Privacy Policy
Sencai Tech s.r.o. ("Sencai", "we", "us"), with registered office in Prague, Czech Republic, is the controller of personal data processed through sencai.space and the Sencai platform. This policy explains what we process, why, on which legal bases, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR). Contact for all privacy matters: privacy@sencai.space.
Data we collect
Account data (name, email address, company, role), billing data (company identifiers, VAT ID, billing address; payment card data is processed exclusively by our payment processor and never stored by us), product usage and telemetry data (features used, log and diagnostic data), security logs (authentication events, IP addresses, audit records), support and contact communications, and cookie data as described in the Cookie Policy.
Purposes and legal bases
We process personal data (a) to conclude and perform the contract with you - providing the platform, billing, and support (Art. 6(1)(b) GDPR); (b) for our legitimate interests - securing the service, preventing fraud and abuse, enforcing our terms, improving the product, and direct marketing to business contacts (Art. 6(1)(f)); (c) with your consent - analytics cookies and optional communications (Art. 6(1)(a)); and (d) to comply with legal obligations, in particular accounting and tax law (Art. 6(1)(c)).
Your infrastructure data - roles
For data contained in infrastructure you connect to or provision through the platform, you (or your organisation) act as the controller and Sencai acts as a processor, processing such data solely on documented instructions and under our Data Processing Agreement, which is published at sencai.space/legal/dpa/ and forms part of the Terms of Service. Where secret values you provide for Secret Injection contain personal data, you remain the controller of that data and Sencai processes it as a processor; Sencai stores such values in Sencai Vault and uses them only for delivery to your own infrastructure. This policy governs the data for which Sencai is the controller.
Recipients
We share personal data only with processors necessary to run the service: EU-based hosting and infrastructure providers, email delivery and company email, payment processing, AI model providers when you use the AI features, and self-hosted analytics and error-tracking operated by us. We do not sell personal data and do not share it with third parties for their own marketing. Public authorities receive data only where the law requires it.
International transfers
Personal data is stored and processed primarily in the EU/EEA. Where a sub-processor processes limited data outside the EEA, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses together with supplementary safeguards.
Retention
Account and contract data is kept for the duration of the contract and thereafter for as long as statutory obligations require (e.g. up to 10 years for accounting records under Czech law) or as long as claims may be asserted. Audit log entries are append-only and are retained indefinitely for security and evidentiary purposes, with access restricted to those purposes; other security logs are retained for the period necessary for those purposes. Data processed on the basis of consent is deleted when consent is withdrawn.
Security
We protect personal data with measures appropriate to the risk, including encryption in transit over public networks and at rest, role-based access controls with support for multi-factor authentication, tenant isolation, and tamper-evident audit logging. We keep secret values you provide for Secret Injection in Sencai Vault, encrypted at rest. Platform services can reach these values only through dedicated credentials limited to storing them, reading them for delivery, or deleting them, over connections encrypted with TLS, and Sencai Vault keeps an audit trail of that access. Each delivery to your infrastructure is encrypted with a key generated for that delivery alone. No system is absolutely secure; we notify affected users and authorities of personal-data breaches as required by Articles 33 and 34 GDPR, and where we act as your processor we notify you as set out in the Data Processing Agreement.
Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time with effect for the future. Contact privacy@sencai.space; we respond within one month. You may also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ, www.uoou.gov.cz) or your local supervisory authority.
Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. AI-assisted features of the platform operate on infrastructure data under your control and direction.
Changes to this policy
We may update this policy as the service or the law evolves. Material changes will be announced on this page and, for registered users, by email or in-app notice before they take effect.