GDPR COMPLIANT // Effective from: 23 August 2026

Privacy Policy

1. Introduction

ALVILA SYSTEMS s.r.o. ("we", "our", or "us") respects the privacy of its users ("you" or "your"). This Privacy Policy explains how we collect, use, share, and protect your personal data in connection with your use of the implic.it critical-thinking platform ("Services").

This policy is issued pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and applicable Czech law.

2. Data Controller

The controller of your personal data is:
ALVILA SYSTEMS s.r.o.
Registered office: Křemencova 178/10, 110 00 Praha 1, Czech Republic
Company ID (IČO): 28972384
Registered in the Commercial Register maintained by the Municipal Court in Prague

For any questions regarding the processing of your personal data, please contact us at: help@implic.it

3. Personal Data We Collect

Personal data contained in text you submit for analysis is automatically replaced with placeholder identifiers before the analysis (anonymisation). The conversion key (the mapping between placeholder and actual value) is kept in encrypted form until you claim it, for no longer than 7 days. Once claimed, or once that period lapses unused, the mapping is deleted from our systems and the key remains with you alone; it cannot be obtained again. Details on transfers to AI providers are set out in Section 6.1. Anonymisation is an automated process and may not be complete for atypically written data; you may remove sensitive details from the text before submitting it.

We may collect and process the following categories of personal data:

• Account data: your name, email address, and password (stored in hashed form) provided when creating an account.
• Billing data: name, billing address, email address, telephone number, and company registration numbers (IČO / DIČ) provided when placing an order, used to issue the invoice.
• Payment data: we issue invoices payable by bank transfer or QR code. We do not collect or store payment card numbers.
• Consultation data: when you book a consultation, the appointment may be linked to a Google Calendar event for scheduling purposes.
• Usage data: information about how you interact with our Services, including exercises completed, session duration, and feature usage.
• Technical data: IP address, browser type and version, operating system, and other device or connection information collected automatically when you access our Services.
• Communications: any messages you send us, including support requests or feedback.
• Cookies and similar technologies: see Section 9 below.

4. Purposes and Legal Bases for Processing

• Performance of a contract (Art. 6(1)(b) GDPR): We process account and billing data to create and maintain your account, provide access to the Services, issue invoices, process orders, and respond to your requests.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): We process invoice and billing data as required by applicable accounting and tax law (Czech Act No. 563/1991 Coll. on Accounting; invoices retained for 10 years).
• Legitimate interests (Art. 6(1)(f) GDPR): We process technical and usage data to ensure the security and proper functioning of our Services, prevent fraud, and improve our platform. We may also use your contact details for direct marketing of our similar services if you are an existing customer. You may object to this at any time.
• Consent (Art. 6(1)(a) GDPR): Where we rely on your consent (for example for certain cookies or marketing communications beyond our legitimate interest), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
• Legitimate interests (Art. 6(1)(f) GDPR) - development and improvement of the platform: We use data arising from use of the Services to train and evaluate our own models and control components, exclusively in anonymised form and by automated means (see Section 6.2 below and Sections 11.5 to 11.8 of the Terms of Service). You may object to this processing at any time.

5. Data Retention

• Account and contract data is retained for the duration of your account and for 3 years after account closure or contract termination.
• Billing data and invoices are retained for 10 years as required by Czech accounting law.
• Data processed under our legitimate interests is retained for no longer than necessary, and in any case for no more than 1 year after your last use of the Services, unless a longer period is required by law.
• Data processed on the basis of consent is retained until you withdraw your consent or until the purpose is fulfilled.
• Data from an unfinished anonymous trial (without registration) is deleted automatically no later than 48 hours after creation.

6. Recipients of Personal Data

We may share your personal data with the following categories of recipients, strictly on a need-to-know basis:

• IT service providers and hosting partners who process data on our behalf under data processing agreements.
• AI model providers (OpenAI, Anthropic) for the purpose of generating analytical outputs; only anonymised text is transferred, both providers operate under data processing agreements (DPA), and transfers to the USA take place under the EU-US Data Privacy Framework.
• Google LLC (Google Calendar) in connection with consultation scheduling; processing governed by Google's Data Processing Addendum.
• Accounting and legal advisors bound by professional secrecy obligations.
• Public authorities, if required by applicable law or a binding legal order.

