1. Controller and contact
The controller of account, contract, payment, security and support data is Martin Kučera, Družstevní 705/IV, 503 51 Chlumec nad Cidlinou, Czech Republic, Company ID 00959324, registered in the Trade Register maintained by the Municipality of Hradec Králové. Privacy requests may be sent to info@alt-popisky.cz or Czech data box yui7vyc. The Provider has not appointed a data protection officer.
2. When we are controller or processor
We are controller of registration, contact, contract, payment, security and support data. For personal data contained in images, instructions, site metadata and ALT text processed by the customer through the service, we normally act as processor on the customer's instructions under the DPA.
3. Data, purposes and legal bases
- Account and contract: name, email, securely hashed password, business, registration or equivalent identifier, country, membership and settings — performance of a contract and pre-contract steps.
- Payments and credits: order, package, amount, variable symbol, bank matching data, accounting document and credit movements — performance of a contract and legal accounting or tax obligations.
- Operations and security: IP address or secure fingerprint, session, time, device, audit and error records — legitimate interests in protecting the service, preventing fraud and evidencing requests. We use Google reCAPTCHA v3 to protect sign-in and registration from automated abuse. Its browser component creates a verification token; our server sends it to Google and includes the IP address when obtained from an authenticated proxy. The server verification request does not include your password or email.
- Support: message, contact, technical material and resolution history — performance of a contract and legitimate interests in service quality and legal defence.
- Optional analytics or advertising: only after future deployment, prior user choice where required and an update to this policy.
4. Images and AI
For generation, the service sends image content and the necessary instruction to the OpenAI API to produce draft ALT text. The Altomat application database does not permanently store the original image file; it keeps necessary references, technical fingerprints, request state and generated or edited ALT text.
Under OpenAI's current terms, API data is not used to train models by default. Standard API abuse-monitoring data may generally be retained for up to 30 days unless another control is enabled for the account. Customers must not submit content without a lawful basis or requiring safeguards the service does not provide.
5. Recipients and suppliers
- Websupport — private VPS hosting and SMTP infrastructure; processor of operational data in the EU/EEA according to the configured service.
- OpenAI Ireland Limited / OpenAI, L.L.C. — AI processing of image content and instructions; subprocessor of customer content. Relevant contractual safeguards include standard contractual clauses.
- Fio banka, a.s. — receives and records bank payments as an independent controller under banking and legal obligations; it does not process customer images.
- Google — reCAPTCHA v3 for sign-in and registration protection, security, and fraud and abuse prevention; processor of data for this protection under the applicable contractual terms and data processing addendum. This service does not analyse customer images or generate ALT text.
- Public authorities, advisers or security suppliers only where required by law or necessary to protect rights and the service.
6. Transfers outside the EEA
The service is offered worldwide. OpenAI processing may occur outside the European Economic Area. The Provider uses safeguards described in the OpenAI DPA, including standard contractual clauses, and limits transferred data to what generation requires. The customer is responsible for the lawfulness of transferring its customer content into the service.
7. Retention
- Original images: not permanently stored in the application database; temporary OpenAI processing follows its current API controls, normally up to 30 days for abuse monitoring.
- Account, membership, site configuration and API keys: for the contract, then deleted or anonymised within a reasonable technical period after verification.
- Generated ALT text, request state and operational history: up to 24 months from creation, or earlier after approved deletion or closure unless needed to audit disputed usage.
- Active and revoked sessions: up to 30 days after expiry or revocation; verification and recovery tokens up to 30 days after expiry.
- Support communication and ordinary security logs: normally 24 months after closure or creation; longer only for an incident, dispute or legal obligation.
- Accounting, payment and credit records: for the statutory period, generally five years after the relevant accounting period; selected records may have a longer legal period or be retained during a dispute.
- Backups: removed from live operations without undue delay and overwritten through the secured backup rotation; not restored to ordinary use in the meantime.
8. Account deletion
Request deletion through the account or support@alt-popisky.cz. After verification, we delete or anonymise operational data and disconnect integrations. Records required for accounting, legal claims, a security incident or another legal obligation cannot be erased immediately; they are restricted to that purpose and removed when the period ends.
9. Cookies, measurement and advertising
The application uses technical cookies or equivalent storage for its own sign-in, security, language and user-preference functions. On sign-in and registration pages, we load Google reCAPTCHA v3 from www.google.com and execute it before the form is submitted. reCAPTCHA uses the _GRECAPTCHA cookie for risk analysis; www.google.com may also have other Google cookies set. We do not integrate GA4, Google Tag Manager or advertising tools into the application. Google Search Console may verify site ownership without visitor profiling.
If optional analytics or advertising tools are introduced, we will present the required prior choice before activation, update suppliers and purposes, and make withdrawal as easy as consent.
10. Commercial messages and cold outreach
Account data is not currently used for newsletters or advertising profiles. Any individual B2B outreach outside the application must comply with GDPR and electronic-marketing rules: it needs a specific legal basis and lawful sending route, clear sender identity, source transparency, the required notice and a simple free opt-out. Publication of an email address online is not blanket consent to advertising.
After an objection or opt-out, we retain the minimum address in a restricted suppression list. Any existing-customer exception for our own similar services is used only as allowed by law and with an opt-out when collecting the address and in every message.
11. Your rights
Subject to the GDPR conditions, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing and withdraw consent where processing relies on it. You may object to direct marketing at any time without giving reasons.
Send requests to info@alt-popisky.cz. We may reasonably verify identity and account authority. You may also complain to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
12. Security and incidents
We use risk-appropriate technical and organisational measures including encrypted transit, password hashing, access restrictions, audit trails, backups, vulnerability management and secret separation. No system is absolutely secure. Where a personal data breach is likely to risk individuals, we follow GDPR notification duties.
13. Changes
We update this policy when the service, suppliers or law changes. Material changes will be announced in advance in the application or by email. The current version and effective date always appear above.