NOT NULL AI

Privacy Policy

Last updated:

1. Who we are and how to contact us

This Privacy Policy explains how personal data is processed when you use the services offered by NOT NULL AI at notnullai.com. The controller of your personal data, unless this policy says otherwise, is:

  • NOT NULL AI s.r.o.
  • Registered office: Renoirova 624/1, Hlubočepy, 152 00 Praha 5, Czech Republic
  • Company ID (IČO): 244 21 618
  • Registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 440909
  • E-mail: info@notnullai.com
  • Phone: +420 774 170 792

In this policy, we, us and our mean NOT NULL AI s.r.o. You means any person whose personal data we process in connection with our services. We have not appointed a data protection officer. For any question about this policy or your personal data, write to info@notnullai.com.

This policy is written to meet the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) and applicable Czech law. Terms such as controller, processor and personal data have the meaning given to them in the GDPR. The use of our services is also governed by our Terms and Conditions.

2. What this policy covers

This policy applies to the following services (together, the Services):

  • NOT NULL AI Chat – our web application that lets registered users converse with AI models from several providers and pay for usage from prepaid credit;
  • Photo-to-Figurine – a web widget, which may be embedded on our own pages or on third-party websites, operated by us, that lets you upload a photo, have an AI-generated figurine preview created and order a physical figurine; the figurine itself is sold by ZIGILAB s.r.o. (see Photo-to-Figurine);
  • user accounts, including sign-in with e-mail and password or with Google;
  • the administration interface used by our authorised administrators, coworkers and partners;
  • our websites, e-mails and customer support connected with the above.

Depending on how you interact with us, you may be a website visitor, a registered user, a customer who buys credit, a person who orders a figurine through Photo-to-Figurine, a person who places a Photo-to-Figurine order without an account, a person shown in a photo that someone else uploads, a partner or coworker with access to the administration interface, or someone who contacts us for support.

This policy does not cover websites or services operated by others, even where they link to or embed our Services. Where our Photo-to-Figurine widget is embedded on a third-party website, the operator of that website is responsible for its own website and its own processing; see Cookies and browser storage.

3. Personal data we process

We process personal data that you give us, data that our systems generate when you use the Services, data derived from what you submit, and data we receive from third parties such as Google, Stripe or AI providers. The categories depend on which Services you use.

Account data

  • Your e-mail address and your password, which we store only in hashed form.
  • Account status and lifecycle information, such as when the account was created, activated, changed or closed, and the confirmations and security tokens used for activation, password changes and password resets.
  • Your organisation within the Services. Each account has its own organisation that holds the prepaid balance; the organisation may carry a name you provide.
  • Where you use Google Sign-In, the Google account information described in Google Sign-In.

Chat content

  • The prompts and other text you submit, the responses returned by AI models, and the structure of your conversations and branches.
  • The model and provider you selected, token counts, the cost charged for each request and technical information returned by the provider (for example status, usage and content-safety information).

Files uploaded through your account

We store files you upload through an account file-upload feature, along with their name, type, size and owner. Where file content is included in a model request, we send it to the selected provider.

Photo-to-Figurine data

  • The photos you upload, as uploaded, including any information embedded in the file (such as camera details, date or location data, if present).
  • Your editing choices (such as crop, zoom, rotation or mirroring) and the edited version of the photo that we produce from them.
  • Your product selections, such as style, colouring, size, quantity and stand, and any name you ask to have engraved.
  • Results of automated analysis of the photo, such as the estimated number of people or animals shown, and information returned by the AI provider, including the generated preview images and content-safety information.
  • Order and contact details: first name, last name, e-mail address, phone number, an optional note, your chosen language and the Packeta pickup point you select.
  • Promo codes used and the related discount and partner-commission attribution.

Payment data

  • Amounts, currency, payment status, dates and payment identifiers, and the event data that Stripe sends us about a payment, which may include the payer’s name, e-mail address and billing country or address.
  • Records of your prepaid balance, top-ups, reservations and charges for usage, and any request to withdraw unused credit.
  • We do not receive or store your full payment card details; see Payments.

