1. Who we are
We are Nextima, s. r. o., the provider of AIKOZO, registered at Vysokoškolákov 8421/41, 010 08 Žilina, Slovak Republic, company identification number (IČO) 55341047. Our Legal Notice contains our full company details.
For privacy questions, DPO enquiries or requests concerning your personal data, email nextima.sro@gmail.com or write to our registered office, marked “AIKOZO — Data protection”.
2. Our role and your organisation's role
This policy covers our website, documentation, business communications and the AIKOZO services we operate.
We act as controller when we decide how to use personal data for our own website, customer relationships, security, billing and legal responsibilities.
For personal data in customer workspaces, accounts and related records that we process on a customer's instructions, we act as processor, or subprocessor if that customer is itself a processor. The customer's privacy information and processing agreement explain its purposes and instructions. This policy does not replace that agreement. Storing an account or audit record does not automatically make us its controller for every purpose.
Your organisation may operate its own deployment or choose additional integrations and providers. Its privacy information explains those arrangements. Our responsibilities and your rights continue to apply.
3. Information we process and where it comes from
| Information | Examples |
|---|---|
| Website and service activity | IP address, request time and page, browser/device details, referring page where supplied, actions, errors, security events and usage records. |
| Contacts and accounts | Name, email, organisation, role, account identifiers, sign-in records, enquiries and support correspondence. |
| Commercial and legal records | Contract and invoice details, payment status, privacy requests and information needed for legal obligations or disputes. |
| Customer content and AI records | Uploaded documents, requirements, discussions, connected-system content, prompts, retrieved context, responses, translations, embeddings and generation history. These can include information about you or other people. |
We receive data from you, your organisation and its authorised users, configured identity and integration services, and use of our websites and services. Your organisation identifies the underlying sources of customer-controlled content. Embeddings, identifiers and other derived records can still be personal data.
4. Why we use data and our legal bases
The following applies when we are the controller. Your organisation determines the legal basis for processing it controls.
| Purpose and data | Legal basis under the GDPR |
|---|---|
| Run and protect our website and documentation using connection and security records | Our legitimate interests in providing the service and protecting systems and visitors — Article 6(1)(f). |
| Answer enquiries and manage relationships using contact details and correspondence | Our legitimate interests in business communication — Article 6(1)(f). Where you personally are the contracting party, necessary contractual or requested pre-contractual processing — Article 6(1)(b). |
| Administer customer relationships, measure billable usage and resolve service/security issues using relevant contact and operational records | Our legitimate interests in administering and protecting the service — Article 6(1)(f). This does not authorise unrelated reuse of customer content. |
| Keep accounting/tax records and handle privacy requests using the necessary financial, contact and verification records | Our legal obligations — Article 6(1)(c). |
| Establish, exercise or defend legal claims using relevant records | Our legitimate interests in protecting our legal rights — Article 6(1)(f). |
Processing based on legitimate interests must be necessary and balanced against your rights. You can object as explained below.
Contact details are needed to answer an enquiry, identity/access details to provide an account, and required commercial details for invoicing. Without necessary data, we may be unable to provide that service. Browsing does not generally require you to provide information by law. Optional choices remain optional; using AIKOZO is not blanket consent to processing.
5. AI processing
AI features can send your input and relevant authorised workspace context to a model provider. This may include document extracts, related records and conversation history beyond the text you enter. We use this information for generation, enhancement, translation, embeddings, retrieval and analysis. Original and translated text, inputs, outputs and associated history may be retained as described below.
We do not use customer content for our own model training, fine-tuning or evaluation. We use OpenAI's default API setup. OpenAI's published policy says API data is not used for model training unless the customer opts in. Default abuse-monitoring logs may contain prompts, responses and metadata and are retained for up to 30 days, subject to legal and safety exceptions. Other stored application state depends on the API feature. See OpenAI's data controls.
