Privacy Policy

Last updated: 11 July 2026

This Privacy Policy explains how Ai Data s.r.o., IČO 21824541, registered office at Grafická 3365/1, Smíchov, 150 00 Praha, Czech Republic, recorded in the Commercial Register kept by the Municipal Court in Prague under file no. C 406991 ("Qyx", "we", "us", "our"), processes personal data in connection with the Qyx.ai platform and websites (the "Service").

We are the data controller for the personal data described in this Policy, except where we act as a processor on your behalf (see Section 8).

1. What data we collect

Account and contact data: name, email address, company name, billing details, and any information you provide when registering or contacting us.

Payment data: processed by our payment provider. We receive limited transaction data (e.g. that a payment succeeded, last four digits, billing country) but not your full card number.

Usage and technical data: IP address, device and browser information, log data, feature usage, credit consumption, and similar diagnostic data.

Input and Output data: prompts, files, and content you submit to the Service, and the content generated in response. Where this contains personal data of third parties, you are the controller and we act as your processor (Section 8).

Communications: messages, support requests, and correspondence with us.

Cookies and similar technologies: see our Cookie Policy.

2. Why we process your data and on what legal basis

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You may object to such processing (see Section 9).

3. AI processing and how it works

To generate Output, we send your Input to third-party AI model providers acting as our sub-processors. These providers process the Input to return a result. We (Ai Data s.r.o.) do not use your Input or Output to train our own AI models. Each third-party provider processes your Input under its own terms; how a given provider handles data (including whether it may use it to improve its models) is governed by that provider's terms, which vary between providers. A list of the providers we use is available on our sub-processors page. If this matters for your use case, review that page and the relevant provider's terms, and avoid submitting personal or sensitive data to tools whose data handling does not meet your requirements.

Do not submit special-category or highly sensitive personal data (e.g. health, biometric, or financial-identity data) as Input unless you have a lawful basis and have taken appropriate safeguards. You are responsible for the lawfulness of the Input you submit.

4. Cookies

We use strictly necessary cookies to run the Service, and, with your consent, analytics and marketing cookies. You can manage your preferences via our cookie banner. Details are in our Cookie Policy.

5. Who we share data with

We share personal data with categories of recipients acting as our processors or sub-processors, including:

• AI model providers — to generate Output from your Input.
• Payment processor — to take payments and manage subscriptions.
• Hosting and infrastructure providers — to run and store the Service.
• Email and communication providers — to send transactional and support messages.
• Analytics and product providers — to understand and improve usage (subject to consent where required).

A current list of the specific sub-processors we use is available at our sub-processors page and is kept up to date.

We may also disclose data to authorities where required by law, and to advisers or acquirers in connection with a corporate transaction, subject to confidentiality.

We do not sell your personal data.

6. Where your data is hosted and international transfers

The Service is hosted within the European Union (Frankfurt, Germany). Your account and platform data are stored on EU-based infrastructure.

However, to generate AI Output, Input is sent to third-party AI model providers, some of which operate infrastructure outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses or an adequacy decision — to protect your data. You can request more information using the contact details below.

7. How long we keep data

We keep personal data only as long as necessary for the purposes described:

• Account data: for the life of your account and a reasonable period afterwards.
• Billing and accounting data: for the retention period required by Czech tax and accounting law.
• Input/Output data: as described in Section 8 and our Data Processing Agreement; typically retained while your account is active and deleted or anonymised thereafter, unless we must keep it by law.
• Logs and technical data: for a limited period for security and diagnostics.

8. When we act as a processor

When you use the Service to process personal data of your own customers, employees, or other third parties, you are the controller and we are your processor. That processing is governed by our Data Processing Agreement (DPA), which sets out the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects, and our obligations. For that data, you are responsible for having a lawful basis and for responding to the relevant data subjects' requests; we assist you as set out in the DPA.

9. Your rights

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). Where processing is based on legitimate interests, you may object on grounds relating to your situation.

To exercise your rights, contact us at hi@qyx.ai. We respond within the statutory time limits.

You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.cz.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. No system is completely secure; you are responsible for keeping your credentials safe.

11. Children

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where changes are material, notify you.

13. Contact