Introduction

1. Scope and Application

This Policy applies to all personal data collected, processed, stored, or shared in connection with your use of the Services, whether through our websites, mobile applications, APIs, SDKs, or other interfaces, in compliance with GDPR Article 2, Act No. 101/2000 Coll., and Article 3 of the E-Commerce Directive.

This Policy applies to:

• Visitors: Individuals browsing our websites or Services without an account
• Registered Users: Individuals or entities with accounts
• Free-Tier Users: Users accessing limited features
• Paid Subscribers: Users with premium plans
• API Users and Developers: Users accessing APIs or Developer Tools
• Enterprise Customers: Organizations with custom agreements

2. Data We Collect

We collect and process personal data to provide, improve, and secure the Services, in compliance with GDPR Article 5(1)(b) on purpose limitation and Act No. 101/2000 Coll.

2.1 Personal Data Provided by You

• Account Information: Name, email address, username, password, billing address, payment details, tax identification number
• User Content: Data you upload, submit, or generate, such as text inputs, files, images, code, prompts for ihos AI, or messages in ihos Chat
• Communication Data: Information provided when contacting us at hello@ihos.eu, including support requests, feedback, complaints, or inquiries
• Verification Data: Government-issued identification, proof of address, or corporate documentation for identity verification
• Preferences: User-defined settings, such as language preferences, notification settings, or AI model selections

2.2 Data Collected Automatically

• Usage Data: Pages visited, features used, API calls, DNS queries, hosting resource usage, and session duration
• Device and Technical Data: IP addresses, browser type, operating system, device identifiers, geolocation data (approximate), network information
• Analytics Data: Aggregated and anonymized data on usage patterns, performance metrics, and user behavior
• Security Data: Logs of login attempts, authentication events, and security incidents
• Cookies and Tracking Technologies: Data collected via essential, functional, performance, and analytics cookies

2.3 Data from Third Parties

• Payment Processors: Billing information from third-party payment providers (e.g., Stripe, PayPal)
• Authentication Providers: Data from single sign-on (SSO) services (e.g., Google, Apple)
• Third-Party Integrations: Data from APIs or services integrated with ihos Developer Tools or Cloud Hosting
• Public Sources: Information from public profiles or websites, used for verification or compliance

3. Purposes of Data Processing

We process personal data for the following purposes, in compliance with GDPR Article 6, Act No. 101/2000 Coll., and Article 6 of the Digital Services Act:

3.1 To Provide and Operate the Services

• Create, maintain, and secure user accounts
• Process inputs, generate outputs, and deliver features for all services
• Process subscription fees, invoices, and payment disputes
• Respond to inquiries, complaints, or technical issues via hello@ihos.eu

3.2 To Improve and Develop the Services

• Analyze usage patterns, performance metrics, and user feedback to enhance functionality
• Use anonymized prompts and outputs to improve ihos AI
• Develop new features, tools, or services

3.3 To Ensure Security and Compliance

• Detect and prevent fraud, unauthorized access, or cyberattacks
• Fulfill obligations under Czech and EU laws, such as anti-money laundering or sanctions compliance
• Monitor and remove illegal or prohibited content

3.4 To Communicate with You

• Send account updates, service alerts, or policy changes
• Provide promotional offers or newsletters with your consent
• Collect user input to improve the Services

4. Data Sharing and Disclosure

We may share personal data with third parties under specific circumstances, compliant with GDPR Articles 28–29, Act No. 101/2000 Coll., and Article 6 of the Digital Services Act:

4.1 Data Processors

Third-party vendors (e.g., cloud providers, payment processors, analytics platforms) process data on our behalf under data processing agreements. Examples include AWS, Google Cloud, Stripe, and SendGrid.

4.2 Legal Obligations

We may disclose data to authorities to comply with legal orders, compliant with GDPR Article 6(1)(c), Act No. 40/2009 Coll., and Regulation (EU) 2021/784.

4.3 Business Transfers

Data may be transferred in the event of a merger, acquisition, reorganization, or sale of assets, compliant with GDPR Article 6(1)(f) and Section 1895 of the Czech Civil Code.

4.4 No Sale of Personal Data

We do not sell personal data, as prohibited by GDPR Article 5(1)(a) and the California Consumer Privacy Act (CCPA), where applicable.

5. Data Protection Measures

We implement robust technical and organizational measures to protect your data, compliant with GDPR Article 32, Act No. 181/2014 Coll., and Regulation (EU) 2019/881:

• Encryption: AES-256 for ihos Chat, TLS/SSL for data transmission
• Access Controls: Role-based access, multi-factor authentication (MFA), and least privilege principles
• Intrusion Detection: Real-time monitoring and intrusion detection systems
• Backups: Encrypted daily backups with 30-day retention
• Incident Response: Procedures for data breaches, with notifications within 72 hours
• Audits: Regular security and compliance audits

6. Your Data Protection Rights

You have the following rights under GDPR Articles 15–22, Act No. 101/2000 Coll., and applicable laws:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data, subject to legal retention obligations
• Restriction: Restrict processing in certain cases
• Data Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Automated Decision-Making: Opt out of decisions based solely on automated processing

To exercise these rights, contact hello@ihos.eu. We will respond within 30 days.

7. International Data Transfers

Data may be transferred to countries outside the EU/EEA, compliant with GDPR Chapter V. We use:

• Standard Contractual Clauses: For transfers to non-adequate countries
• Adequacy Decisions: For countries with EU adequacy status
• Safeguards: Encryption and contractual protections

8. Data Retention

We retain personal data only as long as necessary, compliant with GDPR Article 5(1)(e) and Act No. 101/2000 Coll.:

• Account Data: Retained until account deletion, then deleted within 30 days
• Usage Data: Retained for 12 months, then anonymized
• DNS Resolver Logs: Anonymized within 24 hours
• Backups: Retained for 30 days

9. Cookies and Tracking Technologies

We use cookies for essential, functional, performance, and analytics purposes, compliant with GDPR Article 6(1)(a) and Article 5(3) of the E-Commerce Directive. You can manage cookie preferences via our website, with consent required for non-essential cookies.

10. Service-Specific Data Practices

• ihos AI: Processes prompts and outputs, with anonymized data used for model improvement
• ihos DNS Resolver: Collects minimal, anonymized query data
• ihos Cloud Hosting: Processes hosted content and server logs
• ihos Developer Tools: Processes code and data inputs
• ihos Chat: Uses end-to-end encryption, with no access to message content

11. Children's Privacy

We do not knowingly collect data from children under 16 in the EU, compliant with GDPR Article 8 and Section 14 of the Czech Civil Code. If we detect such data, we will delete it.

12. Contact Information

For questions, concerns, or to exercise your rights, contact:

13. Complaints and Dispute Resolution

You may file complaints with us at hello@ihos.eu or with the Czech Data Protection Authority (ÚOOÚ). EU consumers may use the ODR platform (https://ec.europa.eu/consumers/odr).

14. Miscellaneous

• Updates: We may update this Policy, with notice via hello@ihos.eu
• Severability: Invalid provisions are severed, with remaining provisions enforceable
• Governing Law: Governed by Czech and EU law, with disputes resolved in Prague courts