Privacy Policy, ZAPSIO

Last updated: 16. 6. 2026 • Version 1.1

Your privacy is essential to us. This document explains what personal data we collect, why, how we protect it and what rights you have. Processing is carried out in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Act No. 110/2019 Coll., on the Processing of Personal Data.

Data controller:
Jakub Polách, self-employed sole trader (OSVČ)
Company ID (IČO): 29584701
Address: Všeň 67, 512 65 Všeň
E-mail: info@zapsio.com

1. What personal data we process

a) Data provided by the User

Registration data: e-mail address, name (if provided).
Payment data: we do not process card numbers, expiry dates or CVC codes; all payment information is handled exclusively by the Stripe payment gateway (PCI DSS Level 1). We only see an anonymised token, the card type and the last 4 digits.
Meeting recordings: audio/video files uploaded to the application, their transcripts and AI analyses. The content of the meetings belongs to you; we process it solely to provide the Service.

b) Data collected automatically

Technical data: IP address, browser type, operating system.
Analytics data: pages visited, session duration, interactions with the application (via anonymised analytics).
Cookies: see the Cookie Policy.

2. Purposes and legal bases of processing

Purpose of processing	Legal basis (GDPR)	Retention period
Provision of the Service (login, transcription, analysis)	Performance of a contract (Art. 6(1)(b))	For the lifetime of the account + 3 months
Invoicing and tax obligations	Legal obligation (Art. 6(1)(c))	10 years under tax legislation
Sending transactional e-mails (payment confirmations, etc.)	Performance of a contract (Art. 6(1)(b))	For the lifetime of the account
Sending news and marketing communications	Legitimate interest / consent (Art. 6(1)(a) or (f))	Until consent is withdrawn / until you unsubscribe
Security and fraud prevention	Legitimate interest (Art. 6(1)(f))	90 days (logs)
Web analytics (anonymised)	Legitimate interest / consent (Art. 6(1)(a) or (f))	26 months

3. Processors and recipients of data (third parties)

We share your data only with vetted partners, and only to the extent strictly necessary to operate the Service:

Partner	Purpose	Registered office / Transfer outside the EU
Supabase	Database, authentication, file storage	EU (Frankfurt), no transfer outside the EU
OpenAI, Inc.	Transcription (Whisper) and AI analysis (GPT)	USA, transfer based on Standard Contractual Clauses (SCCs)
Stripe, Inc.	Payment processing	USA, transfer based on SCCs, EU-US DPF certification
Vercel, Inc.	Web application hosting	USA / EU, based on SCCs

We do not sell your personal data to third parties. We do not disclose data to public authorities except where required by law.

4. Data security

We take the following technical and organisational measures to protect your data:

All communication is encrypted using HTTPS/TLS.
Meeting recordings are stored in encrypted storage (Supabase Storage).
Access to data is limited to authorised persons on a least-privilege basis.
Payment data is never stored on our servers (it is handled by Stripe).

5. Your rights as a data subject

Under the GDPR, you have the following rights:

Right of access To request, at any time, a copy of the personal data we process about you.

Right to rectification To have inaccurate or incomplete data corrected.

Right to erasure To request deletion of your data where there is no ground for further processing.

Right to data portability To receive your data in a machine-readable format.

Right to object To object to processing based on legitimate interest.

Right to withdraw consent To withdraw your consent to marketing communications at any time.

You can exercise your rights by e-mail at info@zapsio.com. We will respond within 30 days. You also have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Czech Republic (ÚOOÚ) (uoou.cz).

6. Meeting recordings and content

Audio recordings and their transcripts are stored solely for your own use. We do not use the content of your meetings to train AI models or for any other purpose without your express consent.

Recordings are automatically deleted 90 days after being deleted from the application or 90 days after the account is closed.

Notice: You are responsible for ensuring that all participants in a recorded meeting have been informed of the recording and have given their consent. ZAPSIO accepts no liability for unauthorised recording of third parties.

7. Children

The ZAPSIO service is not intended for persons under 16 years of age. If we discover that we have collected data about a child under 16 without parental consent, we will delete the data without undue delay.

8. Changes to this document

This document may be updated from time to time. We will inform you of material changes by e-mail. The date of the last update is always shown at the top of the document.

9. Contact

If you have any questions about the protection of personal data, write to us at info@zapsio.com.