Privacy Policy for Verduona Apps
Version: 2026-10-17 · Identifier: privacy-en@2026-10-17 · Effective: on publication
This policy explains how Verduona s.r.o. processes personal data in Agent Jack, Siphone, Tržnice, SIMS and Sphere and on its websites, under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll. The Czech version is Zásady ochrany osobních údajů.
We do not need, and do not ask for, your consent to process your data. We process it because we need it to provide the service (contract), because the law requires it, or for a legitimate interest. We ask for consent only for optional things (marketing messages, analytics cookies), separately, and you can withdraw it at any time.
1. Controller and contact
Verduona s.r.o., company ID 04013751, Varšavská 715/36, 120 00 Praha 2, Czech Republic. Data protection contact: [email protected], or by post to our registered office. Data protection officer: none appointed (not required for us).
2. When we are controller and when processor
- We are the controller for data about our users and customers: account, sign-in, licence, billing, support, communication, security, websites.
- We are a processor for data that a business customer puts into or processes through the apps for its own purposes, e.g. leads in Siphone, employee data in SIMS and Tržnice, data in a company's Agent Jack workspace. The customer is the controller (for Siphone, typically the advertiser whose ad form you filled in, or its agency). We follow its instructions and a data processing agreement. Please contact the controller first; if a request reaches us, we pass it on.
- Instances on a customer's server: the data stays on the customer's server under its responsibility. We access it only for support and updates. Only what is needed to verify the licence goes to Sphere.
3. Data we process
| Category | Examples |
|---|---|
| Identity and contact | name, email, phone, company, role |
| Sign-in | Sphere/Zitadel account ID, Google sign-in data (name, email, account ID), 2FA settings |
| Licence and contract | licence, seats, instances, acceptance of terms (document, version, time, app) |
| Service content and operation | agent conversations, tasks, files, workspace settings, connected integrations, logs of agent actions |
| Technical | IP address, device, browser, app version, logs, error reports |
| Billing | billing details, payments |
| Communication | emails, support requests |
| Siphone (as processor) | Meta ad form data (name, phone, email, interest), SMS content, call data and any recording/transcript, CRM status, "STOP" opt-out |
We do not ask for special-category data (health etc.); do not enter it unless you have a legal ground.
4. Purposes, legal bases and retention
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Account, sign-in (Sphere, Google) | (1)(b) contract | account lifetime + 30 days |
| Providing the apps (agents, workspace, integrations, AI processing on your instruction) | (1)(b) contract | account lifetime + 30 days; backups max. 90 days |
| Licence, grace period, licence checks | (1)(b) contract | contract + 4 years |
| Record of acceptance of terms (clickwrap) | (1)(f) legitimate interest: proving the contract | contract + 4 years |
| Service messages (onboarding, changes to terms, outages) | (1)(b) contract | contract duration |
| Support and complaints | (1)(b) and (1)(f) | 3 years after resolution |
| Security, abuse prevention, logs | (1)(f) legitimate interest: service security | 90 days; during an incident until closed |
| Improving the service from aggregated / pseudonymised statistics | (1)(f) legitimate interest | max. 24 months |
| Billing and accounting | (1)(c) legal obligation (Czech accounting and VAT acts) | 10 years |
| Establishing and defending legal claims | (1)(f) legitimate interest | limitation period and proceedings |
| Website enquiries and orders | (1)(b) pre-contractual steps | 12 months; if a contract follows, as above |
| Messages to existing customers about similar services | (1)(f) and s. 7(3) of Czech Act No. 480/2004 Coll. | until you opt out |
| Newsletter and other marketing | (1)(a) consent (optional, separate) | until withdrawn |
| Analytics cookies | (1)(a) consent (cookie banner) | per cookie table, max. 13 months |
For legitimate interests we have assessed that they do not override your rights; you may object (section 8).
5. Artificial intelligence
- To carry out your instruction, we send the relevant content (your request, task context, files) to an AI model provider. It processes it as our processor or, with BYOK (your own key), as your supplier under your terms with it.
- With an own OpenRouter key (BYOK), processing is governed by the user’s own agreement with OpenRouter. Our starter key only bridges the period until the user adds their own key; we use it under OpenRouter’s standard terms. We have no signed enterprise DPA or agreed SCCs with OpenRouter.
- We do not use your content to train models. Agent Jack and Siphone send OpenRouter no-training, zero-data-retention and no-fallback routing preferences. These are request-level preferences, not a signed DPA or SCCs.
- We make no decisions about you based solely on automated processing with legal or similarly significant effects (Art. 22 GDPR).
- Where AI talks to people (Siphone), it discloses that it is AI / an automated system (Art. 50 of Regulation (EU) 2024/1689, the AI Act).
