monitoring)	Audio, transcripts, message content	Legitimate interest (Art. 6(1)(f))
Network and information security	Technical and usage data	Legitimate interest (Art. 6(1)(f))
Evaluation of the trial run and improvement of the service	Usage data	Legitimate interest (Art. 6(1)(f))
Information about the course and the end of the trial run	E-mail address	Legitimate interest (Art. 6(1)(f))
Establishment, exercise, and defense of legal claims	Relevant case-related data	Legitimate interest (Art. 6(1)(f))

Legitimate Interest Assessment

Where processing is based on legitimate interest (Art. 6(1)(f) GDPR), we have conducted an assessment to balance our operational necessities against your fundamental rights and freedoms. We have determined that our interest in ensuring service quality, system stability, and security is consistent with your reasonable expectations, provided that appropriate technical safeguards are in place. You have the right to object to processing based on legitimate interests at any time (see Section 11).

Important Note on Language Models

We do not utilize the content of your conversations or uploaded documents to train our own or third-party language models. Processing of content is strictly limited to providing the requested service features. The data processing agreements with the providers listed in Section 6 limit the processing of your content to providing the service and do not grant them the right to use it to train their own models.

5. Where the data comes from

We collect personal data through the following primary sources:

Directly from you: This comprises the vast majority of our data. It includes information you provide voluntarily during the account registration process (e.g., identity data) and data generated during our interactive sessions (e.g., content of conversations, transcriptions, and uploaded documents).
From third-party authentication providers: If you choose to sign in using a Google account, we receive necessary identity verification and profile data directly from Google. This data is transferred based on the specific permissions and consent you provide within Google's authentication window.
Automatically collected data: Certain technical and usage data is generated and collected automatically as part of the standard communication between your browser and our servers. This collection is inherent to the technical provision and security of the service (e.g., IP addresses, device information, and session metadata).

6. Who we share data with

We prioritize the confidentiality and integrity of your personal data. We do not sell personal data to third parties, nor do we disclose it for third-party marketing purposes.

To provide our service, we engage specialized service providers who act as our data processors in accordance with Article 28 of the GDPR. These providers are contractually obligated to process your data exclusively under our documented instructions and to maintain appropriate technical and organizational security measures.

Provider	What for (purpose of processing)	Which data
Supabase	Account database and authentication	Registration data, technical sign-in records
ElevenLabs	Voice agent, speech transcription, processing of the conversation and uploaded files	Audio, transcripts, messages, uploaded documents
Resend	Transactional e-mail delivery (registration confirmations, service notices)	E-mail address, content of operational messages
Netlify	Hosting of the website and server functions	Technical data, IP address
Google	Sign-in with a Google account, only if you use it	Identity verification, e-mail, name, account identifier

We may further disclose data to public authorities where required by law, and to legal or accounting advisors where needed to establish or defend claims.

The list of processors may change over time. The current one is always the one stated in this document. We notify material changes under section 14.

Beyond that, some files of the site, fonts and code libraries, are loaded from public content delivery networks: Google Fonts and jsDelivr. They are not processors, we pass them none of your data and they set no cookies. Your IP address and browser details do reach the network operator, though, because otherwise it would have nowhere to deliver the file.

7. Transfers outside the EU

Part of the data stays in the European Union. Supabase keeps the account database in its Frankfurt region and Resend sends transactional e-mail from its EU region (Ireland). Both providers are nevertheless companies established in the United States and may access the data from there, and the remaining providers process data in the United States or other jurisdictions outside the European Economic Area (EEA).

We ensure that any such transfer is compliant with Chapter V of the GDPR by relying on the following legal mechanisms:

EU–US Data Privacy Framework (DPF): ElevenLabs, Netlify, Resend and Google are certified under the EU–US Data Privacy Framework; for these transfers we rely on the European Commission's adequacy decision of 10 July 2023. This confirms that these organizations provide an adequate level of data protection essentially equivalent to that of the EU.
Standard Contractual Clauses (SCCs): Supabase is not DPF-certified; although the database itself is hosted in Frankfurt, any access from the United States is covered by the European Commission's Standard Contractual Clauses incorporated in its Data Processing Addendum, supplemented by a documented Transfer Impact Assessment (TIA) published by the provider and, where necessary, additional technical and organizational safeguards (such as encryption and strict access controls) to ensure your data remains protected to EU standards.

