Privacy policy

1. Who is responsible for your data

The controller is Respectful AI, s. r. o., Company ID 19233558, registered at Na Perštýně 342/1, 110 00 Praha 1, Czech Republic. The company is registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 383 453.

For questions or requests about personal data, write to info@respectfulai.com, call +420 608 231 721, or use our registered postal address. Please mark your request “Privacy”.

2. Visiting the website and keeping it secure

Your browser sends technical data needed to deliver the page, such as your IP address, the requested URL, request time, browser information and HTTP response information. Hosting access and error logs may record these details, including a referring URL if your browser supplies one. These records help operate the website, diagnose faults and investigate misuse.

When you use the Contact form, the website also checks technical request information, including the request origin and a security token. Spam limits use a keyed fingerprint of your IP address, a request count and an expiry time. This is pseudonymous personal data, not anonymous data. The application's counter files do not contain your raw IP address or message.

Purpose and legal basis: delivering a reliable website and protecting visitors, the form and our systems against abuse are our legitimate interests under Article 6(1)(f) GDPR. We use limited technical data for those purposes, rather than to track your interests or create an advertising profile.

The current website has no analytics scripts, advertising pixels, embedded social-media widgets, remotely loaded fonts or third-party media players. Images and website scripts are served from this website. We do not sell visitor data.

3. Contacting Respectful AI

The Contact form processes your name, email address, organisation if supplied, selected area of interest and message. If you contact us directly, we also receive the contact details, correspondence and any information or attachments you choose to send. Telephone enquiries may include your number and information needed to follow up.

We use this information to read and answer your enquiry, discuss a possible service, make arrangements and keep a record of the conversation. The form sends its contents to info@respectfulai.com. It does not store an enquiry in a website database; the delivered email and subsequent correspondence are handled in our mailboxes.

• If you ask us to take steps towards a contract with you personally: Article 6(1)(b) GDPR applies to the necessary pre-contractual communication.
• If you act for an organisation or send another business or general enquiry: Article 6(1)(f) GDPR applies. Our legitimate interests are responding to people who contact us and managing business relationships.
• If a specific legal duty requires a record: Article 6(1)(c) GDPR applies to that record. Relevant evidence may also be retained under Article 6(1)(f) for establishing, exercising or defending legal claims.

Contacting us is voluntary, and providing information is not a statutory requirement. To use the form, you need to provide a name, a valid email address and a message, and choose an area of interest. Organisation is optional. Without the necessary details we cannot process or reply to the enquiry through the form. You can instead email or telephone us.

Please provide only what is needed for your enquiry, and avoid passwords, sensitive documents or unnecessary information about other people. Sending an enquiry does not subscribe you to a newsletter. We do not ask for marketing consent as a condition of answering you.

4. Cookies and the page search

The site uses a first-party, strictly necessary security cookie, __Host-rai_forms, when the Contact form requests a protected session. It contains a random session identifier, not your name, email address or message. It helps prevent forged submissions. Simply reading a static page does not initiate this form session.

The cookie is a session cookie, with no fixed persistent expiry. Your browser manages its lifetime and may preserve sessions when restoring tabs. The server-side form token is valid for 30 minutes. Production cookie settings include Secure, HttpOnly and SameSite=Lax.

We do not set optional analytics or advertising cookies or use browser storage for visitor tracking. This necessary security cookie does not require consent under the applicable Czech electronic-communications rules. The related personal-data processing relies on our legitimate interest in secure communication under Article 6(1)(f) GDPR.

You can block or delete cookies in your browser. Blocking this security cookie can prevent the Contact form from working; direct email and telephone remain available. The website's page-search feature searches text in your browser. Our script does not send your search terms to a search provider or our server.

5. Who receives your information

Information is accessed by people authorised by Respectful AI who need it to respond, operate the website or meet a legal duty. We use the following providers in the current enquiry workflow:

• Gigaserver, operated by Seonet Multimedia s.r.o., Czech Republic: website hosting, email delivery, technical logs and hosting backups. Gigaserver's terms and privacy documents.
• Google – Gmail: enquiry emails are also handled using a personal/free Gmail account. Google may therefore receive message contents, addresses and email metadata. This consumer service is governed by Google's Privacy Policy.
• Microsoft – Microsoft 365: enquiry correspondence is also handled through Microsoft 365. Microsoft's processing role and terms depend on the account and service used; it may process information to provide email and related security services and for its own purposes described in its applicable notice. Microsoft's Privacy Statement.

