Privacy Policy

Effective from 5 October 2026, supplemented 7 October 2026 (users and profile photos, Facebook and Instagram, artificial intelligence, website chat, Microsoft Clarity and Google signals on the website) · Privacy Policy of the Vindario application. The Czech version (Zásady ochrany osobních údajů) prevails in case of doubt.

This policy explains how personal data are processed on the vindario.com website, in the Vindario application (a CRM running in the browser at *.vindario.com) and in the Vindario CRM Android app (cz.vindario.crm).

1. Who we are

ČESKOMORAVSKÁ DOTAČNÍ, spol. s r.o.
Pražákova 1008/69, Štýřice, 639 00 Brno, Czech Republic
Company ID (IČO) 26947153, VAT ID CZ26947153
registered in the Commercial Register kept by the Regional Court in Brno, section C, file 47319
Privacy contact: [email protected]

We have not appointed a Data Protection Officer as we are not required to. All requests are handled by the operator at the e-mail above.

2. Controller and processor

• We are the controller for data of visitors of vindario.com, people who contact us (for example to request a demo), contact persons of our customers and security logs of the application.
• We are a processor for all data that a company using Vindario (our customer) stores in it: its clients, deals, e-mails, calls, contracts, calendars, messages and data about its employees and partners. The company is the controller and provides its own privacy information to its clients and staff. We process these data only on its instructions and under a data processing agreement.

Vindario users. People who work in Vindario (employees and partners of our customers) have an account created by their company. The data the company keeps about them in Vindario (name, contact, role, profile photo, records of work) we process for the company as processor; the company, as their employer or contractual partner, gives them its own information (in Vindario under Settings → GDPR). As controller we process about users only what we need for the secure operation of the service: sign-in and security logs and communication with the user about operation and support.

If you are a client of a company that uses Vindario, please contact that company first. If you write to us, we will forward your request to the company and help to resolve it.

3. Data we process as controller

4. Data we process for customers (as processor)

Depending on which parts of Vindario a company uses:

• contacts and companies (name, address, phone, e-mail, notes, data from public registers ARES, RÚIAN and the Czech land registry), deals, quotes, contracts and signatures, installations, complaints, commissions and invoices;
• e-mails from mailboxes the company connects to Vindario (via IMAP and SMTP), including attachments;
• calls and call recordings from the CloudTalk phone system, if connected;
• internal team chat, enquiries from the company’s web forms and messages from the company’s customers;
• user data: name, e-mail, phone, role, profile photo, settings, notification devices and activity records;
• user location only in the mobile app, only when the user turns it on and consents, and only while route tracking is on (shown by a visible notification; the app has no background location access otherwise).

The data belong to the company. We do not use them for anything other than providing the service, we do not sell them and we do not use them for advertising. Vindario does not automatically delete data that users stored; deletion is always a deliberate action of an authorised user or the handling of a request.

User profile photo

The photo is optional. It can be uploaded by the user or by the administrator of the user’s company; the company may use it only with the consent of the person in the photo. We store the photo in publicly accessible storage: it is stored so that anyone who knows its web address can open it, even without signing in. This is so that it displays wherever the company uses it outside the application:

• in the e-mail signature and on the digital business card, if the company sets them up with the photo: recipients of the e-mails can see it;
• in the chat window on the company’s website, when the user takes over a conversation with a visitor: the visitor sees the user’s first name, job title and the photo, if the user has one.

Inside the application only colleagues from the same company see the photo. The user or the company administrator can remove it at any time in Settings, in the E-mail signatures section (Profile photograph). The file is then removed from the storage and the image stops loading in e-mails sent earlier. After removal the photo may remain in backups for a limited time, from which it is overwritten automatically.