Using content as context or creating embeddings is different from training a model, but can still process personal data. Only provide information your organisation is authorised to use. Avoid passwords, secrets and unnecessary sensitive data. This policy does not itself authorise processing sensitive or criminal-offence data.
Our AI Transparency Notice explains AI capabilities, limitations and human review.
6. Providers and international processing
Authorised staff and users within your organisation can access information according to their responsibilities and permissions. We also use the providers below. Enabled integrations receive the data needed for their function; their own permissions and arrangements apply. Professional advisers and authorities may receive information where needed for advice, legal claims or legal obligations.
| Provider | Purpose, locations and safeguards |
|---|---|
| Amazon Web Services EMEA SARL | Hosts our application, data and identity infrastructure in Frankfurt, Germany. Website/documentation delivery through CloudFront and authorised support can involve processing outside the EEA, including the US. AWS acts as processor or subprocessor under its DPA, incorporated by its standard terms. Applicable transfers use adequacy protection or Standard Contractual Clauses (SCCs), with supplementary safeguards. AWS subprocessors. |
| OpenAI Ireland Ltd. and its service providers/affiliates | Provides AI services as processor or subprocessor. Our default API setup has no EU-only residency commitment; processing can involve the US and other countries. The OpenAI DPA is incorporated into its standard terms. EEA/Swiss data is handled through OpenAI Ireland; onward transfers use SCCs or applicable adequacy decisions. OpenAI subprocessors. |
| Google Ireland Limited — Gmail | Handles contact email, attachments and related metadata through ordinary Gmail. Google is an independent controller under its Privacy Policy; this is not a Google Workspace processor arrangement. Processing can occur worldwide. Google's transfer safeguards include adequacy decisions, the EU–US Data Privacy Framework for covered transfers, and SCCs where required. |
| Google LLC / Google Ireland Limited — Google Fonts | Supplies documentation fonts and receives IP addresses, requested URLs and request headers. Google LLC supplies the API; Google Ireland is the EEA privacy controller. The same published international-transfer safeguards apply. The Fonts FAQ describes cookie-free delivery without end-user profiling or targeted advertising. Google does not host AIKOZO. |
EU application hosting does not mean all processing by these providers stays in the EU. Contact us for information about transfer safeguards or a copy where relevant. Customer agreements also govern authorisation and notification of subprocessors.
Google controls its own retention and deletion under its published criteria, including legal/security exceptions and encrypted backups retained for up to six months. Those copies are separate from our correspondence and backup schedules below. The Google Fonts FAQ does not specify a fixed retention period for font-request data.
7. Retention and deletion
The periods below are our retention policy. We are still implementing and verifying the deletion, backup-expiry and recovery controls needed to enforce them. Shorter feature-specific periods and valid earlier deletion instructions continue to apply. These periods do not extend deadlines for responding to your rights requests.
| Records | Maximum period or rule |
|---|---|
| Website/documentation access and security logs | 30 days from creation. |
| Operational, authentication, usage and security records for our own purposes | 90 days from creation. Accounting evidence follows its separate schedule. |
| Business correspondence and support | Unsuccessful enquiries: 12 months after last meaningful contact. Customer correspondence: during the relationship and 24 months after it ends. Closed support records: 24 months after closure. |
| Accounting and tax records | Financial statements, accounting vouchers and books: ten full calendar years following the year concerned. Records describing the accounting/retention system: ten full calendar years following the year of last use. Other records follow the applicable statutory schedule, including required extensions. |
| Privacy requests and identity evidence | Request/response records: three years after closure. Necessary identity-document copies: delete as soon as verification is complete, no later than seven days afterwards; keep only the minimum verification outcome. |
| Customer accounts, content, AI histories and derived indexes | While the service is active, subject to the customer's instructions and earlier expiry. After termination: 30 days for agreed return/export and deletion of remaining live copies within 60 days. A different customer schedule must be recorded in the processing agreement. |
| Our backups | Expire within 35 days of creation; copying does not restart the period. Under the 60-day live-deletion schedule, residual termination-related copies expire within 95 days of termination. Access is restricted to recovery; completed erasures must be reapplied before restored data returns to use or new backups. |
A documented security incident may justify keeping the relevant access, security or operational logs separately for the time needed to resolve it. Other exceptions require an applicable legal obligation or a specifically applicable documented legal hold limited to the evidence needed. The accounting rules follow Slovak Act No. 431/2002, sections 35–36; other periods above are operational limits, not statutory periods.
