Data processing agreement (DPA)

You are the controller — you decide which mailboxes to connect and which features to turn on. We are the processor, ITex Services s.r.o., Company ID 08886164, VAT ID CZ08886164, registered office Knapovec 180, 56201 Ústí nad Orlicí.

We process data only for you and according to your instructions. Instructions include how you configure the service in the portal.

If we had to process data otherwise, we'd do so only where the law requires it, and we'd tell you in advance unless the law prohibits it.

Purpose: sorting mail in connected mailboxes, the daily digest, learning from your moves and the features you turn on (including AI features).

Data subjects: you and the users of the mailboxes, and people who write to the mailboxes or are written to from them.

Data: mailbox credentials; for messages the sender, recipients, subject, date and classification; learned senders and rules. With AI features on, also the beginning of message text (without attachments, links or addresses) sent to the language model, and short results (summaries, drafts).

Duration: message records for 30 days, everything else for the duration of the contract and at most 30 days after it ends. Details in the privacy policy.

We do not store full message bodies or attachments; the beginning of the text, at most 300 characters for 30 days, only with the digest excerpt turned on. Mail stays in your mailbox with your provider.

Only people who need data for their work have access to it, and they are bound by confidentiality.

Data is transmitted encrypted, mailbox passwords are stored encrypted, access is protected by two-factor authentication and customers' data is kept separate.

We continuously evaluate security. We'll describe specific measures in more detail on request.

We use sub-processors. All are bound by contracts requiring the same level of protection:

Vercel — hosting of the website and portal; Supabase — database.

Our own server in the Czech Republic — mail sorting; an email sending provider — digests and notifications.

Anthropic and OpenAI — language models, only with AI features turned on. They don't use our data to train their models.

If we want to add or replace a sub-processor, we'll tell you at least one month in advance. If you disagree, you can terminate the contract.

The database is in the European Union; mail sorting runs on our server in the Czech Republic.

Only what is sent to language model providers based in the USA with AI features turned on is processed outside the EU.

Transfers to the USA are based on standard contractual clauses approved by the European Commission. Providers don't keep data beyond processing the request and don't use it for training.

Requests from people for access to, rectification or erasure of their data are handled by you as the controller. We'll help — you can find and forget senders directly in the portal (Senders → Forget).

If such a request reaches us by mistake, we'll pass it to you and won't respond ourselves.

We'll also assist you with data protection impact assessments and dealings with the authority, if needed.

If we discover a security breach affecting your data, we'll let you know without undue delay, within 48 hours of becoming aware of it.

We'll describe what happened, which data is affected, the likely consequences and what we're doing about it. Notifying the authority and informing affected people is then up to you as the controller.

On request, we'll demonstrate that we comply with what's written here. If you want to audit us, we'll agree the date and scope in advance so it doesn't disrupt other customers.

You bear the cost of an audit unless it reveals that we breached our obligations.

When a mailbox is disconnected, we delete its credentials; after the contract ends, we delete data within 30 days at the latest.

The exception is data we must keep by law, typically accounting documents.