We do not sell your personal data to third parties.

6.1 Anonymisation before transfer to AI providers

Anonymisation of the input text is enabled by default. When enabled, personal data (names, contact details and other identifiers) is replaced with placeholders (e.g. [PERSON_1]) before the text is sent, and AI model providers receive only such anonymised text. The key needed to restore the original values stays available to the user alone: it is never transferred to third parties and we do not retain it either - once claimed, the mapping is deleted from our systems and cannot be obtained again.

Anonymisation can be switched off in the form. In that case the text is transferred to AI model providers in its original form, including any personal data it contains. Switching it off is only possible after an explicit confirmation that the text contains no personal data of third parties, or that the user has the consent of the persons concerned, and that the user accepts responsibility for processing without anonymisation. This confirmation, including its wording, version and the time it was given, is stored as a record of the instruction received.

6.2 Use of data for development and model training

Data arising from use of the Services (submitted texts and context, analysis outputs, data on the course of processing, and ratings of outputs) is used to develop and improve the platform, in particular to train and evaluate our own models and the control and supervisory components that ensure the quality and safety of outputs. The legal basis is our legitimate interest in improving our services.

For this purpose, data is used exclusively in anonymised form. We do not use text containing personal data in its original form for development or training. For text processed with anonymisation enabled, this condition is met at the point of input; where anonymisation was switched off (Section 6.1), we anonymise the text before using the data for this purpose, and until then the text is not used for development.

Evaluation is carried out exclusively by automated, machine-based means, that is, without specific texts being read by people; the result consists of aggregate and derived data on the quality of the analysis. This does not affect access by authorised personnel to data to the extent necessary when resolving a specific technical problem or a complaint, nor obligations under the law.

You may refuse the use of data for this purpose at any time in your account settings or by writing to help@implic.it. A refusal takes effect for the future and does not affect the provision of the Services or their price.

7. International Transfers

We primarily store and process your data within the European Economic Area (EEA). Transfers outside the EEA occur with AI model providers (OpenAI, Anthropic) based in the USA; these transfers take place under the EU-US Data Privacy Framework or, where applicable, standard contractual clauses approved by the European Commission in accordance with Art. 46 GDPR. Equivalent safeguards apply to any transfer in connection with Google services.

8. Your Rights Under GDPR

You have the following rights with respect to your personal data:

• Right of access (Art. 15 GDPR): you may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16 GDPR): you may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): you may request deletion of your personal data ("right to be forgotten") where the data is no longer necessary or processing is unlawful.
• Right to restriction of processing (Art. 18 GDPR): you may request that we limit processing of your data in certain circumstances.
• Right to data portability (Art. 20 GDPR): you may request a copy of data you provided to us in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): you may object at any time to processing based on our legitimate interests, including direct marketing and the use of data for development and model training under Section 6.2.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at help@implic.it. We will respond within one month. If you believe we have violated your rights under GDPR, you have the right to lodge a complaint with the Czech supervisory authority: Office for Personal Data Protection (UOOU), pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

9. Cookies

Our Services use cookies and similar tracking technologies. We use:

• Strictly necessary cookies: required for the operation of our Services (e.g. session management, authentication). These cannot be disabled.
• Functional cookies: remember your preferences (e.g. language, theme settings).
• Analytics cookies: help us understand how users interact with our Services so we can improve them. These are only placed with your consent where required by law.

You can control and delete cookies through your browser settings at any time.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These include encrypted connections (HTTPS), access controls, and regular security reviews.

11. Automated Decision-Making

We do not carry out fully automated individual decision-making or profiling that produces legal or similarly significant effects on you.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via our website or by email. The date of the most recent revision is shown at the bottom of this page.

Back to home