Just ImagAIne, Matyáš Hrubý, Business ID: 19468091, registered address K Holyni 150/7, 15400 Prague 5 – Slivenec (referred to as "we," "the Controller," or "Just ImagAIne").
This policy describes how we process personal data in connection with our website justimagaine.com and the provision of AI chatbots and related services to our clients. If you have any questions, contact us at mhruby@justimagaine.com.
| Term | Meaning |
|---|---|
| AI Assistant / Chatbot | a software service (chatbot, AI agent) typically built on the Voiceflow platform and third-party language models, which we develop and deploy for our clients |
| GDPR | Regulation (EU) 2016/679 of the European Parliament and of the Council |
| EEA | European Economic Area |
| Personal Data | any information about a natural person by which that person can be directly or indirectly identified |
| Client | a natural or legal person with whom we have a contract for the development/operation of an AI chatbot or other service |
| End User | a person who communicates with an AI chatbot deployed by one of our Clients (e.g., a visitor to the Client's website) |
| You / User | the person to whom this policy applies — a visitor to our website, a prospective or existing Client |
| Controller | the entity that determines the purposes and means of processing personal data |
| Processor | the entity that processes personal data on behalf of and under the instructions of the Controller |
| Special Category Personal Data | sensitive data (health status, sexual orientation, ethnic origin, religion, etc.) — we do not process this data about you |
We process only the personal data necessary to provide our services. Processing is carried out transparently, securely, and in accordance with GDPR.
As part of our activities, we use artificial intelligence (AI language models), primarily for the operation of AI chatbots that we develop for our Clients. We do not use AI for automated individual decision-making or profiling within the meaning of Art. 22 GDPR. The outputs of AI systems are subject to the possibility of human review, and our Clients have the option to configure or limit the extent of automation.
This is key to our activities — depending on the context, we are either a Controller or a Processor.
With respect to you (a website visitor, prospective or existing Client), we are the Controller of personal data. We process data you provide to us yourself (name, email, billing details, etc.) — see Art. 4 and 5 for an overview.
If we develop and operate an AI chatbot for a Client, End Users' communication with that chatbot constitutes processing of personal data that we carry out on behalf of and under the instructions of the Client — i.e., in the role of Processor. In this relationship, the Client is the Controller and is responsible, among other things, for informing its End Users about the processing.
The terms of this processing (scope, purpose, duration, security) are governed by a separate Data Processing Agreement (DPA), which we conclude with the Client as part of our cooperation.
If you are an End User of a chatbot deployed by one of our Clients and wish to exercise your rights regarding personal data, please contact the relevant Client directly — this policy does not apply to processing carried out on its behalf.
In providing services (both as Processor and as Controller), we use other entities (see Art. 7), in particular providers of AI language models, the chatbot operating platform, and Airtable, where the End User's IP address is stored for rate-limiting and chatbot abuse-protection purposes. We have appropriate agreements in place with these entities (DPA / data processing terms).
We do not process any special categories of personal data (sensitive data) about you.
(We currently do not operate a newsletter or analytics/marketing cookies. If we introduce these in the future, we will update this section and the related consents.)
| Why? | What data? | Legal basis | How long? |
|---|---|---|---|
| Handling an inquiry/question — we respond to inquiries sent by email or via the contact form | Name, email, phone, message content | Legitimate interest (handling the inquiry) | Until resolved + a reasonable period for follow-up communication, max. 2 years |
| Concluding and performing a Service Agreement | Name/company name, business ID, contact details, content of cooperation | Performance of a contract | For the duration of the Agreement + 3.5 years after its termination (statute of limitations) |
| Invoicing and accounting | Billing details, bank details | Compliance with a legal obligation | As required by law (usually 10 years) |
| Operation of the website | IP address, technical data (necessary cookies) | Legitimate interest | For the duration of the visit / session |
| Processing on behalf of a Client (operation of an AI chatbot for its End Users) | As specified in the relevant DPA with the Client | Per the Client's (Controller's) instructions | As specified in the DPA with the Client |
| Protecting the AI chatbot against abuse and managing query limits | IP address of the chatbot's End User (stored in Airtable) | Legitimate interest (service security, abuse prevention) — exercised on behalf of the Client as Processor | For the period necessary for security purposes, typically max. 90 days, unless otherwise agreed in the DPA with the Client |
We process personal data on the basis of:
If we process your personal data as a Processor on behalf of a Client, the legal basis follows what the Client, as Controller, has chosen with respect to its End Users.
| Purpose | Provider |
|---|---|
| AI language models in chatbots | OpenAI, Anthropic, Google (Gemini) |
| Platform for building and operating chatbots | Voiceflow |
| Storage of IP addresses for rate limiting and chatbot abuse protection | Airtable |
| Website hosting | Netlify |
| Accounting and invoicing | Fakturoid |
Personal data may be processed by these processors outside the European Economic Area (in particular the USA — OpenAI, Anthropic, Google). In such cases, the transfer is ensured through Standard Contractual Clauses or through the provider's participation in the EU-US Data Privacy Framework, where certified.
We may also transfer personal data to third parties if required by law or necessary for the performance of a contract.
Technical measures:
Organizational measures:
You have the right to:
You can exercise your rights at mhruby@justimagaine.com. We will respond no later than within one month.
If you are not satisfied with how your request was handled, you have the right to file a complaint with the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.
We may update this policy from time to time, in particular in connection with the expansion of our services or changes in legislation. The current version is always available on this website.
Matyáš Hrubý · mhruby@justimagaine.com · K Holyni 150/7, 15400 Prague 5 – Slivenec · Business ID: 19468091