Privacy policy

The controller of personal data is [OPERATOR NAME], company ID no. (IČO) [COMPANY ID NO. (IČO)], with its registered office at [REGISTERED OFFICE / ADDRESS]. We have not appointed a data protection officer, as we are not required to do so. For all privacy matters, write to [CONTACT EMAIL].

It depends on how you use the service. From the least to the most:

If you only read

• The server (Vercel) writes standard operational logs: IP address, time, the page requested and the browser type. These serve to run the service and defend it against attacks, not to track people.
• Nothing else. Without your consent, no visitor analytics are loaded (see Cookies).

If you have an account

• your email address and password (we store only its hash), and, if you sign in with Google, your name and profile picture from Google;
• your settings: favourite venues, interests, followed streets and areas, digest topics, delivery time;
• the channels you connect: the identifier and name of your Telegram account, a second email address and its verification code;
• what we have sent you: a record of every digest delivered (where, when, what), so that we never send anything twice;
• the messages you write to the assistant and its replies; on the paid plan, also what the assistant remembers about you (e.g. "doesn't eat fish") — you can see this and delete it;
• usage: how many messages and words the assistant has processed, for the budget of your plan;
• on the paid plan, subscription details; the payment details themselves are held only by Stripe.

If you run a business and claim its listing

• the contact details you enter (name, telephone, email), proof of your authority, and what you publish about the business;
• the emails you send us from the business (menus, changes), including attachments.

If you write to us or mail reaches us

• our mailbox is read by an automated system: the sender's address, subject, text and attachments are stored and sorted (a menu from a venue, the town newsletter, a reply, a bounce message). Any message the system does not recognise is read by a person.

If you call the MCP or the API

• a salted hash of the IP address, the name of the tool, the number of rows returned, the time, and whether you hit a limit. We do not store the IP address itself.

Data about other people that we publish

• operators of venues, medical practices and businesses: names, addresses and contact details from public registers and websites (see Data);
• members of the city council and the city board: how they voted, as published by the city; parties to the town's contracts — private individuals are shown only as "natural person" (see Town documents).

For each purpose, we state the legal basis under Article 6(1) GDPR:

• operating the account, the digests, the assistant and the paid plan — performance of a contract with you — Article 6(1)(b).
• security, rate limits, protection against abuse, operational logs — our legitimate interest in a functioning and secure service — point (f).
• visitor analytics (Google Analytics) — solely your consent — point (a); you may withdraw it at any time.
• claiming a business listing and mail from businesses — performance of a contract and our legitimate interest in correct data — points (b) and (f).
• publishing data on venues, businesses and medical practices — our legitimate interest in informing the public; this is data that is public from registers or that the business has published itself — point (f).
• town documents, votes, contracts and tenders — our legitimate interest in informing about the exercise of public administration, and freedom of expression and information (Article 85 GDPR, Section 17 of Act No. 110/2019 Coll.); the sources are documents published under Act No. 106/1999 Coll., Act No. 128/2000 Coll., Act No. 340/2015 Coll. and Act No. 134/2016 Coll. — point (f).
• accounting and tax for the paid plan — compliance with a legal obligation — point (c).

We do not make decisions about you by automated means that would have legal or similarly significant effects (Article 22 GDPR). We do not use data for advertising and we do not sell it.

Data is processed on our behalf by the following processors, each only for the stated purpose and under a data processing agreement:

• Supabase, Inc. — database and authentication; the data is stored in the eu-west-1 region (Ireland, AWS).
• Vercel, Inc. — hosting of the website and the API, operational logs; server functions run in Dublin (Ireland), while the content delivery network (CDN) is worldwide.
• Google (Google Ireland Ltd. / Google Cloud EMEA Ltd.) — sign-in with Google; Google Analytics 4 visitor analytics (only with consent); Gemini language models on the Vertex AI platform and text recognition in scans (Document AI) — in the europe-west3 region (Frankfurt). Under the Google Cloud contractual terms, your inputs are not used to train models.
• Telegram (Telegram FZ-LLC / Telegram Messenger Inc.) — delivery of digests and chat with the bot — if you connect Telegram. Telegram has its own privacy policy.
• email mailbox provider — [EMAIL MAILBOX PROVIDER, REGISTERED OFFICE AND REGION] — sending and receiving email (digests, verification codes, mail from businesses and the town, sign-in emails).
• Resend, Inc. (USA) — a fallback email sender, used only when it is enabled in place of our own mailbox.
• Stripe Payments Europe, Ltd. — payments for the paid plan — once they are launched; only Stripe sees your card details.