Technical, security and history data

  • IP address, network and connection information, browser and device information (user agent), preferred language, and the time and part of the Services a request relates to.
  • Session information needed to keep you signed in and to protect forms.
  • A history of meaningful events and changes in the Services, such as order state changes, edits of contact details, payments and account actions, and audit records of actions taken by administrators and coworkers; see Service history, audit and security records.
  • Records of e-mails we send you, such as recipient, subject and delivery status.

Communications

  • The content of e-mails and other messages you send us, and our replies.

Administration interface users

  • For administrators, coworkers and partners: e-mail address, password hash, optional linked Google account, assigned roles and permissions, invitations, and audit records of their actions in the administration interface.

Do you have to provide your data?

You do not have a legal obligation to provide personal data to us. However, some data is necessary to enter into and perform a contract with you: without an e-mail address we cannot create an account; without a prompt we cannot generate a response; without a photo and your contact details we cannot create a figurine or complete an order. Technical data such as your IP address is processed automatically when your device communicates with our servers.

Sensitive data

We do not ask for special categories of personal data (such as health data or data revealing political opinions or religious beliefs). Please do not enter such data about yourself or others into prompts unless you need to. We do not use photos to identify people: our automated analysis estimates how many people or animals a photo shows, and does not perform face recognition or identify any individual.

4. Chat and AI model providers

When you send a message in NOT NULL AI Chat, we send your prompt, together with the earlier messages and responses in the same conversation branch, to the provider of the AI model you selected so that it can generate a response. Other branches of the conversation are not sent. We do not send your name, e-mail address, IP address or account identifier to the provider with the request; however, the provider receives whatever personal data the content itself contains.

Our current model providers include OpenAI, Anthropic, Google (Vertex AI on Google Cloud) and Mistral AI. The models and providers available may change over time as we add, replace or remove them; the model you choose in the Services identifies the provider that will process your request.

Each provider processes this data under its API or business terms and data processing terms, and those terms, together with the provider account settings, govern whether and how submitted content may be used for improving or training the provider’s models; the rules differ by provider and by model. Providers may retain data for limited periods for abuse monitoring. Each provider’s terms govern its use and retention practices and may change.

We store your conversations, prompts and responses in our own database so that you can see and continue them, so that we can calculate and account for charges, and for the other purposes described in this policy. Technical records of an individual request, which may include its content, can also be kept while that request is being completed or recovered after an interruption.

When you delete a conversation in the Chat, it is removed from your view. It is not immediately erased from our systems, and the related messages and charges remain part of our records; see How long we keep data.

Responses are produced by AI models and can be inaccurate or incomplete. Please avoid entering personal data about other people unless you are entitled to do so and it is necessary for your request.

5. Photo-to-Figurine: how your photos are handled

Photo-to-Figurine is designed so that you can see a generated preview before you pay. Your photo therefore passes through the following steps:

  1. Upload. Our server checks the upload and, if it is accepted for storage, stores the original file as uploaded. The widget creates an anonymous session for your order and records your IP address and browser information for it. If you are signed in to NOT NULL AI in the same browser and on the same site, the photo may also be linked to your account.
  2. Editing. You can crop, zoom, rotate or mirror the photo. Our server applies your edits and produces an edited version of the photo. Where no edit is needed and the file format allows it, it prepares a processed copy of the full photo; for some unedited formats that our server cannot convert, no processed copy is made. A prepared version does not carry the embedded file information of the original.
  3. Automated checks. We automatically check the file (for example its type and size) and estimate the number of people or animals in the photo, using both a detection model running on our own servers and the AI provider’s analysis. See Automated processing.
  4. Generation. We send the prepared photo, together with instructions derived from your selections, to our AI image provider, currently Google (Vertex AI on Google Cloud), which generates the figurine preview. In some cases, for example with certain file formats that our server cannot convert, the photo sent to the provider is the original file as uploaded. The name you ask to have engraved is not sent to the AI provider. The provider applies its own content-safety filters and may decline to generate an image.
  5. Order and fulfilment. When you complete your order, we pass it to the seller of the figurine, ZIGILAB s.r.o. Fulfilment happens on the seller’s side: the seller and its manufacturing and fulfilment partners receive what they need to produce and deliver the figurine: your name, e-mail address, phone number, your note, the pickup point, the engraving text, your product selections, a link to the chosen preview and, where a prepared photo exists, a link to that photo. The fulfilment links never give access to the original photo.
  6. Retention of the original. We retain the original photo once an upload has been stored, including where a later check (such as the subject count) refuses it or no order is completed. Uploads rejected before they are stored are not kept.

