This Privacy Policy describes how we collect, use, and protect personal data when you use ginibooster (the "Service"), accessible at ginibooster.cz and api.ginibooster.cz.

1. Data Controller

1a. Representative in the European Union (Art. 27 GDPR)

As the Data Controller is established outside the European Union but offers services to individuals in the EU, a representative in the Union has been designated pursuant to Article 27 GDPR. Data subjects and supervisory authorities may contact the representative in addition to the Data Controller on all matters related to the processing of their personal data.

2. Personal Data We Process

Account data (collected during registration)

• E-mail address, password (stored only as an Argon2id hash, never in plaintext)
• Optional: first name, surname, middle name, date of birth, phone number, company

Document data (when you use the parsing service)

• Bank statement PDFs and their contents: account numbers, IBAN, BIC, account owner, transactions (date, amount, counterparty name and account, payment symbols VS/KS/SS, description, balance).
• Czech ID card images and their contents: document number, full name, date of birth, sex, place of birth, nationality, dates of issue and expiry, address, personal number (rodné číslo), marital status, issuing authority, MRZ zone. ID images are processed entirely on our own servers using on-device OCR (Tesseract and RapidOCR). They are not transmitted to any third-party AI provider for extraction.

Request metadata

• IP address, timestamps, HTTP status codes, request and response payloads, request IDs (UUID).
• User-submitted bug reports (text description and reference to the associated upload).

3. Purposes of Processing

• Delivering the parsing service you request.
• Managing your account: registration, authentication, password changes.
• Security: rate limiting, account lockout after failed login attempts, fraud prevention.
• Quality improvement: analysing parsing errors and improving parser accuracy across bank formats. This processing is based on legitimate interest (Art. 6(1)(f) GDPR); you have the right to object at any time — see Section 8.
• Technical support: resolving bug reports submitted through the service.
• Billing and accounting where legally required.

4. Legal Basis (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b)) — for providing the Service you signed up for.
• Legitimate interest (Art. 6(1)(f)) — security and parser-accuracy improvement.
• Legal obligation (Art. 6(1)(c)) — accounting, tax, and anti-money-laundering duties where applicable.

5. Recipients and Processors

• OVH SAS (France, EEA) — infrastructure provider hosting our servers and database. All uploaded documents and parsing operations stay within this infrastructure.
• Google Ireland Ltd. (Ireland, EEA) — e-mail correspondence (controller's contact mailbox and outbound transactional / support replies). User-uploaded documents are never sent through e-mail.

All bank statement parsing and ID card OCR is performed on our own servers under the standard production configuration. Where a business customer (B2B Controller) has provided explicit written authorisation under our Data Processing Agreement (specifically, the AI Processing Addendum), limited maintenance and security tasks may involve the transmission of redacted document content to enterprise-grade AI assistants operated under no-training and zero-retention (or short-period retention) configurations. Czech ID-card images, the rodné číslo, cardholder photographs, and signature images are excluded from any such transmission under all circumstances. We do not sell or share your personal data with third parties for advertising.

6. Retention Period

• Uploaded bank-statement PDFs — 90 days from upload, or until you request deletion in writing, whichever is earlier.
• Uploaded ID-card images — 30 days from upload, or until you request deletion, whichever is earlier (shorter retention reflects the heightened sensitivity of the rodné číslo under Art. 87 GDPR and §60 of Czech Act No. 110/2019 Coll.).
• Parsed JSON results and API request metadata — 12 months from request.
• Documents accessed for maintenance and security purposes (parser-defect diagnosis, regression-test corpus, incident response) — up to 12 months from upload, bank statements only; ID-card images and rodné číslo are excluded from any such use.
• Bug reports and processed-bug records — 24 months.
• Security audit logs — 24 months.
• Encrypted backups — up to 30 days (rolling).
• Account data — duration of your account + 30 days after deletion.
• Billing and accounting records — retained for the period required by Czech accounting and tax law (typically up to 10 years).

For business customers (B2B Controllers) operating under a signed Data Processing Agreement, the retention periods specified in Annex I §D of that DPA apply and override the defaults above to the extent the DPA provides shorter periods or additional categories.

You can request deletion of any of the above at any time (see Section 8).

7. International Data Transfers

The Data Controller is established in Ukraine. All processing of uploaded documents takes place on our server in France (OVH, EEA). The only transfer outside the EEA is administrative access by the Data Controller from Ukraine; this transfer relies on Standard Contractual Clauses (SCCs) adopted by the European Commission and on equivalent safeguards.

8. Your Rights

Under GDPR you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data — "right to be forgotten" (Art. 17)
• Restrict processing (Art. 18)
• Data portability — receive your data in a machine-readable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time (Art. 7(3))
• Lodge a complaint with a supervisory authority

To exercise any right, contact us at ginibooster@gmail.com. We will respond within 30 days.

9. Cookies and localStorage

We do not use third-party tracking cookies. The Service uses browser localStorage to store JWT access and refresh tokens, your language preference, and minimal user-profile data. These are essential for the Service to function — logging out clears them.

10. Security

• Passwords are hashed with Argon2id.
• All traffic is encrypted using TLS 1.2 or higher.
• Rate limiting and account lockout protect against brute-force attacks.
• Database access is limited to the minimum necessary roles.

No online service can guarantee absolute security. We take reasonable steps, but you should also use a unique, strong password and keep your API keys secret.

11. Supervisory Authority

You have the right to file a complaint with the Czech data protection authority:

12. Changes to This Policy

We may update this Privacy Policy. The "last updated" date at the top will change. Material changes will be announced by e-mail to registered users.

13. Contact

Questions about this Privacy Policy or about your personal data: ginibooster@gmail.com.