Privacy Policy

MAŃSKI AI s.r.o., company ID 17571987, Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, Commercial Register C 130587, Regional Court in Brno, is the controller for account administration, billing, support and the security of its own Service. Send privacy requests to contact@veritasask.com or our registered office. Our company website is https://www.manskiai.cz/.

For personal data in a professional or institutional Customer’s content, that Customer generally determines the purpose and acts as controller; we act as processor under the agreed DPA. If the Customer itself processes for another controller, the authorised chain must be recorded in the DPA. We do not become an independent controller of a client file merely because our software processes it. For a natural person’s purely personal use, we are controller to the extent needed to provide the requested personal service. Where a special statutory regime applies, the relevant institutional agreement must identify it.

We receive account identity, email, display name, preferences and language from you or the authentication process; organisation invitations, roles and permissions from authorised administrators; prompts, documents, projects, conversations, generated outputs and source references from your use of the Service; usage counts, timestamps, technical error and security records from service operation; and messages or ratings you voluntarily submit.

Billing data include plan, seats, payment and subscription status and transaction references received from the payment service. Veritas Ask does not store full payment-card numbers in its application database. Relevant payment providers may process payment information under their own notices. Submitted documents may concern clients, patients, counterparties, witnesses, employees, researchers or other people identified by the Customer. Public-source research may retrieve information from the sources selected or permitted for the task.

We use data necessary to register and serve an individual contracting Customer under Article 6(1)(b) GDPR. Administration of a business customer’s representatives and users relies on our legitimate interest in delivering and managing that business relationship under Article 6(1)(f), subject to their rights. Required accounting and compliance records rely on Article 6(1)(c) and applicable accounting or other legal duties.

Service security, preventing misuse, investigating errors and establishing or defending legal claims rely on legitimate interests in a reliable, secure service and protection of rights, balanced against the people affected. We minimise the data used for those purposes. Optional analytics rely on consent under Article 6(1)(a) and applicable device-storage rules. Support is used to answer the request and administer the relevant relationship; it does not subscribe you to marketing. Any separate marketing activity requires its own applicable legal basis and information.

Professional Customer Content is processed on documented instructions, not on a supposed blanket consent created by accepting our Terms. The Customer must identify its Article 6 basis and any Article 9 condition, Article 10 authority or other statutory rule. We do not independently choose to train on that content or use it for advertising.

Customer Content is not used to train Veritas Ask. Inference means processing the selected inputs to generate the requested output; it is distinct from training. We send the information required for an authorised task to the relevant AI processing service. Disabling provider response storage in AI requests does not establish zero retention for every security log, backup or supplier system. The AI Usage and Data Residency documents explain these distinctions; the DPA governs processor instructions.

Do not place a confidential file or personal information in a public web-search query unless that disclosure is authorised. The application separates private-document work from public-source queries, but does not automatically determine whether every prompt contains sensitive information. Users must select and minimise inputs appropriately.

Operational data flows are distinguished by function. Workspace content is held in the application database and file storage. An AI task sends the question, selected history and approved document material to an AI interface for processing; preparation may include remote token counting and transcription of applicable files. Sign-in processes identity, email and session data. The payment service receives identity, order and billing data; the payment integration does not send it customer documents or conversations.

Each recipient’s legal role is determined for the particular processing. A service acting on our instructions for our own account-administration purposes may be our processor without being a subprocessor of Customer Content. An independent controller determines its own purposes and means; the same provider may have different roles for different operations. The DPA register includes only evidenced entities processing Personal Data on the Provider’s behalf in performing its processor obligations to the Customer. A technical library or tool with no Personal Data flow to its supplier is not a recipient on that basis. Unresolved roles are verified first; statutory information and contracting duties remain applicable.

Within an organisation, administrators and authorised users can access shared material according to their role and permissions. Staff or support access must be necessary and authorised for the relevant task. Authorities may receive information where law requires it; we assess the request and disclose only what is legally required. We do not sell Customer Content or provide it to advertisers.

Customer Data is stored and processed within the European Union. This commitment covers the Service’s processing chain, including AI inference and service-provider access to Customer Data. There is no standard exception for routine processing or support outside the EU. Detailed infrastructure locations are not published. Suppliers must operate within the agreed EU boundary for this data; corporate headquarters alone do not establish where processing occurs.