Who is responsible for what

NOT NULL AI s.r.o. operates the Photo-to-Figurine tool and is the controller for operating the tool, processing photos (including retained originals), automated checks, AI processing, history and audit records, and security. The figurines are sold by ZIGILAB s.r.o. (IČO 21414912), Phov 4, 256 01 Soběhrdy, Czech Republic (zigilab.cz, podpora@zigilab.cz). When the tool collects and passes order and contact details and creates the payment session for ZIGILAB’s sale, we do so for ZIGILAB. ZIGILAB decides how it uses those details as the seller and is the controller for the sale, including payment, fulfilment, accounting and complaints, under its own privacy information. You can contact either company about this processing.

Access to original photos is restricted to our authenticated and authorised administrators and to authorised coworkers who hold the relevant permission. They may access originals for customer support, testing, audit, investigation of problems or complaints, and security or forensic purposes. Access to originals is logged.

Please remove location data before uploading if you do not want it to be stored. Many phones embed the location where a photo was taken into the file. We keep the original file as uploaded, including such information if it is present.

People shown in photos

A photo may show people other than the person who uploads it. By uploading a photo, you confirm that you are entitled to use it for this purpose and that the people shown in it (or, for children, their parents or guardians) agree to it being used to create a figurine. We rely on the person uploading the photo to inform them about this processing and to point them to this policy. Because informing people shown in photos directly would be impossible or involve disproportionate effort (Art. 14(5)(b) GDPR), we make this information publicly available in this policy. People shown in a photo can exercise their rights by contacting us as described in Your rights.

Order information stored in your browser

The widget stores your order progress in the browser of the website where it is used, so that you do not lose it if you reload the page or return from payment; see Cookies and browser storage.

6. Google Sign-In

You can create an account, sign in, or connect an existing account using Google Sign-In. When you do so, we ask Google only for the basic sign-in permissions openid, email and profile. With your permission, Google provides us with:

  • your Google account identifier;
  • your e-mail address and whether Google has verified it;
  • your name, given name and family name;
  • the address of your profile picture;
  • your language setting (locale) and, for Google Workspace accounts, your organisation’s domain, where Google provides them.

We do not request access to your Gmail, contacts, files, calendar or other Google data, and we do not retain or use Google access tokens or refresh tokens that would let us act in your Google account.

We use this information only to create your account, sign you in, connect your Google account to your NOT NULL AI account, keep your sign-in details up to date and protect your account. If Google confirms that your e-mail address is verified and it matches an existing NOT NULL AI account, we connect the Google sign-in to that account automatically. You can connect or disconnect Google Sign-In in your account settings. We keep a record of when a Google account was connected, used or disconnected.

You can disconnect Google Sign-In in your account settings and request erasure of the Google account information we hold by writing to info@notnullai.com. We handle erasure requests as described in Your rights.

We do not sell Google user data, use it for advertising, or share it with third parties other than the service providers who help us run the Services, or where required by law. Google processes your data during sign-in under its own privacy policy, as an independent controller.

7. Payments

Payments are processed by Stripe through its hosted checkout pages. You enter your card or other payment details directly on Stripe’s pages; we do not receive or store your full card number or security code.

  • Chat credit is paid to NOT NULL AI s.r.o. through our own Stripe account. When you start a top-up, we pass your account e-mail address to Stripe to pre-fill the checkout.
  • Photo-to-Figurine orders are paid to the seller of figurines, ZIGILAB s.r.o. (IČO 21414912), through the seller’s own Stripe account. We pass your order e-mail address, your language and the order items (including any engraving text) to Stripe. ZIGILAB s.r.o. receives the order and contact details it needs to sell and deliver the figurine and to handle payments, accounting and complaints, and it processes them as a separate controller under its own privacy information; see the Terms and Conditions for its identification.

