DRAFT - This document is a working draft and not yet legally reviewed. Please consult your legal counsel before relying on this text.
Privacy Policy
Sencai Tech s.r.o. ("Sencai", "we", "us"), with registered office in Prague, Czech Republic, is the controller of personal data processed through sencai.space and the Sencai platform. This policy explains what we process, why, on which legal bases, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR). Contact for all privacy matters: privacy@sencai.space.
Data we collect
Account data (name, email address, company, role), billing data (company identifiers, VAT ID, billing address; payment card data is processed exclusively by our payment processor and never stored by us), product usage and telemetry data (features used, log and diagnostic data), security logs (authentication events, IP addresses, audit records), support and contact communications, and cookie data as described in the Cookie Policy.
Purposes and legal bases
We process personal data (a) to conclude and perform the contract with you - providing the platform, billing, and support (Art. 6(1)(b) GDPR); (b) for our legitimate interests - securing the service, preventing fraud and abuse, enforcing our terms, improving the product, and direct marketing to business contacts (Art. 6(1)(f)); (c) with your consent - analytics cookies and optional communications (Art. 6(1)(a)); and (d) to comply with legal obligations, in particular accounting and tax law (Art. 6(1)(c)).
Your infrastructure data - roles
For data contained in infrastructure you connect to or provision through the platform, you (or your organisation) act as the controller and Sencai acts as a processor, processing such data solely on documented instructions and under a Data Processing Agreement (available on request at sales@sencai.space). This policy governs the data for which Sencai is the controller.
Recipients
We share personal data only with processors necessary to run the service: EU-based hosting and infrastructure providers, email delivery, payment processing, and self-hosted analytics and error-tracking operated by us. We do not sell personal data and do not share it with third parties for their own marketing. Public authorities receive data only where the law requires it.
International transfers
Personal data is stored and processed primarily in the EU/EEA. Where a sub-processor processes limited data outside the EEA, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses together with supplementary safeguards.
Retention
Account and contract data is kept for the duration of the contract and thereafter for as long as statutory obligations require (e.g. up to 10 years for accounting records under Czech law) or as long as claims may be asserted. Security and audit logs are retained for the period necessary for security and evidentiary purposes. Data processed on the basis of consent is deleted when consent is withdrawn.
Security
We protect personal data with measures appropriate to the risk, including encryption in transit and at rest, strict access controls with multi-factor authentication, tenant isolation, and tamper-evident audit logging. No system is absolutely secure; we notify affected users and authorities of personal-data breaches as required by Articles 33 and 34 GDPR.
Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time with effect for the future. Contact privacy@sencai.space; we respond within one month. You may also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ, www.uoou.gov.cz) or your local supervisory authority.
Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. AI-assisted features of the platform operate on infrastructure data under your control and direction.
Changes to this policy
We may update this policy as the service or the law evolves. Material changes will be announced on this page and, for registered users, by email or in-app notice before they take effect.