6. Recipients and processors
We do not sell data. We share it only with these suppliers, to the extent a feature needs, and with public authorities where the law requires.
| Supplier | Purpose | Location | Safeguard for transfers outside the EEA |
|---|---|---|---|
| Anthropic PBC | AI models (Claude) | USA | EU-US DPF if certified, otherwise SCCs |
| OpenAI (OpenAI Ireland Ltd. / OpenAI, L.L.C.) | AI models (GPT, Codex) | EU/USA | EU-US DPF if certified, otherwise SCCs |
| OpenRouter, Inc. | routing to further AI models; data goes on to the model host | USA and the model host’s country | BYOK: the user’s own agreement with OpenRouter. Temporary starter key: OpenRouter’s standard terms; we have no signed enterprise DPA or agreed SCCs with OpenRouter. Routing preferences do not replace contractual transfer safeguards. |
| Google (Google Ireland Ltd. / Google LLC) | Google sign-in | EU/USA | EU-US DPF |
| Cloudflare, Inc. | DNS, tunnel, website hosting, attack protection | global network / USA | EU-US DPF, SCCs |
| Twilio Inc. | sending and receiving SMS (Siphone); processing region US1 | USA | EU-US DPF, SCCs |
| Meta Platforms Ireland Ltd. | receiving leads from ad forms (Siphone) | EU/USA | EU-US DPF |
| Raynet s.r.o. | CRM, lead sync (Siphone) | Czech Republic | within the EU |
| OptimSys s.r.o. (OptimCall) | calls (Siphone) | Czech Republic | within the EU |
| Odorik (carrier) | telephone connectivity (Siphone) | Czech Republic | within the EU |
| Hetzner Online GmbH | servers and backups | Germany / Finland | within the EU |
| Verduona's own servers | running apps and backups | Czech Republic | within the EU |
| Plus Five Five, Inc. (Resend) | Sphere system emails (sign-up, invitations, notices); replies and confirmations in Siphone, only when enabled | USA | EU-US DPF, SCCs |
| Shopify International Ltd. (Ireland) | online shop and orders at https://shop.verduona.com | Ireland / Canada / USA | adequacy decision (Canada), EU-US DPF, SCCs |
| Shopify and its payment provider | shop payments; see Shopify’s privacy policy | as described in Shopify’s and its payment provider’s policies | as described in Shopify’s and its payment provider’s policies |
| PostHog, Inc. | website analytics after explicit consent | EU (Frankfurt; eu.i.posthog.com) | EU hosting; SCCs under the DPA for any transfers outside the EEA |
| Google (Google Ireland Ltd. / Google LLC), Google Analytics 4 | website analytics after explicit consent | EU/USA | EU-US DPF, SCCs |
EU-US DPF = EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023). SCCs = Standard Contractual Clauses (Commission Decision 2021/914). We provide a copy of the safeguards on request.
For customer-hosted instances and BYOK, the customer chooses the suppliers.
We use conversion.al (Conversional GmbH) within the customer’s own account under the customer’s own agreement with Conversional. Verduona has no DPA with Conversional; it is not a subprocessor under a Verduona agreement.
7. Security
Encryption in transit (TLS), encryption at rest, separation of each customer's data, access only for authorised staff with two-factor authentication, passwords and keys in a vault, backups, patching and access logs. Details are in the annex to the data processing agreement. We notify you and the Czech supervisory authority of a breach affecting your rights under Art. 33–34 GDPR.
8. Your rights
You have the right to:
- access your data and get a copy;
- rectify inaccurate data;
- erasure where we no longer need the data or process it unlawfully;
- restrict processing;
- portability of data processed under contract or consent;
- object to processing based on legitimate interest, and always to direct marketing;
- withdraw consent at any time, without affecting earlier processing (link in the email, cookie settings, or by email);
- not be subject to a decision based solely on automated processing (Art. 22).
Send requests to [email protected]. We reply within one month (extendable by two months for complex cases; we will tell you). We may verify your identity.
Siphone SMS: reply "STOP" and you will get no further SMS or calls to your number. Exercise other rights with the controller (the company whose ad you filled in); you may also write to us and we pass the request on.
Complaints: you may complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz, or to the supervisory authority where you live or work.
9. Cookies and similar technologies
| Type | Purpose | Basis | Duration |
|---|---|---|---|
| Strictly necessary (sign-in, session, security, language, storing your cookie choice) | making the app and website work | s. 89(3) of Czech Act No. 127/2005 Coll.; no consent needed | session to 12 months |
| Analytics (PostHog EU and Google Analytics 4; both only after explicit consent) | website traffic measurement; on verduona.com also session recording (20% of visits, inputs masked) | consent | max. 13 months |
| Marketing | not used | — | — |
We use one shared GA4 property for verduona.com and agentjack.dev.
Our websites show a banner with "Essential only" and "Accept analytics"; analytics cookies do not run without consent. Change your choice any time via "Cookie settings" in the footer. The apps (Agent Jack, Siphone, Tržnice, SIMS, Sphere) use only strictly necessary cookies and storage. The desktop app stores session data and cache on your device.
10. Where we get data
From you (sign-up, use), from your employer or the customer who gave you access, from Google when you sign in with it, and for Siphone from the Meta ad form you filled in.
11. Is providing data required?
Account and contract data is needed to provide the service; without it you cannot use the app. Marketing and analytics are optional.
12. Children
The apps are not intended for anyone under 18, and we do not knowingly process their data.
13. Changes
We update this policy when our processing changes. We notify material changes by email and in the app. The current version is always on our website with its version date.