We receive and store information about each payment: the amount and currency, the status, dates, Stripe identifiers, and the event data that Stripe sends us about the payment. That event data may include the payer’s name, e-mail address and billing country or address. We also keep our own records of balances, top-ups, charges for usage, orders, refunds and requests to withdraw unused credit.

Stripe processes payment data on behalf of the payment recipient and also, for purposes such as fraud prevention and compliance with financial regulations, as an independent controller under its own privacy policy.

8. Service history, audit and security records

We deliberately keep a history of meaningful events and changes in our own application database. This history lets us reconstruct what happened in a workflow, for example how an order moved from upload to payment and delivery, when contact details were changed, how a payment was processed, or which actions were taken on an account. It may include:

  • records of requests to parts of the Services, including IP address, browser information, preferred language, time and the part of the Services involved;
  • the event history of orders and items, including changes to contact details and delivery choices;
  • payment and balance events;
  • account and security events, such as registration, activation, sign-in method changes, password changes and account closure (including the IP address and browser information used to close the account);
  • audit records of actions taken by administrators, coworkers and partners in the administration interface, including access to original photos.

We use this history to provide the Services, support customers, find and fix errors, reconstruct and verify transactions, keep the Services secure, investigate abuse, fraud and security incidents, audit our operations and establish, exercise or defend legal claims. The exact form of these records may change as the Services evolve, but their purposes remain those described here.

The service is not designed to record your mouse movements, scrolling or keystrokes. We do not currently use session-replay or behavioural analytics tools.

10. Automated processing

Several parts of the Services work automatically, without a person reviewing each case. We want to explain them plainly.

  • AI responses and previews. Chat responses and figurine previews are generated automatically by AI models based on what you submit.
  • Counting subjects in a photo. For Photo-to-Figurine, a detection model on our servers and the AI provider’s analysis each estimate how many people or animals the photo shows. We use the higher estimate. This number sets the group price multiplier for the figurine (for example, a figurine of two subjects costs more than one of a single subject). If no subject is detected, the single-subject price applies. The resulting price is shown to you before you pay.
  • Groups larger than three. If the estimate exceeds three subjects, the widget does not accept the photo; contact the seller, ZIGILAB s.r.o., for an individual offer.
  • Content-safety filters. The AI provider applies its own content-safety filters and may decline to generate a preview; the widget then shows that generation failed and lets you try again, for example with a different photo.
  • Technical and security checks. We automatically check files (type, size, dimensions), limit the rate of certain requests and refuse requests that do not meet technical or security requirements.

These steps do not involve profiling in the sense of evaluating your personal aspects, and they are not decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR: you see the price before deciding whether to buy, and a refused photo or failed generation does not prevent you from trying again or contacting the seller, ZIGILAB s.r.o., for an individual offer. Nevertheless, if you believe an automated outcome is wrong, for example that the number of subjects was estimated incorrectly, you can contact us at info@notnullai.com and ask for a person to review it and to hear your point of view.

11. Who we share data with

We share personal data only as necessary for the purposes in this policy. Our service providers change from time to time; where we name providers below, they are our current providers and we may replace them with others offering appropriate safeguards.

  • Hosting and infrastructure providers that host our servers, database and file storage in the European Union (currently in Germany), acting as our processors.
  • AI model providers, currently including OpenAI, Anthropic, Google (Google Cloud Vertex AI) and Mistral AI, which process chat content and photos to generate responses and previews, acting as our processors; see Chat and AI model providers.
  • E-mail service provider (currently Google), which transmits and stores the e-mails we send and receive.
  • Affiliated companies that provide administrative or operational support to us, under confidentiality and only as needed.
  • Payment service provider, currently Stripe, which processes payments as described in Payments.
  • Google as provider of Google Sign-In (as an independent controller) and of web fonts used by the Photo-to-Figurine widget.
  • The seller of figurines, ZIGILAB s.r.o. (IČO 21414912), which receives the order and contact details it needs to sell and deliver figurines and to handle payments, accounting and complaints, and processes them as a separate controller under its own privacy information.
  • The seller’s manufacturing and fulfilment partners that produce and hand over figurines; they receive the order details described in Photo-to-Figurine, including links to the prepared photo and preview that do not give access to the original photo.
  • Packeta (Zásilkovna s.r.o.), whose pickup-point selector runs in your browser when you choose a pickup point and which receives the data needed to deliver the parcel to the selected pickup point, as an independent controller.
  • Promo-code partners, who see only aggregated information about orders placed with their code and the resulting commission, not the names or contact details of customers.
  • Operators of websites that embed the Photo-to-Figurine widget. The widget runs within their web page and stores order progress in the browser on their website, so the website and its scripts may technically be able to access the information you enter into the widget.
  • Our authorised administrators and coworkers, bound by confidentiality, with access limited to what their role requires.
  • Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality.
  • Public authorities, courts and other bodies where we are required by law to disclose data, or where it is necessary to establish, exercise or defend legal claims.
  • A successor or acquirer of all or part of our business, if the business or the relevant Services are transferred, subject to this policy.

