Privacy notice

Effective from 29 September 2026

Controller

The controller of personal data is CONFESS Research s.r.o., IČO 26738384, with its registered office at Vítkova 5/32, 186 00 Praha 8 – Karlín, entered in the Commercial Register kept by the Municipal Court in Prague, file C 90664 (“Confess”, “we”). For privacy matters, contact us at klouckova@confess.cz.

This notice describes how we handle personal data on the brain.confess.cz website and in the Brain application.

The brain.confess.cz website

The website measures visits with Google Analytics. If you accept cookies, Google Analytics stores a random identifier in cookies (_ga) that expire after at most two years, and we see the pages you view, how you arrived, your device and browser type, and your approximate location. If you reject cookies or make no choice, no cookies are set and Google Analytics receives only signals without an identifier (that a page was viewed, from which kind of device and roughly where), which it uses to estimate overall traffic. The legal basis is your consent for the cookies and our legitimate interest in knowing how the website is used for the signals without an identifier. You can change your choice at any time under Cookie settings at the bottom of every page. Google Ireland Limited processes the data on our behalf; transfers to Google LLC in the USA are covered by the EU–US Data Privacy Framework.

If you send us the contact form on the website, we process your name, e-mail address and company in order to get back to you and arrange a demo. Booking a demo takes you to Calendly, which handles the booking under its own privacy policy. The legal basis is our legitimate interest in communicating with prospective clients. We keep these details for as long as needed to respond to your enquiry and any follow-up, unless a contractual relationship follows.

Users of the Brain application

About users who have access to Brain, we process:

• name, e-mail address and role in the application,
• sign-in records and technical usage data (time, IP address, browser type),
• the history of questions asked and answers given.

The purpose is to provide, secure and improve the service. The legal basis is the performance of the agreement with the client on whose behalf you use Brain, and our legitimate interest in running the service securely and reliably. We keep the data for the duration of the client agreement and afterwards only for as long as needed to wind up the agreement and meet our legal obligations.

Data in research studies

Research data a client uploads to Brain may contain personal data, such as respondents’ statements. In that case the client is the controller and Confess is the processor. We process the data solely on the client’s instructions and under the data processing agreement we have with the client. We use it for no other purpose, and in particular not to train AI models.

Recipients

We disclose data only to suppliers who help us run the service, under data processing agreements: hosting (Railway, servers in the EU), the AI model (Google Cloud), speech-to-text (ElevenLabs), e-mail (Resend) and web analytics (Google Analytics).

Some suppliers may process data outside the European Union. Such transfers are covered by standard contractual clauses or another safeguard under the GDPR. We do not sell data and do not pass it on to anyone for marketing purposes.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest. Send your request to klouckova@confess.cz; we reply within one month. If you believe we process your data unlawfully, you may lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

If you use Brain on behalf of a client, please direct your request to the client first; for research data, the client is the controller.

Security

We protect data with technical and organisational measures: encrypted transfer, access control, separation of each client’s data, and regular backups. Only staff who need access to provide the service have it.

Changes to this notice

We may update this notice. The current version is published on this page, and we inform Brain users of material changes.