Privacy policy
1. Who processes your data
The controller is AcuityHub, s. r. o., with its registered office at Pribišova 3416/12, 841 05 Bratislava, Slovakia, company ID (IČO) 56799292, registered in the Commercial Register of the Bratislava III City Court, Section Sro, insert no. 185740/B. Contact: ahoj@zmienka.com. We have not appointed a data protection officer (DPO).
2. What data, why and on what legal basis
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Website address and public data from it (business name, city, line of business, text from the homepage), questions and AI answers | To compile the questions for AI, evaluate the answers, and create the test and report | Performance of a contract, or your request before entering into one (Art. 6(1)(b) GDPR) | Results and downloaded pages in memory for 24 to 36 hours, the recognized site profile for 7 days, a saved report for 30 days |
| Email, business details entered with the report | To unlock the full report, link it to you, and send a link to the plan | Performance of a contract (Art. 6(1)(b)) | 12 months from storage |
| The plan (results, tasks, texts) and access to it | To deliver the paid plan and let you open it again | Performance of a contract (Art. 6(1)(b)) | 12 months from creation |
| Repeat measurements for the plan (date, number of mentions, site score, check results) | To compare a new measurement with the first (before and after), and, with Monitoring, automatically once a month | Performance of a contract (Art. 6(1)(b)) | 12 months from the last measurement, an unfinished measurement 7 days |
| Monitoring (subscription): the buyer's email, the Stripe customer and subscription identifiers, subscription status, date of the next measurement | To run the monthly measurements, send the result email, and let you cancel in the Stripe customer portal | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) | 10 years from the last change of the record (documentation for payments under the accounting act) |
| Done for you: the buyer's email, business name and website from the test, our correspondence, possibly billing details and access to your website's content management system or FTP that you send us | To carry out the ordered work on the website, communicate with you by email, and issue an invoice. We never store access credentials in the Zmienka system. They exist only in our email correspondence, we use them only for the ordered work, and once it is finished we ask you to revoke our access or change the password | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) | The order and payment 10 years (accounting act); the email with credentials is deleted no later than 30 days after the work is completed |
| An unfinished plan (intermediate results of preparation) | To continue preparing the plan after a page refresh or an outage | Performance of a contract (Art. 6(1)(b)) | 7 days, then deleted |
| Email, business details and test result, if you ticked consent to emails | First one confirmation email with no business details. After you confirm, we send you the test result and up to 3 emails with tips and an offer of the plan (within 5 days of the test), then occasional news about visibility in AI | Consent (Art. 6(1)(a)) | An unconfirmed record is deleted after 48 hours, the sending schedule (queue) no later than 14 days after the test. Otherwise until you withdraw consent. After you unsubscribe, we keep your email on an unsubscribe list so we don't send you news again (legitimate interest), for 10 years from unsubscribing |
| IP address | Daily limit on free tests and sign-ups, protection against abuse and security of the service | Legitimate interest (Art. 6(1)(f)) | The limit counter at most 26 hours. An IP address stored with an email stays with that record (12 months) |
| Payment data: email, amount, package, time, payment identifier (we don't see the card number), the secret plan number, any refund or dispute | To verify the payment, deliver the plan, issue a receipt, and for accounting. The buyer's email together with the secret plan number ensures that the plan opens only for you and that a top-up payment is added to the same plan. We send the plan link only to the buyer's email | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) | 10 years from the last change of the record under the accounting act |
| Messages you send to ahoj@zmienka.com | To reply, and to handle a complaint or withdrawal | Performance of a contract, or legitimate interest (Art. 6(1)(b) and (f)) | For the duration of handling and the limitation period of claims, at most 4 years |
Card payments on zmienka.com are not launched yet. Paid services can be ordered only after launch. The data about payments and subscriptions in the table above will therefore be processed only from then.
Legitimate interest and how we weighed it
The free test costs us money for every AI call. Without a limit per IP address, one person or program could use it up and so restrict everyone else. We therefore use the IP address, which we receive with every request anyway. The counter holds only the number of today's tests and expires within 26 hours. The counter is in a Cloudflare D1 database within our Cloudflare account. The intrusion on your privacy is low, and every website receives your IP address. If you disagree, you can object (see Your rights).
3. Is providing data mandatory
Not by law. Without a website address we can't run the test, without an email we can't unlock the full report, and without an email and a payment we can't deliver the plan. Consent to emails (test result, tips and news) is voluntary, the box is not pre-ticked, and it does not affect the service. We make no decisions about you by automated means with legal or similarly significant effects. The AI evaluates the content of websites, not people.
