Privacy

Two different roles

We make software that businesses use to run their work: clients, schedule, money, documents. The Czech version of this document is binding; this one is a translation.

Your clients’ data is yours. You decide why you keep it and for how long. We store and process it on your instructions and do nothing with it on our own initiative: we do not sell it, study it or show it to anyone else.

The data of the person using the software is ours. Email, name, sign-in times: without these, signing in does not work.

What we store

— email and name, so you can sign in; we hold no password at all;

— your links to organisations, to show you what you have access to;

— the organisation’s working data: clients, lessons, payments;

— a staff member’s calendar, if they connected it themselves, so we do not book over busy time;

— who opened a client’s record: protection against a leak from the inside, visible only to the owner.

The organisation’s data and the calendar keys are stored encrypted, and the encryption key is kept apart from the database. Access to the database alone does not open their contents.

What we never do

We do not email your clients in our own name — no marketing, no invitations to our own products. We do not train models on your data and do not hand it to anyone for that. We do not sell data or pass it to advertising.

Who we pass data to

Only those without whom the software does not work: the database (Ireland), email providers (EU and USA), address lookup (Czechia), the public company register (Czechia), Google Calendar — if a staff member connected it themselves, and a language model used to draft contracts. The full list with names, countries and transfer basis is in the last section of the Data Processing Agreement; we update it whenever it changes.

Google Calendar

Google Calendar is connected only by the person themselves — a staff member in their workspace or a client in theirs — and can be disconnected at any time; we then delete the access key and revoke it with Google.

What we read: the time and titles of events in the primary calendar, only to show them to that same person in their own schedule next to their bookings. Other staff, the organisation and clients do not see them. We do not store the events: we ask Google again each time. We store only the access key, encrypted.

What we write — for staff members only: two separate Aiwork calendars of our own — one with that person’s bookings, one with their working hours. We do not write to or change any other calendar.

Who receives Google data. No one except the person who connected the calendar. We do not share, transfer or disclose Google user data to third parties — not to the organisation, other staff or clients, not to advertisers, data brokers or analytics services. The only exceptions are the ones the law forces on everyone: a court order or a binding request from a public authority, and then only what is strictly required. Our database provider (Supabase, Ireland) stores the encrypted access key as our processor and cannot read it.

No AI models. Google user data is never sent to any AI or language model — neither our own nor a third party’s. The language model we use for the assistant, drafting contracts and translating document names (OpenAI) receives only the text of those documents and an anonymised summary of the workspace, never calendar data, and is configured not to retain or train on what it receives.

How we protect it. The access key is encrypted with AES-256-GCM before it is stored, and the encryption key is kept apart from the database. All traffic to us and to Google goes over HTTPS (TLS). Events are not stored at all: they are fetched from Google when the person opens their schedule and shown only to them; the server checks on every request that the calendar belongs to whoever is asking. We request read-only access to calendar events and the calendar list, plus the right to manage only the calendars Aiwork creates itself. Access to production systems is limited to the people who run the service. When the calendar is disconnected, the key is erased and revoked with Google at once.

We do not sell Google data, pass it to anyone, use it for advertising or train models on it. Aiwork’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

— while the organisation uses the software, for the whole time;

— after it leaves: thirty days to export everything, then we delete or anonymise;

— a client who stopped attending: after three years we remind the organisation and offer to anonymise; we do not delete on our own;

— the record-access log: one year;

— nightly database backups: up to 35 days; past versions of a workspace: up to 30 days;

— someone asks to be forgotten: we erase straight away.

What you can ask for

To see what we hold about you. To correct it. To take it in a file. To have it deleted. To object to processing. To complain to a supervisory authority — in Czechia that is Úřad pro ochranu osobních údajů.

Where to ask. If you are a client of a business that uses our software, ask them: the data is theirs and they answer to you. If you are not sure who to ask, write to us and we will pass it on and follow up.

What remains after deletion. Personal data goes: name, age, phone, email, correspondence. What stays is the organisation’s business records — lessons, amounts, dates, and the name on documents already issued. A document without a name proves nothing, and the organisation is required by law to keep such documents.

Children

Children attend schools, and their data is entered by the organisation. Consent is obtained by the organisation from the parents. We collect nothing from children directly. The client portal is meant for adults and teenagers from 15; for a child under 15, a parent signs in.

Cookies

Only what sign-in needs. There is no tracking of you across other sites — and therefore no cookie banner: there is nothing to ask about.

If there is a breach

We have a written procedure. We tell the organisations at once, the supervisory authority within 72 hours, and the people affected if it puts them at risk.