5. Google integration (Calendar, Tasks, Drive)

A user may connect a Google account to Vindario. Vindario requests only these scopes:

• Google Calendar (calendar): two-way sync of meetings, calls and tasks between Vindario and the user’s calendar;
• Google Tasks (tasks): sending tasks from Vindario to Google Tasks;
• Google Drive (drive): client folders on the company’s Drive, uploading and showing client documents, including files that others added to the folder via a shared link;
• e-mail address and identity (userinfo.email, openid): matching the Google account to the right user and signing in with Google.

Vindario does not use the Gmail API and does not access Gmail through Google. Mailboxes are connected separately via IMAP, only if the company sets this up.

We use data received from Google APIs only to provide user-facing features that the user can see and has enabled. We do not sell them, do not use them for advertising or creditworthiness and do not use them to train AI or machine-learning models. Our staff do not read them unless the user consents, it is necessary for security or investigating abuse, or it is required by law. Access tokens are kept only on the server and never reach the browser.

You can disconnect at any time in Vindario settings or at Google Account → Third-party apps with account access.

6. Facebook and Instagram integration (Meta)

A company can connect its Facebook Page and Instagram account to Vindario. The messages its customers send via Messenger and Instagram Direct then appear in Vindario and the company replies from there. For these messages the company is the controller and we process them as its processor. Messenger and Instagram are operated by Meta Platforms Ireland Limited as an independent controller under its own policies.

When a company connects its Page (via Facebook Login), we process:

• the ID and name of the connected Page and of the company’s Instagram account and the access token issued by Meta (stored encrypted);
• messages and attachments that customers send to the company or the company sends from Vindario; attachments are stored in private storage;
• data about the customer that Vindario loads from Meta: the page-scoped ID, name, username and profile picture (a copy is stored in private storage because the link from Meta stops working after a time); for Instagram also the number of followers, whether the customer follows the company’s account and the company follows them, and whether the account is verified, so that the company can recognise fake and spam accounts and verified profiles. The data are loaded after the customer’s first message, then refreshed roughly once a week, and a company employee can reload them with a button. Only people at the company who have access to customer messages can see them.

These data are used only to display the conversation, to tell customers apart and to reply, and the Instagram data additionally to recognise fake and spam accounts and verified profiles. We do not use them for advertising, do not sell them and do not use them to train AI models. Messenger and Instagram messages are not sent to AI automatically; only when a company employee asks the internal assistant Dotík can the conversation title (the customer’s name) and a preview of the last message (up to 140 characters) reach the model.

The company should inform its customers about this in its own policy; data obtained from Meta are data the customer did not give to the company directly (Art. 14 GDPR).

Disconnecting the Page stops new messages and invalidates the access token. Existing messages stay with the company until it deletes them or asks us to. How to request deletion is described on the Data deletion page.

7. Artificial intelligence

Some features use AI models. Data are sent to the provider only when the feature runs. Some features run automatically once a company turns them on or connects them: sorting of incoming e-mail (new e-mails and their attachments are sent automatically to Google Gemini; automatic sorting can be switched off for each connected mailbox) and transcription of recorded calls (recordings go to xAI). Other features start only when a user uses them.

• Google Gemini: the Dotík assistant, sorting and drafting replies to e-mails including attachments, text correction, grant advisor, analysis of project documents;
• xAI (Grok): transcription and summaries of call recordings and voice notes.

Website chat. General questions in the chat window are answered by the automated assistant Botík (Google Gemini). At first contact it says that it is artificial intelligence and each of its replies is labelled as such (Art. 50 of the EU Artificial Intelligence Act). It answers only from prepared materials, has no access to data in Vindario and does not write, order or pass anything on by itself. At most the last 20 messages of the conversation are sent to Google, only to prepare the reply; telephone numbers, e-mail addresses, personal ID numbers, account and card numbers and passwords are masked automatically before sending (recognition by pattern may not catch everything, so please do not type personal ID numbers, health data or account numbers into the chat). The name and contact you enter in the chat form are not sent to Google. The conversation is stored in Vindario in a database in the EU (Ireland) and our colleagues who handle enquiries can see it; you can write to a person with the “Chci mluvit s člověkem” (“I want to talk to a person”) button. If you type a phone number or e-mail address into the chat, Vindario stores it with the conversation and our colleagues are notified so that they can get back to you (no contact record is created automatically). The chat window does not use cookies; it stores only a conversation identifier in your browser, and only once you write your first message (see cookie information (Czech)).

