Privacy Policy
Last updated: October 13, 2026
1. Data Controller (Správce osobních údajů)
Egemen Toprak
OSVČ (Self-employed person / Osoba samostatně výdělečně činná)
IČO (Identification Number): 22240322
Email: privacy@permit.cz
Website: https://permit.cz
The controller processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Czech Act No. 110/2019 Coll. on the processing of personal data (Zákon o zpracování osobních údajů).
2. Personal Data We Collect
We collect and process the following categories of personal data:
2.1 Account Data
- Email address (required for account creation)
- Name (if provided)
- Authentication tokens and session identifiers
2.2 Immigration Case Data
- Permit type, application status, and timeline information
- Documents and document metadata you upload
- Checklist progress and notes
2.3 AI Assistant Interactions
- Questions you ask the AI immigration assistant
- Conversation history (stored for continuity and quality improvement)
2.4 Technical Data
- IP address, browser type, operating system
- Pages visited, time of access, referring URL
- Cookies and similar identifiers (see our Cookie Policy)
2.5 Email Updates
If you sign up for email updates about changes to official Czech immigration rules, we keep:
- your email address;
- the wording you agreed to and its version, the page you signed up on, and when you asked, confirmed and (if you do) unsubscribed. This is our record of your consent;
- a keyed hash of your IP address, used only to limit repeated sign-up attempts and deleted after 30 days;
- which updates we sent you, and when.
Signing up does not create a Permit.cz account and gives no access to paid features. We email you only after you confirm through the link we send (double opt-in), and every update has a one-click unsubscribe link.
3. Legal Bases for Processing (Article 6 GDPR)
| Purpose | Legal Basis |
|---|---|
| Providing the Permit.cz service (account, case tracking, AI assistant) | Art. 6(1)(b) — Performance of a contract |
| Analytics and service improvement | Art. 6(1)(a) — Your consent (via cookie banner) |
| Email communications about your account | Art. 6(1)(b) — Performance of a contract |
| Email updates about rule changes, after you sign up and confirm | Art. 6(1)(a) — Your consent |
| Keeping the record of that consent, and of your unsubscribe so we never email you again | Art. 6(1)(f) — Legitimate interest (and Art. 7(1), showing that consent was given) |
| Legal obligations (invoicing, tax records) | Art. 6(1)(c) — Legal obligation |
| Security, fraud prevention | Art. 6(1)(f) — Legitimate interest |
4. Data Sharing and Processors
We share personal data only with trusted third-party processors who assist in operating our service:
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | EU (Frankfurt) | Standard Contractual Clauses (SCCs) |
| Vercel Inc. | Website hosting and content delivery; page-view counts (Vercel Web Analytics), only with your analytics consent | EU edge network | SCCs, DPA |
| OpenAI Inc. | AI assistant responses | USA | SCCs, DPA; API data not used for training per OpenAI API terms |
| Google LLC | Analytics (with consent only) | USA | SCCs, consent-based; IP anonymization enabled |
| Resend, Inc. | Sending our emails (sign-in links, receipts, and email-update confirmations and updates) | USA | SCCs (Module Two), incorporated in Resend's Data Processing Addendum |
We do not sell your personal data to any third party. We do not share data with advertisers, data brokers, or any party not listed above.
5. International Data Transfers
When data is transferred outside the EU/EEA (to OpenAI, Google and Resend in the USA), we rely on European Commission-approved Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR, supplemented by additional technical measures (encryption in transit via TLS 1.2+, encryption at rest).
6. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data | Until account deletion + 30 days backup |
| Immigration case data | Until account deletion or manual removal by user |
| AI conversation history | 90 days, then automatically deleted |
| Analytics data | Google Analytics: the period set in our Google Analytics property (Google offers 2 or 14 months). Vercel Web Analytics: according to Vercel, the visit identifier is discarded after 24 hours |
| Things kept in your browser | Until you clear them; see section 8 |
| Invoicing / tax records | 10 years (Czech Act No. 563/1991 Coll. on Accounting) |
| Server logs | 30 days |
| Email-update sign-up you never confirmed | Deleted 30 days after your last request (the confirmation link itself expires after 48 hours) |
| Confirmed email-update subscription | Until you unsubscribe |
| After you unsubscribe | Your address, the consent record and the unsubscribe date, so that we never email you again and can show what you agreed to; deleted if you ask us to erase them |
| IP-address hash from a sign-up | 30 days |
7. Your Rights Under GDPR
As a data subject, you have the following rights. To exercise any of them, contact us at privacy@permit.cz. We will respond within 30 days.
- Right of access (Art. 15) — Request a copy of your personal data.
- Right to rectification (Art. 16) — Correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — Request deletion of your data ("right to be forgotten").
- Right to restriction (Art. 18) — Restrict processing in certain circumstances.
- Right to data portability (Art. 20) — Receive your data in a machine-readable format.
- Right to object (Art. 21) — Object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7(3)) — Withdraw consent at any time without affecting prior processing.
- Right to lodge a complaint — File a complaint with the Czech Data Protection Authority (ÚOOÚ).
Czech Data Protection Authority (Supervisory Authority)
Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
Web: www.uoou.cz
Email: posta@uoou.gov.cz
8. Cookies and Browser Storage
Some things are kept in your own browser rather than sent to us. The full list, with names and how long each lasts, is in our Cookie Policy. In short:
- Cookies remember your cookie choices, keep subscribers signed in, and record whether this browser has used its free exam paper. Analytics cookies (Google Analytics) are set only if you agree.
- Local storage keeps what you type into a form's companion (including personal details shared between forms, which are never sent to us), your last result in "Find your next step", and your assistant conversation. It stays until you clear it: "Clear all" on a form, "Clear chat" in the assistant, or clearing this site's data in your browser.
- Session storage briefly carries a homepage search to the forms list, and is gone when you close the tab.
- Memory only: your answers while you are still answering "Find your next step", and the renewal date check, are not stored at all.
You can give or withdraw analytics consent at any time with "Cookie settings" at the bottom of every page. Withdrawing deletes the Google Analytics cookies and stops both analytics services.
9. Security Measures
We implement appropriate technical and organizational measures to protect your data:
- All data transmitted via TLS 1.2+ encryption
- Database encryption at rest (AES-256)
- Row-Level Security (RLS) ensuring users can only access their own data
- Authentication via industry-standard protocols (Supabase Auth)
- Regular security reviews and dependency updates
- API keys and secrets stored in environment variables, never exposed to the client
10. Children's Privacy
Permit.cz is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately.
11. Automated Decision-Making and AI
Our AI immigration assistant provides informational guidance only. It does not make legally binding decisions about your immigration case. All AI-generated content should be verified with official Czech government sources or a qualified immigration lawyer.
AI conversations are processed by OpenAI via their API. Per OpenAI's API data usage policy, data sent via the API is not used to train their models.
12. Changes to This Policy
We may update this privacy policy from time to time. Material changes will be communicated via email or a prominent notice on the website. The "Last updated" date at the top indicates when the latest revision was made.
13. Contact
For privacy-related inquiries:
Egemen Toprak
Email: privacy@permit.cz
IČO: 22240322