Return/export is arranged with the customer; there is no universal self-service export. Deactivating an account or removing a visible item does not necessarily erase its history, translations, embeddings or backups. These related copies must be included in the deletion process. Provider retention, including OpenAI and Google, is described in sections 5–6.
8. Cookies and browser storage
We do not use optional analytics, advertising or marketing for AIKOZO. Our homepage does not set application cookies or browser-storage entries. The application, login and documentation use storage for the following purposes:
| Purpose | Duration and control |
|---|---|
| Sign-in and session protection | Application session: up to 12 hours, with a 30-minute server idle timeout. Sign-in attempt protection: up to 30 minutes. Identity-service cookies can last for the browser session, 60 seconds or 12 hours according to purpose; your organisation's sign-in settings can differ. Logout ends the application session. |
| Appearance, language, filters and layout | The application appearance cookie lasts 365 days and renews when applied, including the default appearance. Application preferences and documentation palette storage have no set expiry and persist after logout. The documentation stores its palette automatically on page load. Login appearance lasts for the browser-tab session. |
| Organisation context and ongoing jobs | Organisation context, sign-in redirect protection and recent jobs use browser-tab storage. Some job records, including user/organisation and artifact identifiers, persist across sessions without a general time limit. Private job records clear on logout, authentication redirection or identity change; relevant completion events clear feature-specific records. |
| Quick phrases when sign-in is disabled | Phrases and usage details stay in browser storage without a set expiry until removed through the feature or browser controls. With sign-in enabled, phrases are stored through the service instead. |
You can change preferences in the relevant controls and clear stored data in your browser. Browser session restoration can preserve tab storage. Blocking sign-in storage can prevent authentication. Browser storage duration is separate from server-record retention.
Documentation loads Google Fonts automatically; requests disclose the information described in section 6 without setting Fonts cookies. Selecting a documentation search result can put search terms in the URL and therefore browser history and server/CDN logs. Email and YouTube links do not embed those services. Sending email transfers its content; opening the video link takes you to YouTube.
Necessary storage and optional technologies require different treatment. Any optional storage requiring consent must wait for your choice; this notice does not obtain that consent.
9. Security and automated decisions
We use access controls, tenant separation and other organisational and technical measures appropriate to the risks. No service can guarantee absolute security.
For our own purposes, we do not make solely automated decisions about people with legal or similarly significant effects. AI suggestions about engineering work are not intended for that purpose. A customer's additional use requires its own assessment and safeguards.
10. Your rights
Subject to the GDPR's conditions, you can request access and a copy, correction, erasure, restriction and, where applicable, portability of your data. You also have the applicable protections concerning solely automated decisions.
You can object to processing based on legitimate interests because of your situation. We must stop unless overriding legitimate grounds or legal claims justify continuing. You can object to direct marketing at any time. Where processing relies on consent, you can withdraw it as easily as you gave it, without affecting earlier lawful processing.
Write to nextima.sro@gmail.com. We may need proportionate identity verification; do not send identity documents unless requested through an appropriate channel. Requests are normally free. We respond without undue delay, normally within one month. Where the GDPR permits an extension of up to two further months, we explain it within the first month. Any permitted refusal or fee will be explained.
For data controlled by your organisation, you can also contact it directly. We will handle or forward requests and assist it as appropriate.
You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred, without contacting us first. In Slovakia: Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava; contact information.
11. Changes
We update this policy when our processing changes and communicate material changes appropriately. A new purpose will be addressed before processing begins. Publishing an update or continuing to use AIKOZO does not itself provide consent.