If a proposed deployment would require a different arrangement, it must be assessed and expressly agreed before the affected processing, with required information and a valid legal transfer basis. This notice is not consent to such a change. A Customer choosing to access, download or disclose its own data outside the EU remains responsible for that separate act; this does not permit our suppliers to process outside the agreed boundary. The UK Addendum addresses the separate UK-to-EU transfer framework.

Workspace documents, conversations, projects and saved outputs remain for the period you retain them in the workspace, ending when you delete them or an authorised administrator applies the organisation’s retention instruction. Subscription cancellation alone does not delete them. In the current organisation controls, a configured retention period is applied through an administrator-run cleanup; setting a number of days is not a promise of automatic background deletion.

Account and membership information is kept while the account or authorised membership is active. Personal account deletion requires organisational ownership and memberships to be resolved first, to protect the organisation’s records. Deletion removes the active local account and its personal content; removal of the associated authentication identity can require administrator completion. Legally required records are separated by purpose and do not authorise continued research use of deleted content.

Optional analytics use a 90-day rolling window, with deletion of older events performed when the analytics collection process next runs; this is not a claim of a continuous deletion scheduler. Withdrawing analytics consent deletes events linked to the signed-in account. The analytics preference cookie lasts 180 days and the language preference cookie 365 days unless cleared sooner. See the Cookie Policy for other device storage.

Voluntary satisfaction feedback may be requested monthly. It includes your rating, selected area, optional detail and account, language, profession and plan references to investigate issues and improve the service. We rely on our legitimate interest in responding to voluntarily provided feedback; participation is optional. It is kept until you request its deletion or delete your account, and appears in your data export. Do not include client or patient details in feedback.

Support correspondence is kept for handling the request and any directly related complaint or claim. Security and abuse records are kept for detecting and resolving the relevant event and establishing or defending related claims; access and scope must be limited to that purpose. Accounting records follow the statutory period applicable to the record, including the relevant five- or ten-year accounting periods where applicable. A genuine legal hold lasts only for the identified obligation or claim and is reviewed when it ends.

Standard DPA acceptance requires no individually negotiated retention schedule. The default instructions in Schedule D apply automatically. A deployment with additional statutory retention or assurance requirements may need an optional sector or enterprise schedule. The Provider must supply accurate backup, supplier and log-lifecycle information; the absence of a published numerical period does not waive deletion rights.

We keep contractual acceptance evidence: the acting account and verified email, the named Customer and any organisation scope, declared authority, server timestamp, acceptance route, contract language, document versions and content fingerprints. This serves the legitimate interest in proving the Agreement and meeting applicable accountability duties. It is kept for the contractual relationship and the applicable period for establishing, exercising or defending related claims, restricted to that purpose; a specific legal hold ends when its identified basis ends. It is not marketing consent.

Depending on the applicable conditions, you may obtain access and a copy, correct inaccurate data, request erasure or restriction, receive portable data and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You may object to direct marketing without giving reasons. Exercise rights through account settings where available or at contact@veritasask.com; we may ask for proportionate identity verification, never your password.

For GDPR requests we respond without undue delay and normally within one month. If a lawful extension is needed for complexity or number of requests, we explain it within that first month; an extension is not automatic. Requests about institutional content are referred promptly to the relevant controller and assisted under the DPA. We do not require you to close a complaint with us before approaching a regulator.

You may complain to the Czech Office for Personal Data Protection, https://uoou.gov.cz/, or the competent authority where you live, work or consider an infringement occurred. UK-related rights and complaints are addressed in the UK Addendum, including access to the ICO.

We apply the access controls and operational safeguards described in Security & Compliance and the TOMs, supplemented by any separately agreed institutional schedule. Public descriptions do not imply an unverified certification. We use AI to generate research outputs but do not use those outputs to make solely automated decisions with legal or similarly significant effects about account holders. A Customer’s downstream decision-making requires its own legal assessment and human oversight.

Accounts are for people aged 18 or over. A professional may lawfully process information relating to a minor only within an authorised professional purpose and the appropriate protections; this is different from offering accounts to children. Required registration or billing data cannot be withheld if they are necessary to provide the requested account or transaction; optional feedback and analytics are not a condition of access.

This notice is dated 29 September 2026. We will communicate a material change in processing before it takes effect where required. A revised notice does not expand a processor’s instructions or override an agreed DPA. Contractual changes follow the Terms; consent is requested separately where the law requires it.