We do not disclose data to any other recipients unless required by law or by a public authority. The only data that is public is data you publish yourself (e.g. as the owner of a business) or data that is public by its nature (see Town documents).

We aim to keep data in the EU: the database, authentication, server functions and language models all run in Ireland and Germany. Transfers outside the EU may nevertheless occur:

• Supabase, Vercel, Google and Resend are companies based in the USA and may access data for support and operational purposes. Such transfers are covered by the European Commission's standard contractual clauses and, for Google and Vercel, also by certification under the EU–US Data Privacy Framework.
• Telegram is based outside the EU (UAE). By connecting Telegram, you agree that the messages you choose to receive will pass through its servers; without Telegram, no such transfer takes place.
• The CDN may temporarily store a page on a node outside the EU; such pages contain no account data of yours.

• account and settings — for as long as the account exists; after the account is deleted, they are erased within 30 days, including backups.
• messages to the assistant and its memory — for as long as the account exists; you can delete the memory at any time.
• records of delivered digests — for as long as the channel exists, and at most until the account is deleted.
• rate-limit counters (IP hash, account) — from minutes up to 24 hours depending on the limit, after which they are overwritten.
• MCP/API call records and operational logs — [RETENTION PERIOD FOR OPERATIONAL LOGS, e.g. 90 days]; at Vercel, according to its settings, typically a matter of days.
• incoming mail — [RETENTION PERIOD FOR INCOMING MAIL, e.g. 12 months] from when it was dealt with; menus and news derived from it remain as content of the service.
• accounting records — 10 years, as required by law.
• consent to analytics — 12 months in the browser, after which we ask again.
• claims of business listings — for as long as the listing is managed and for 3 years thereafter (proof of authority).

The website stores in your browser only what it cannot work without, and it does so in "local storage", not in cookies:

• sign-in — your session token (a key beginning with sb-) and a small hint for the site header so that it knows you are signed in. Without these, you cannot sign in. They remain until you sign out.
• your analytics choice — the key znj-consent: whether you allowed or declined analytics, and when. 12 months.
• interface settings — for example a dismissed bar or a selected tab. No personal data.

Visitor analytics — only with consent

When analytics is enabled, a "Visitor statistics" bar appears with two buttons of equal size — Accept and Decline. Until you click Accept, nothing is loaded from Google's servers. We treat a browser sending a Global Privacy Control or Do Not Track signal as Decline and do not show the bar. After consent, Google Analytics 4 sets the cookies _ga and _ga_… (for up to 2 years) and learns which pages you opened, from what device and roughly from where. Advertising features are permanently disabled, and we strip from the page address anything that might be confidential (codes, tokens, email). Account management, the sign-in pages and the administration are never measured.

You can change your choice at any time using the Cookie settings link in the website footer (shown only when analytics is enabled). Declining analytics switches it off and deletes the _ga cookies.

A language model (Google's Gemini, operated on Vertex AI in Frankfurt) comes into contact with data in the service in the following places:

• assistant — your questions, your settings and — on the paid plan — what the assistant has remembered are sent to the model so that it can answer. None of this is used to train the model.
• menus and venue websites — the model reads a venue's website or an email containing a menu and extracts the items; the result carries the "AI" label until a person approves it.
• town documents — we convert scans to text (Google Document AI) and process the texts into vectors so that they can be searched. We send the model only what the town has published.
• classification — the model sorts news and events into categories and suggests headlines; it makes no decisions about people.