Processors act only on our instructions and under contracts that require them to protect personal data.

12. International transfers

We host the Services in the European Union. However, some of our service providers, or their subprocessors, are located or process data outside the European Economic Area (EEA), in particular in the United States. This currently concerns, for example, OpenAI, Anthropic, Google and Stripe. AI requests to some providers may be processed in any region where they operate, including outside the EEA.

Where personal data is transferred outside the EEA, we rely on:

  • an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the recipient is certified under it (Google LLC and Stripe, LLC are certified as at the date of this policy); or
  • Standard Contractual Clauses approved by the European Commission, where the provider’s data processing terms incorporate them, together with any applicable supplementary measures.

You can ask us for more information about these safeguards or for a copy of them by writing to info@notnullai.com.

13. How long we keep data

We keep personal data for as long as it is needed for the purposes for which we process it, and in particular:

  • Account and chat data for as long as your account exists, and after it is closed for as long as needed for the purposes below.
  • Payment, balance, order and other accounting records for the periods required by accounting, tax and other applicable law, which can be up to ten years, and for as long as needed to handle complaints, refunds and disputes.
  • Photo-to-Figurine photos, previews and order data for as long as needed to complete the order and support the handling of complaints and warranty claims, and for the support, audit, investigation and security purposes described in this policy. The seller keeps its own records under its own privacy information.
  • History, audit and security records for as long as they are reasonably needed to reconstruct transactions, investigate incidents and abuse, and protect the Services.
  • Data relevant to legal claims for the duration of the applicable limitation periods and, where a dispute, investigation or proceeding is pending, until it is concluded.

Because these purposes can last for a considerable time, much of this data is kept for an extended period. When data is no longer needed for any of these purposes, it is to be deleted or anonymised. Deletion is currently not automated for every category of data: we delete or anonymise data that is no longer needed when we identify it, and in any case when we handle a request from you. Copies in backups are kept until the backups are overwritten or deleted in the ordinary course of operation.

Deleting conversations and closing your account

Deleting a conversation removes it from your view but does not erase it from our systems. Closing your account disables sign-in and ends your sessions. The account record, including your e-mail address, password hash and linked Google identity, and the organisation and balance, conversations, files, payments, orders, and audit and security records remain as described above where needed for legal obligations, claims, security and the other purposes in this policy.

If you want your personal data erased, you can ask us to do so; see Your rights. We assess each request under Article 17 GDPR and erase or anonymise the data we do not need to keep for another lawful purpose.

14. Your rights

Your right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests, you can object at any time, on grounds relating to your particular situation, by writing to info@notnullai.com. We will then stop, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

Under the GDPR you have the following rights, subject to the conditions and exceptions set out in the law:

  • Access – to obtain confirmation whether we process your personal data and a copy of it, with information about the processing.
  • Rectification – to have inaccurate data corrected and incomplete data completed.
  • Erasure – to have your data erased where, for example, it is no longer needed or you have successfully objected, unless we need to keep it, for example to comply with a legal obligation or to establish, exercise or defend legal claims.
  • Restriction – to have the processing of your data restricted, for example while the accuracy of data or an objection is being assessed.
  • Data portability – to receive data you provided to us, which we process by automated means on the basis of a contract or consent, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
  • Withdrawal of consent – where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
  • Human review – to ask for a person to review an automated outcome, as described in Automated processing.

