// Privacy Policy

Privacy Policy

Effective from 14 August 2026

1. Data Controller

Josef Tarič
Business ID (IČO): 88739635
Address: Letovská 552, 199 00 Prague – Letňany, Czech Republic
E-mail: info@promptlab.cz
(hereinafter referred to as the "controller")

2. Scope of Personal Data Processing

The controller processes personal data that you provide in the course of communication (e-mail, phone) or when ordering services or a software licence. This includes in particular:

  • First and last name
  • E-mail address
  • Phone number (if provided)
  • Billing details (address, business ID, VAT ID – for business clients)
  • Computer ID – when ordering a software licence, used to generate a licence key tied to a specific computer
  • IP address and technical request data – processed automatically as part of website operation and security

This website uses no third-party analytics or advertising tools (Google Analytics, Facebook Pixel, etc.).

It does, however, keep a simple first-party visit log so the controller knows which pages people find useful. For each page view it stores:

  • the page address and the time,
  • an irreversible hash of the IP address – used only to tell repeat views apart from separate visitors; the original IP address or your identity cannot be derived from it,
  • the referring website address, if any.

No cookies are used for this, nothing is stored in your browser, and the data is never linked to your name or e-mail. The legal basis is the controller's legitimate interest in evaluating website traffic (Art. 6(1)(f) GDPR). Records are deleted automatically after 180 days. You may object to this processing at any time (see Art. 8).

3. Purpose of Processing

Personal data is processed for the purpose of:

  • Communication and responding to enquiries
  • Performing a contract (providing ordered services – training, consultations; delivering the software licence and generating the licence key)
  • Issuing tax documents and fulfilling legal obligations

4. Legal Basis for Processing

  • Performance of a contract (Art. 6(1)(b) GDPR) – processing necessary to provide the ordered service
  • Legitimate interests (Art. 6(1)(f) GDPR) – responding to enquiries, website security and the first-party visit log described in Art. 2
  • Legal obligation (Art. 6(1)(c) GDPR) – bookkeeping, tax duties

5. Retention Period

Personal data is retained for the duration of the contractual relationship and thereafter for the period required by law (in particular tax and accounting regulations – generally 10 years from the end of the tax period). Contact details from non-binding enquiries are retained for a maximum of 1 year from the last communication. Visit-log records (Art. 2) are deleted automatically after 180 days. Newsletter sign-ups that are not confirmed via the link in the verification e-mail are deleted automatically after 30 days.

6. Cookies and Browser Storage

The website uses only strictly necessary and functional storage, which is essential for it to work and therefore requires no consent under the ePrivacy Directive and Section 89 of Czech Act No. 127/2005 Coll.:

  • Session cookie (PHPSESSID) – keeps the admin login and protects forms against abuse (CSRF); deleted when the browser closes.
  • The lang cookie – remembers whether you read the site in Czech or English.
  • Browser local storage – your acknowledgement of the cookie notice, your last scroll position (so returning back does not lose your place), an optional switch that disables the 3D background on weaker phones, and "liked" marks on tutorials. This data stays on your device only and is never sent to the server.

The website uses no marketing, advertising or tracking cookies and takes part in no ad networks.

7. Recipients and Transfers Outside the EU

The controller never sells personal data or shares it for marketing. The following processors and services do receive data, to the extent necessary:

  • Web hosting and e-mail provider (Subreg / Gransy s.r.o., Czech Republic) – running the website, database and outgoing e-mail.
  • Embedded videos (YouTube – Google Ireland/LLC, Facebook – Meta Platforms) – the player loads only after you click the video yourself. Until then nothing is sent to these services. After a click they receive your IP address and device data under their own policies, which may involve a transfer outside the EU/EEA.
  • AI Playground (Hugging Face, Inc., USA) – if you try a model on the AI Playground page, the text or prompt you type there is sent directly to Hugging Face servers in the United States. Please do not enter personal or sensitive data into those fields. Processing is based on your voluntary use of the feature; the transfer to the USA relies on standard contractual clauses and/or the EU–US Data Privacy Framework.
  • Public authorities – tax authorities, supervisory bodies and courts, where required by law.

Apart from the above, no data is transferred outside the EU/EEA.

7a. Use of Artificial Intelligence

The AI Playground page makes third-party artificial intelligence systems available (models hosted on Hugging Face). You are therefore interacting with a machine, not a human, and any text, image or code returned to you is AI-generated — it may be inaccurate, misleading or entirely made up, and should be verified. This notice is provided in line with Article 50 of Regulation (EU) 2024/1689 (the AI Act).

The fotoZije examples and some of the imagery on this site are created or modified by artificial intelligence; in the case of photographs this means reconstruction of damaged areas, not a record of a real event.

8. Your Rights

As a data subject, you have the following rights under GDPR:

  • Access to your personal data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of personal data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)

To exercise these rights, please contact me at the e-mail address listed above.

9. Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Office for Personal Data Protection (Czech Republic)
Pplk. Sochora 27, 170 00 Prague 7
Website: www.uoou.cz

10. Final Provisions

This policy may be updated from time to time. The current version is always available on this page. Last updated: 14 August 2026.