This English translation is provided for convenience only. The Czech version is legally binding.
1. Data Controller
Ing. Petr Kadlec, DiS., Company ID (IČO): 00724149
Email: info@hlasovka.com
2. What Data We Process
- Registration data: name, email, password (stored as a bcrypt hash)
- Profile data: phone, signature, organization (optional)
- Voice recordings: audio files uploaded by the user, transcribed using AI
- Generated documents: transcripts, extracted fields, DOCX/PDF outputs
- Payment data: processed exclusively by Stripe, Inc. — we do not store card numbers
- Technical data: IP address (rate limiting), session cookie
- Invitation request: email, an optional note and the visit source (UTM link parameters) — used solely to process the invitation
- Product statistics and diagnostics: first-party service usage events (e.g. “document created”, in-app page views, use of the record button, technical error reports) tied to the account, collected without IP addresses and without browser fingerprinting, processed exclusively by us (no third-party analytics services) and retained for no longer than 13 months — to improve the service and resolve technical issues
3. Purposes of Processing
- Providing the service (transcribing voice notes, generating documents, sending emails)
- Managing the user account and subscription
- Protection against abuse (rate limiting, email verification)
4. Legal Basis
Processing is necessary for the performance of a contract (Art. 6(1)(b) GDPR) — providing the service you have ordered. For protection against abuse we rely on our legitimate interest (Art. 6(1)(f) GDPR).
5. Third Parties (Processors)
| Service |
Provider |
Purpose |
| OpenAI API |
OpenAI, Inc. (USA) |
Audio transcription (Whisper), field extraction and style polishing (GPT-4.1). Under the OpenAI API terms, content is not used to train models. |
| Stripe |
Stripe, Inc. (USA) |
Payment processing and subscription management |
| SMTP provider |
Depends on configuration |
Sending emails (verification, records) |
| Hetzner |
Hetzner Online GmbH (DE) |
Server and database hosting |
For transfers to the USA we rely on Standard Contractual Clauses (SCC) and data processing agreements (DPA) concluded with the respective providers.
6. Data Retention
- User account and data: for the lifetime of the account
- Audio files: temporarily; deleted from the server after processing
- After account deletion, all data is irreversibly removed
7. Your Rights
Under the GDPR you have the right to:
- Access your data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure — deletion of the account and all data (Art. 17) — in Settings → Account
- Data portability — export of your data in a machine-readable format (Art. 20) — in Settings → Account
- Object to processing (Art. 21)
- Lodge a complaint with the supervisory authority — the Czech Office for Personal Data Protection (ÚOOÚ)
8. Cookies
We only use essential login cookies: the session cookie hlasovka.sid and — only if you tick “Keep me signed in” at login — the hlasovka.remember cookie (valid for 90 days, revocable at any time by logging out). We use no tracking, analytics or marketing cookies. Both cookies are httpOnly, SameSite=lax and secure in production.
9. Contact
For any questions regarding data protection, contact info@hlasovka.com. The public procedure for requesting account deletion is available on the Account deletion page.