The model can make mistakes. Do not treat an answer from the assistant or a record labelled "AI" as verified information — where it matters, check the source we state for every record.

We publish documents of the Town of Znojmo — resolutions of the city board and the city council, by-laws, the official notice board, city council votes, contracts and tenders — so that they can be searched and so that the website can let you know when something concerns your street. The following rules apply to them:

• only what the town has published — we reproduce documents in the version in which the town issued them (resolutions already anonymised); we neither request the originals nor add anything to them. Each one carries "Source: Město Znojmo" and a link.
• assembly members and councillors — are public officials; we give their names alongside votes as the town has published them. We present votes neutrally — totals first, names only when expanded, and no rankings.
• contracts and tenders — we state the contracting parties as listed in the Register of Contracts; private individuals appear only as "natural person", without a name.
• official notice board — notices addressed to specific people (service by public notice, auctions, enforcement proceedings) are excluded from indexing by search engines.
• when the town withdraws a document — the text stays with us, with a note and the date stating that it is no longer on the town's website. Personal data is the exception: at the request of the person concerned or of the town, we hide the text and keep only the title, date and link.
• request to hide — every document page has a "Report a problem with this document" link; otherwise write to [CONTACT EMAIL]. We will respond within 2 working days. We deal with a justified request first and discuss it afterwards.

We do not maintain pages about individual private persons. Business owners appear in the service because they trade under a name they have published themselves; they too may ask for their contact details to be corrected or hidden.

Under the GDPR, you have the right:

• of access — to find out what data we hold about you and to receive a copy (Article 15);
• to rectification — to have inaccurate data corrected — you can change your settings yourself in your Account (Article 16);
• to erasure — to have your data deleted (Article 17; see Deleting your account);
• to restriction of processing — (Article 18);
• to data portability — to receive the data you have provided to us in a machine-readable format (Article 20);
• to object — to processing based on legitimate interest — including how we display data about you in town documents or in the business directory (Article 21);
• to withdraw consent — to visitor analytics, at any time, using the Cookie settings link (Article 7);
• to lodge a complaint — with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz (Article 77).

Send your request to [CONTACT EMAIL], preferably from your account's email address so that we know it is you. We will reply within one month; for a complex request we may extend this period by a further two months, and we will let you know if we do. There is no charge.

The "Delete my account and everything you know about me" button in your Account is deliberately inactive for now — one-click deletion is not finished yet, and we do not want to promise something that will not happen. Until then:

• write from your account's email address to [CONTACT EMAIL] with the subject "Delete account". We will manually delete the account, settings, channels, messages to the assistant and its memory within 30 days and confirm this to you;
• you can disconnect Telegram and the second email address yourself straight away under Settings → Channels; this ends the digests;
• what remains: accounting records (10 years, as required by law) and anonymous statistics with no link to you.

An account created through Google ceases to exist with us as a result; your Google account itself is not affected in any way.

Reading the website is open to everyone. However, only persons over the age of 15 may create an account (Section 7 of Act No. 110/2019 Coll.); we do not offer the service to children under 15 and do not knowingly collect their data. If you find that a younger child has created an account, write to us and we will delete it.

Connections are encrypted (HTTPS), passwords are stored only as hashes, access to the database is restricted by row-level security rules, and the keys to our services are kept neither in the code nor on developers' disks. The administration is accessible only to staff with the appropriate role and is not measured. Even so, no system is perfect; if a breach occurs that could affect you, we will inform you without undue delay, as required by Article 34 GDPR.

When we add a feature, a processor or a purpose, we will update this document and change the "Last updated" date. We will announce material changes to account holders by email, and you will notice a change to the analytics bar because it will ask you again.

[OPERATOR NAME], company ID no. (IČO) [COMPANY ID NO. (IČO)], [REGISTERED OFFICE / ADDRESS]. Email for privacy matters and GDPR requests: [CONTACT EMAIL].

Related: Terms of use, Data (what we have on Znojmo, where it comes from and with which provenance label).