These providers and their relevant service providers may process correspondence or technical data necessary to provide their services. Their roles are not identical: the personal Gmail service is not described here as a Google Workspace processor account. Respectful AI remains responsible for its own use of your information.

Where needed, relevant information may also be disclosed to professional advisers supporting a specific matter, competent public authorities when legally required, or a court in connection with a claim. Such disclosure is limited to what is necessary. Your own email or telephone provider also processes communications under its own arrangements.

6. Processing outside the EEA

Our website is hosted by a Czech provider. Email processing by Google and Microsoft can involve their group companies or service providers outside the European Economic Area, including in the United States. This notice does not promise that all correspondence stays in the EEA.

Google and Microsoft describe reliance on European Commission adequacy decisions, including the EU–US Data Privacy Framework for covered certified recipients, and on approved standard contractual clauses where required. The mechanism depends on the recipient and processing involved. Their published information is available in Google's data-transfer frameworks and Microsoft's international-transfer information.

You can ask us at info@respectfulai.com for information about the transfers relevant to your enquiry and a copy of applicable safeguards, subject to lawful redaction of confidential information. Published provider frameworks do not remove Respectful AI's responsibility for the lawfulness of its own disclosures.

7. How long we keep data

• Routine enquiries that do not become client projects: our retention rule is deletion from active mailboxes and working copies no later than six months after the last contact. This applies to copies held in Gigaserver, Gmail and Microsoft 365.
• Enquiries that become a project, legal records or a specific dispute: relevant records are retained for the project and any necessary follow-up. Where a legal duty or claim requires longer retention, the period is determined by the type of record, its applicable statutory retention or limitation period, and whether proceedings or another documented preservation duty are ongoing. Unrelated correspondence is not retained merely because another record must be kept.
• Form-security counters: their active rate-limit window is ten minutes. Expired entries are removed when the corresponding limiter is next used, so physical removal can occur later if there are no further requests.
• Temporary form sessions: tokens expire after 30 minutes; inactive server-side session records become eligible for deletion after 30 minutes. PHP cleanup is triggered by requests, so this is not a promise of immediate physical deletion at that minute.
• Hosting access and error logs: retention is determined by the hosting service's log-rotation settings and the need to diagnose a fault or investigate a security incident. Records relevant to an identified incident or claim may be preserved until the investigation or applicable claim period ends. Logs are not used for advertising.
• Backup copies: data deleted from live systems can remain in access-restricted backups until their scheduled rotation or overwrite. We do not use such copies for routine correspondence; if a backup is restored, applicable deletions need to be reapplied. Provider-managed backup and log settings can differ from live-mailbox deletion.

You can contact us for the retention information relevant to a particular record. When information is no longer needed for its permitted purpose, it is deleted or anonymised.

8. Your rights

Subject to the conditions in the GDPR, you can request access to your data and a copy, correction of inaccurate data, erasure or restriction of processing. Portability applies to data you provided where processing is automated and based on consent or a contract.

Where processing is based on consent, you can withdraw it without affecting processing already lawfully carried out. The current Contact enquiry and security processing use the legal bases explained above, rather than a blanket consent to this policy.

Send requests to info@respectfulai.com or our postal address. We may ask for proportionate information to verify your identity. We respond without undue delay and normally within one month of receiving the request. If complexity or the number of requests requires an extension of up to two further months, we explain it within the first month. Requests are normally free of charge.

You can complain directly to the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz. You may also approach the supervisory authority in the EU/EEA country of your habitual residence or place of work, or where an alleged infringement occurred. You do not have to contact us first.

We do not use website data for profiling or solely automated decisions that produce legal or similarly significant effects. Form validation and spam limits can refuse a submission; you can still contact us by email or telephone.

9. External links and the newsletter

Links to LinkedIn, Spotify, media outlets and the AI Officer Academy website take you to separately operated services. They may process your IP address and other information when you open them, under their own notices. The links are not embedded tracking widgets; those sites are not loaded merely because you read this page. An email link opens your own email application.

The newsletter band currently announces a future service. It has no active signup field or subscription engine on this website and does not collect an email address. Before newsletter registration or any optional tracking is introduced, this notice and the relevant choices will be updated.

10. Changes to this notice

We update this notice when the website or our processing changes. The date above identifies the current version. If we intend to use existing information for a new purpose, we provide the required information before that further processing takes place.