Privacy policy

The controller of your personal data is SUN Professionals s.r.o., Company ID 27159884, registered office K Dolům 1714/37, Modřany, 143 00 Prague, Czech Republic (this is the company's registered address, not a walk-in office — meetings are arranged in advance), which operates the Iterus brand. For data-protection matters contact tomas@iterus.cz. We are not required to appoint a data protection officer and have not appointed one.

• Contact form — name, e-mail address and the text of your message. The message is delivered only to our company mailbox; the website does not store it in a database.
  • Purpose and legal basis: answering your enquiry and discussing a possible engagement — Art. 6(1)(b) of Regulation (EU) 2016/679 (GDPR) (steps taken at your request before entering into a contract) and Art. 6(1)(f) (legitimate interest in handling the enquiry).
  • Retention: if the enquiry does not lead to an engagement, we delete the correspondence no later than 12 months after the last message. If it does, retention follows the section on clients below.
  • Providing the data is voluntary, but without a name, e-mail address and message we cannot reply.
• AI assistant on the Contact page — the content of the conversation you write to the assistant. What happens to it, where it exists and for how long is described in the separate section How does the AI assistant on the Contact page work?
• Protecting the form and the AI assistant against spam and abuse — the Contact page loads Cloudflare Turnstile, which checks that you are a human. It processes your IP address, browser data (User-Agent, a fingerprint of the encrypted connection) and the page address; it does not read the form or the conversation. When you submit the form and while you talk to the AI assistant, we also hold your IP address only in server memory for 10 minutes to limit the number of submissions and messages from one address; we do not store it anywhere for this purpose. If you ask for a copy of the AI assistant's summary, we hold your IP address and the e-mail address you entered in server memory for up to 24 hours to stop the assistant from being misused to send e-mails. After these periods the server deletes the data at the next request it handles, and at the latest it disappears when the server instance shuts down. Legal basis: legitimate interest in protecting the website and our mailbox against abuse (Art. 6(1)(f) GDPR).
• Visitor statistics — Cloudflare Web Analytics collects anonymous statistics (pages loaded, loading speed). It uses no cookies or other on-device storage and does not identify individual visitors. Legal basis: legitimate interest in improving the website (Art. 6(1)(f) GDPR).
• Operational logs — the hosting platform Vercel records technical data about every request (IP address, browser, requested address, time) to keep the service running and secure, and keeps it for a limited period under its own terms. Our own logs contain only operational events (for example a message that could not be delivered or a limit that was reached) without personal data from the form and without the content of conversations with the AI assistant. Legal basis: legitimate interest in operating the website securely (Art. 6(1)(f) GDPR).
• Clients and their contact persons — if you enter into a contract with us, we process the names, business contact details and billing details of you or your contact persons and the correspondence about the engagement.
  • Purpose and legal basis: performance of the contract (Art. 6(1)(b) GDPR) for the data of the contracting party, legitimate interest in communicating and managing the contractual relationship for the business contact details of its representatives (Art. 6(1)(f)), compliance with accounting and tax obligations (Art. 6(1)(c)) and protection of our legal claims (Art. 6(1)(f)).
  • Retention: for the term of the contract and then for the limitation periods (usually 3 years unless agreed otherwise); accounting and tax documents for as long as accounting and tax law requires (up to 10 years).
• Link to book a meeting — if the Contact page offers booking a meeting via Cal.com, the data you enter after opening that link is processed by Cal.com as an independent controller under its own policy.

We do not carry out automated decision-making or profiling with legal or similarly significant effects. The Turnstile check only tells a human from an automated program. The AI assistant decides nothing: it helps you write a brief, which a human then assesses.

On the Contact page you can describe your project to an AI assistant instead of filling in the form. The assistant is a program, not a person: its replies are generated by Anthropic's Claude language model. It helps you write a brief, but it does not set a price or a date for your project and it decides nothing. A human reviews everything before it becomes an offer.