How to exercise your rights

Send your request to info@notnullai.com, ideally from the e-mail address associated with your account or order, and tell us which right you wish to exercise. If we have reasonable doubts about your identity, we may ask for the additional information necessary to confirm it, and only that. We will respond without undue delay and in any event within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months; we will tell you if that happens and why. Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive.

You can also correct some data yourself, for example by changing your password or connecting or disconnecting Google Sign-In in your account settings.

Right to lodge a complaint

If you believe that we process your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. In the Czech Republic, the supervisory authority is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz. We would appreciate the chance to address your concern first, so please consider contacting us beforehand.

15. Data we receive from others

Most of the data we process comes directly from you or is generated when you use the Services. We also receive personal data from:

  • Google, when you use Google Sign-In: the account information listed in Google Sign-In.
  • Stripe, about payments you make: payment status and identifiers and, depending on the payment, your name, e-mail address and billing country or address.
  • Packeta, through its pickup-point selector: the details of the pickup point you choose.
  • AI providers: the responses, previews, subject estimates and content-safety information they return, which may relate to you or to people you describe or show.
  • Other users: photos and prompts submitted by others may contain information about you, for example when someone uploads a photo that shows you. See People shown in photos.

The purposes, legal bases, recipients, retention and your rights described in this policy apply to this data in the same way.

16. Cookies and browser storage

We use cookies and browser storage that are necessary to provide the Services you use. We do not currently use analytics, advertising or tracking cookies or third-party analytics or advertising tools. If we introduce cookies or storage that are not necessary, we will ask for your consent where the law requires it.

NOT NULL AI website and Chat

  • Session cookie – keeps you signed in and protects forms against cross-site request forgery. It may be set when you visit our pages, even before you sign in, and it generally expires when you close your browser.

Administration interface

  • Session cookie – keeps authorised users signed in and protects forms.
  • Two preference cookies – remember the display theme and the state of the sidebar that the user has chosen.

Photo-to-Figurine widget

The widget sets no cookies. It uses browser storage on the website where it is embedded:

  • Local storage – keeps your order in progress, including your contact details, your note, the selected pickup point, information about the generated previews and a session token that lets you continue the order. It is cleared when payment is completed or the order is reset; otherwise it stays in your browser until you clear it.
  • IndexedDB – temporarily keeps photos and edits you have added but not yet sent for generation, so that they survive a page reload. They are removed when the photo is sent or removed, and in any case once they are older than 48 hours, when the widget is next opened.
  • Session storage – briefly remembers your scroll position so that you return to the right place after payment.

If you use a shared device, you can clear this information through your browser’s settings for the website concerned.

Third-party requests

When the Photo-to-Figurine widget is displayed, your browser loads fonts from Google Fonts. Your IP address and technical browser information are transmitted to Google for this purpose. We rely on our legitimate interest in the widget’s presentation (Art. 6(1)(f) GDPR) for this load. When you choose a pickup point, your browser loads Packeta’s pickup-point selector. When you pay, you are redirected to Stripe. These providers receive your IP address and technical browser information as needed to deliver their content or service, and process it under their own privacy policies.

17. Children

Our Services are intended for adults aged 18 or over and are not directed at children. We do not knowingly collect personal data from children as users of the Services. If you believe that a child has provided us with personal data, please contact us and we will take appropriate steps.

Photos of children may be uploaded to Photo-to-Figurine only by, or with the agreement of, a parent or guardian; see People shown in photos.

18. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure, taking into account the nature of the data and the risks involved. These include encrypted connections, hashed passwords, role-based access control for our administrators and coworkers, logging of administrative access to sensitive data, and restricted access to our systems.

No method of transmission or storage is completely secure, and we cannot rule out every risk. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you and the supervisory authority as required by law.

You can help by choosing a strong, unique password, keeping it confidential and signing out on shared devices.

19. Changes to this policy

We may update this policy when our Services, our providers, our processing or the law change. The current version is published on this page, with the date of its last update shown at the top.

If we make material changes, such as processing personal data for a new purpose or in a significantly different way, we will inform you by reasonable means before the changes take effect, for example by e-mail or by a notice in the Services. Where the law requires your consent to a change, we will ask for it.