We will provide a copy of the safeguards used on request at assistant@fameplay.ai.

8. How long we keep data

We process personal data only for the period necessary to achieve the specific purposes for which it was collected or to comply with applicable statutory retention requirements. Once the retention period expires, data is either securely deleted or irreversibly anonymized.

Data	Retention period
Registration data and account	For the duration of your active account + 3 months following deletion
Audio recordings of calls	3 months from the call
Transcripts and text messages	3 months from the conversation
Uploaded documents	90 days from the end of the conversation
Technical and security logs	3 months
Data needed to defend legal claims	Until the expiry of the statutory limitation period under Czech law

Account Deletion

You can request the deletion of your account at any time by writing to assistant@fameplay.ai. Upon your request, we immediately restrict access to your personal data. We initiate the permanent erasure or anonymization of your data without undue delay, except where specific legal obligations (such as tax law or legal defense) require us to retain certain records for a longer period.

Erasure or Anonymization

After the applicable retention period expires or the purpose of processing ceases, we securely delete or irreversibly anonymize your personal data, unless its further retention is required or permitted by applicable legal regulations.

9. Automated decision-making

The responses generated by our service are produced by a language model and do not constitute automated decision-making as defined by Article 22 of the GDPR. Our processing does not produce legal or similarly significant effects for you; the service functions solely as a conversational assistant. We do not engage in profiling, credit scoring, or the evaluation of personal aspects, behaviors, or preferences.

We do perform a technical check during the sign-in process: when using Google authentication, our system verifies whether the provided e-mail address is associated with a business domain. If this condition is not met, the sign-in process is interrupted, and you are offered alternative registration methods. This mechanism is purely an access control measure and does not constitute an evaluation of your personal characteristics or professional status.

10. How we protect data

We have implemented robust technical and organizational measures in accordance with Article 32 of the GDPR to ensure a level of security appropriate to the risk. Our security framework includes:

Encryption in Transit: All data transmission between your browser and our servers is secured using modern TLS/HTTPS encryption.
Encryption at Rest: Stored data is encrypted by the providers that hold it, so it remains unreadable even if someone gains unauthorized access to the storage media itself. The account database is encrypted with AES-256 by Supabase. Audio recordings, transcripts and uploaded documents are held by ElevenLabs under its own security programme, certified to SOC 2.
Credential Protection: User passwords are stored exclusively as cryptographic hashes; we do not retain passwords in plaintext or readable formats.
Access Control and Authorization: We employ server-side authentication for all API interactions and strict row-level security (RLS) to ensure that users can only access data belonging to their specific accounts. Sensitive identifiers (such as voice agent keys) are issued only after server-side verification and are not exposed in public page sources.
Access Management: Access to sensitive personal data and conversation recordings is strictly limited to authorized personnel on a “need-to-know” basis, through protected administrator accounts.

Data Breach Notification

While we strive for the highest levels of security, no system is entirely impenetrable. In the event of a personal data breach that poses a high risk to your rights and freedoms, we commit to notifying the relevant supervisory authority without undue delay (and in any case, within 72 hours) and informing you, as required by Articles 33 and 34 of the GDPR.

Under the GDPR, you possess specific rights concerning your personal data. You may exercise these rights at any time, free of charge. We are committed to facilitating these rights in a transparent and timely manner.

