Privacy Policy

1. Who processes your data

The operator of the Vyreportuj To website and app (referred to below as “we” or “the service”). For any privacy-related questions, you can reach us at kontakt@vyreportujto.cz.

2. What data we process

• Login credentials — email and password (we never see the password itself; it’s managed by Supabase Auth).
• Data you upload to the app — files (CSV/Excel), SQL/DAX queries, and their analyses.
• Technical data needed to run the service — your login session (cookies), basic site traffic (Vercel Analytics — anonymized, no third-party cookies).

3. How we handle uploaded data

This is the core of our architecture, and we take it seriously:

• We read column meaning from a sample only. When you upload a file, we send the AI model only its structure and a handful of leading rows to recognize what each column means — never the full file.
• Numbers in reports are computed by code, not AI. Sums, averages, trends and other values in charts and reports are computed deterministically by our own code, directly on your data. The AI only receives these already-computed facts to write the surrounding text (summary, comment, answer to a question) — never the raw table of rows. If an analysis breaks results down by a named category (e.g. “top 5 customers by revenue”), those names reach the AI as part of the computed result.
• You trigger any deeper analysis. Creating a report, dashboard, answering a question, or the SQL/DAX advisor always requires your explicit action — nothing runs automatically in the background without your knowledge.
• Your files stay in your account (Supabase Storage), and our app has no access to other users’ data — every query and operation is always scoped to the signed-in user.

4. Who we share data with (processors)

To run the service, we use these processors:

• Supabase — database, authentication, file storage.
• Vercel — app hosting (Frankfurt, EU region), basic anonymous traffic analytics.
• Resend — email notification delivery, European infrastructure.
• Google Cloud (Vertex AI) — processes AI requests (data recognition, reports, answers to questions, the SQL/DAX advisor) with EU data residency enabled. Depending on the workload, models from Anthropic or OpenAI may also be used — they only ever receive the text required for that specific request (see item 3).

5. International data transfers

AI processing runs through Vertex AI with EU data residency — data sent to the AI model doesn’t leave Europe. That said, some of our processors (primarily US companies) may still involve a transfer outside the EU/EEA in the broader sense of the GDPR. For those cases we have Standard Contractual Clauses (approved by the European Commission) in place with the relevant processors, or rely on their certification under the EU-US Data Privacy Framework. We’re happy to share the current list of processors and their terms on request.

6. Retention period

We retain data for as long as your account exists. After account deletion (or at your request), we remove login credentials and uploaded data within a reasonable time, no later than 30 days.

7. Your rights

You have the right to access your data, correct it, have it erased, restrict its processing, port it, and object to its processing. You may also contact the Czech Office for Personal Data Protection (uoou.cz). To exercise your rights, contact us at the email above.

8. Security and data breaches

Access to data is always scoped to the signed-in user and their account. We don’t apply any custom encryption beyond what our infrastructure providers (Supabase, Vercel) offer by default. If a security incident affecting your personal data were to occur, we will notify you without undue delay, and in line with the GDPR no later than 72 hours after we become aware of it.

9. Cookies

We only use technical cookies necessary for sign-in (Supabase Auth session). We don’t use marketing or third-party tracking cookies.