4. Who we pass data to
We don't sell data and we don't use it for advertising. These processors help us:
- Cloudflare, Inc. (USA): hosting of the site and running of functions (Cloudflare Workers), data storage (Cloudflare R2, data stored in the European Union), counters for limits and daily costs (Cloudflare D1), the domain's DNS, and forwarding of emails from ahoj@zmienka.com. It receives everything you enter on the site and sees the messages you send us. It keeps operational logs of the functions (time, path, result, without the content of forms) for 3 days. If the Cloudflare Turnstile bot protection is switched on (for the test and the email for the report), Cloudflare processes your IP address and browser signals during verification. The legal basis is our legitimate interest in protecting the service from abuse (Art. 6(1)(f)).
- Google (Gmail mailbox): receiving and sending emails. Google Ireland Limited (Ireland) and Google LLC (USA).
- Google Gemini API (USA, Google LLC): the AI we ask questions. We use the free tier, and with it Google may use inputs and outputs to improve its services. We send the line of business, city, questions, website address and public text from the website's homepage. We don't send an email or a person's name. Please don't write confidential information into the fields.
- Resend (Resend, Inc., USA): sending emails. The confirmation email, test result, tips and news only with your consent; the link to a paid plan, Monitoring results and the order confirmation for the Done for you service to the buyer as part of the contract; for such an order we also send an internal message to ahoj@zmienka.com (business name, website, email, plan link). It receives the email address, the text of the message (business name, test result, links) and delivery data. The transfer to the USA relies on the European Commission's standard contractual clauses. We delete the record of the sending schedule (queue) no later than 14 days after the test.
- Stripe (Stripe Payments Europe, Ltd., Ireland and Stripe, Inc., USA): card payments, recurring Monitoring payments and the customer portal for canceling them. Stripe processes the card data, and we don't see it. When verifying payments and preventing fraud, Stripe is also an independent controller under its own policies.
- Google Fonts (fonts.googleapis.com and fonts.gstatic.com, USA): the site's fonts. When the page loads, your IP address and browser data are transferred to Google. The legal basis is our legitimate interest in a consistent display of the page (Art. 6(1)(f)).
If any of them processes data in the USA, the transfer relies on the European Commission's adequacy decision for companies listed in the EU-US Data Privacy Framework. If that were not applicable, the European Commission's standard contractual clauses apply. We don't publish data, and we pass it to authorities only when the law requires us to.
5. Cookies and browser storage
We don't use strictly necessary cookies. We set optional Microsoft Clarity cookies only after your consent (see below). In your browser's storage (localStorage and sessionStorage) we keep these keys:
| Key | Purpose | How long |
|---|---|---|
| zm-theme | Your chosen light or dark mode. It is set after you switch modes. | Until you delete it |
| zm-suhlas | Your choice in the analytics banner (yes or no) | Until you delete it or change your choice |
| zm-plan-[plan number] | Tasks and checklist items for your site that you ticked off in the plan | Until you delete it |
| zm-platba (sessionStorage) | Temporarily remembers an unfinished test so it can be restored after you return from Stripe payment. It contains business details, the test result and an access token. | Until the tab is closed, deleted after returning from payment |
These keys serve solely for the functioning of the page you requested and never leave your browser. You can delete the storage at any time in your browser settings.
Traffic statistics. We use Cloudflare Web Analytics to see how many people visit the site, which pages they came from, which subpages they viewed, and how fast the page loads. The tool uses no cookies or storage in your browser (localStorage), does not track you across sites, and does not create a visitor profile. The script loads from static.cloudflareinsights.com, and in doing so Cloudflare sees your IP address and browser data, while we see only aggregate numbers. The legal basis is our legitimate interest in knowing whether the site works and where people come from (Art. 6(1)(f)).
Microsoft Clarity (only with consent)
If you click “I agree” in the banner, we load the Microsoft Clarity service. The service is operated by Microsoft Corporation. We use it to analyze how the page is used: heatmaps of clicks and scrolling, and session recordings in which the text on the page is masked. This lets us see where people get stuck.
- Legal basis: your consent (Art. 6(1)(a) GDPR). Without consent, Clarity does not load.
- Cookies: _clck (1 year) and _clsk (1 day). They contain a visitor and session identifier.
- Transfer to the USA: relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework.
- Withdrawing consent: at any time through the “Cookie settings” link in the page footer. This deletes the _clck and _clsk cookies.
Other tools (Cloudflare Web Analytics) work without cookies and need no consent. If we add other tools with cookies in the future, they will start only after your consent through the banner.
6. Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing, portability, and the right to object to processing based on legitimate interest. You can withdraw your consent to emails at any time with the link in every email, in one click (or the unsubscribe button in your email app), or by a message to ahoj@zmienka.com. Withdrawal does not affect the lawfulness of processing before it.
Write to us at ahoj@zmienka.com and we will reply within 30 days.
If you think we are handling your data incorrectly, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, Slovakia, dataprotection.gov.sk. You can also lodge a complaint with the supervisory authority of the EU member state where you live.