Your rights include:

Right of access (Art. 15): You have the right to obtain confirmation as to whether or not your personal data is being processed, and where that is the case, access to the personal data.
Right to rectification (Art. 16): You have the right to request the correction of inaccurate personal data or the completion of incomplete data.
Right to erasure (Art. 17): Also known as the “right to be forgotten,” you may request the deletion of your personal data where it is no longer necessary, or where you have withdrawn your consent.
Right to restriction of processing (Art. 18): You may request the restriction of processing while we verify the accuracy of the data or in other specific circumstances defined by the GDPR.
Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have those data transmitted to another controller.
Right to object (Art. 21): You may object to processing based on our legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.
Right to lodge a complaint (Art. 77): You have the right to file a complaint with a supervisory authority (see Section 15).

Exercising your rights

To exercise any of these rights, please contact us via e-mail at assistant@fameplay.ai.

We will respond to your request without undue delay, and in any event, within one month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; we will inform you of such extension within the first month.

Handling your request is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act on it under Art. 12(5) GDPR. For security purposes, to avoid disclosing data to the wrong person, we may require additional information to verify your identity before processing your request.

12. Cookies and browser storage

We use no analytics, advertising or tracking cookies and we run no third-party traffic measurement on the site. That is why the site has no cookie bar. We utilize only strictly necessary cookies and local storage technologies, essential for the technical operation of the service and for the features you have explicitly requested (such as maintaining your session). Because these technologies do not track your behavior across different websites, do not serve advertising, and do not profile your activity, they do not require user consent under the ePrivacy Directive and the GDPR.

What we store	Why	For how long
Sign-in token	So you do not have to sign in again after reloading the page	Until sign-out or expiry
Language choice	So the site stays in the language you switched to	Until you clear your browser data
Time of your last activity	So the service signs you out by itself after 12 hours of inactivity	Until sign-out or until you clear your browser data
Temporary sign-in states	For example the note that a Google sign-in did not go through	Until you close the browser tab
Language of the voice agent window	So the window opens in the language you last chose inside it	Until you clear your browser data
Random number of the agent window	It tells your window apart during a call. We create it ourselves, and it is random precisely so that the agent does not compute a fingerprint of your device	Until you clear your browser data

The voice agent window is provided by ElevenLabs and may utilize local browser storage to manage the technical connection and ensure the speech-to-text features function correctly. This storage is used exclusively to facilitate your active conversation and does not involve tracking or advertising.

You can manage or delete all cookies and browser storage at any time via your browser settings. Please note that if you clear your browser data, you will be signed out of the service and your interface preferences (such as language) will revert to default settings.

13. Children

The service is designed for professional use and is intended exclusively for users aged 16 and older. We do not knowingly collect, store, or process personal data of children under the age of 16 without appropriate parental or guardian consent.

If we become aware that we have inadvertently collected personal data from a user under the age of 16 without the required consent, we will take prompt and reasonable steps to delete such data and terminate the associated account. If you are a parent or legal guardian and believe that we have collected data regarding your child, please contact us at assistant@fameplay.ai so that we may verify the situation and proceed with the necessary erasure.

14. Changes to this document

We may update this text, for example when the features of the service or the providers used change. The current version is always the one published at this address; the effective date and version number are stated at the top.

We will notify you of material changes, in particular a new purpose of processing or a new recipient of data, by e-mail or directly in the service, at least 15 days in advance.

15. Contact and supervisory authority

With any question about your data write to: assistant@fameplay.ai. It is always the fastest route and we can resolve most things directly.

If you are not satisfied with how we handled it, you have the right to lodge a complaint with the supervisory authority competent for the controller's seat:

Authority: Úřad pro ochranu osobních údajů (Czech Republic)
Address: Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Phone: +420 234 627 111
E-mail: posta@uoou.cz
Web: uoou.gov.cz

Under Art. 77 GDPR you may also lodge a complaint with the supervisory authority of the member state of your habitual residence; in Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Hraničná 12, 820 07 Bratislava 27, statny.dozor@pdp.gov.sk, dataprotection.gov.sk).

The Slovak version of this document prevails. This English text is provided for convenience only; in case of discrepancy the Slovak version governs.