We use Google Gemini as a paid API service, not a free one. Google processes the data from our requests as our processor under its data processing terms and, under the terms of the paid service, does not use them to improve its products or to train models; it may keep request logs for a limited time to detect abuse of the service. We use xAI through its API; transfers to the USA are based on the standard contractual clauses in that company’s data processing agreement (Data Processing Addendum).

Dictation. Text fields can be dictated. Speech-to-text is performed by the service of your browser or phone, not by Vindario: depending on the browser and device, by its manufacturer (for example Google or Apple) under its own policies. Vindario receives only the resulting text and does not store the audio from dictation. Dictation starts only after you tap the microphone.

No automated decision-making. The Dotík assistant always shows each change as a proposal for approval and never deletes or sends anything on its own. AI in Vindario never decides about people on its own in a way that would have legal or similarly significant effects. E-mail sorting only orders messages; a person decides on the next step.

8. Processors and recipients

Queries to public registers (ARES, RÚIAN, the Czech land registry ČÚZK, the insolvency register) go directly to state authorities. We disclose data to public authorities only where required by law. Meta Platforms Ireland Limited is not our processor but an independent controller (see section 6). Transfers outside the EU rely on the European Commission’s Standard Contractual Clauses or, where the provider is certified, on the EU–US Data Privacy Framework.

9. Retention

• Customer data in Vindario for the term of the contract. Afterwards we hand them over in a machine-readable format on request and then delete them unless the law requires retention.
• Database backups: daily backups at Supabase for 7 days and nightly copies for 60 days, then 30 days in trash. File copies in backups are removed manually on request.
• Messages from website chat, Messenger and Instagram and data about the customer loaded from Meta: for customers of companies for as long as the company decides; for the chat on vindario.com 12 months from the last message, after which we delete or anonymise them without undue delay. Deletion after the period expires is carried out by an authorised employee; at your request we delete the data sooner unless we must keep them by law.
• If a conversation leads to you becoming our customer, our communication becomes part of the customer records. We keep it for as long as our relationship lasts, until you tell us you no longer want our care or ask for erasure (legitimate interest, Art. 6(1)(f) GDPR — you may object). Data we must keep by law are kept for the period the law sets.
• Vindario does not automatically delete data that users stored. Deletion is always done by a person: an authorised user of the company, or us on request.
• Other data as listed in section 3.

10. Android app

The Vindario CRM app opens the Vindario application of the selected company and uses these phone permissions, always only after you allow them: camera (photos for a client or a message), microphone (voice notes and dictation), location (address lookup and route tracking you turn on, with a visible notification), notifications (new messages, tasks and events) and contacts (only if the user turns it on: Vindario contacts are saved to a separate account so that the caller’s name shows on incoming calls). Push notifications are delivered by Google Firebase Cloud Messaging; the notification text may pass through Google servers.

11. Security

Data are transferred encrypted (HTTPS). Access requires sign-in and two-factor authentication can be enabled. Each user sees only what their roles and permissions allow. Each company’s data are separated. Only the application server can access the database and changes are recorded in an audit trail.

12. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, the right to object to processing based on legitimate interest and the right to withdraw consent at any time (with effect for the future). Write to [email protected]; we reply within one month. You may also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7.

To have a conversation in the website chat deleted, e-mail us stating when you wrote and how you signed yourself. You may object to processing based on legitimate interest (for example the record of a conversation).

How to delete your account and data is described on the Data deletion page.

13. Changes

We update this policy when the service or providers change. The current version is always on this page with its effective date. We inform customers about material changes in advance.