• What data we process: whatever you write to the assistant — typically a description of your project, possibly your name, e-mail address and company name. Please do not write data the brief does not need, such as national identification numbers, health data or other people's personal data. If you write them anyway, we will not use them further and will delete them together with your enquiry.

• Purpose and legal basis: preparing the brief and answering your enquiry — Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) (legitimate interest in handling the enquiry).

• Where the conversation exists:

  • in your browser while the Contact page is open; we do not store it on your device, so it disappears when you close or reload the page, or when you choose "Start over". Closing the assistant window alone does not delete it, so that you do not lose it by accident;
  • at the language model provider, Anthropic, which receives the whole conversation so far with each of your messages to generate a reply. Anthropic deletes inputs and outputs within 30 days and does not use them to train models. It may keep them longer only if the law requires it, if it needs them to resolve a dispute between it and us or to combat harmful use of the service, or if the conversation violates its usage policy (then the content for up to 2 years and safety scores derived from it for up to 7 years);
  • in our mailbox, but only if you confirm and send the summary of your brief at the end: we receive the summary and, below it, the full transcript of the conversation. We keep the transcript so that we can check the summary against what you actually wrote to the assistant (legitimate interest in understanding the brief correctly, Art. 6(1)(f) GDPR). On request we send a copy to the e-mail address you enter — the summary only, without the transcript. The e-mails are delivered by Resend (see Who has access to the data?), which processes them under its own terms.

  The website itself does not store the conversation in a database or in operational logs.

• Retention: we keep the summary and the transcript in our mailbox the same way as form messages — if no engagement follows, we delete them no later than 12 months after the last message. If you do not send the summary, the conversation never reaches our mailbox or the website's database; it remains only in the open page, as described above, and at Anthropic for the periods stated.

• Voluntary: talking to the assistant is voluntary; the form on the Contact page works without it.

The website itself uses no cookies — the language is given by the page address. The website itself stores only one thing on your device: your choice of light or dark mode, if you set it in the switch (in the browser's localStorage). The AI assistant stores nothing on your device. The Turnstile widget loads with the Contact page for the form, and for the AI assistant only once its window is opened; it may store technical data needed to detect automated programs. The stored mode choice serves only a feature you asked for, and Turnstile serves solely to secure the form and the assistant you are using, so neither requires consent (Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications).

The data is processed by these processors, who run the website, e-mail and the AI assistant for us:

• Vercel Inc. (USA) — website hosting. The website runs in the Frankfurt region, but the company also processes operational data in the USA.
• Plus Five Five, Inc., trading as Resend (USA) — delivering form messages and the AI assistant's summary (including the conversation transcript) to our mailbox, and the copy of the summary to your e-mail address if you ask for it. Messages are sent from the EU region (Ireland), but their content, metadata and sending logs are stored in the USA, for 30 days according to Resend's documentation (backups for a further 7 days).
• Cloudflare, Inc. (USA) — protection of the form and the AI assistant (Turnstile) and visitor statistics (Web Analytics). Cloudflare also uses Turnstile data, to a limited extent, as an independent controller to improve its detection of automated programs (Cloudflare's Turnstile privacy addendum).
• Anthropic Ireland, Limited (Ireland) — running the AI assistant's language model; it receives the content of the conversation to generate replies. Its parent company Anthropic, PBC and further processors (subprocessors) in the USA also process the data. To run the model, Anthropic uses the cloud infrastructure of Google Cloud, Amazon Web Services and Microsoft Azure. It publishes the current list of subprocessors at trust.anthropic.com.
• Migadu-Mail GmbH (Switzerland) — running our mailbox, where the messages arrive.

For clients, providers of the accounting services and systems we use for bookkeeping also have access to billing and contract data, to the extent needed to meet our obligations.

We do not sell the data and do not pass it to any other recipients unless the law requires us to.

Yes. Vercel, Resend and Cloudflare are based in the USA. All three are listed in the EU-U.S. Data Privacy Framework programme, for which the European Commission adopted an adequacy decision, and their data processing agreements also include the Standard Contractual Clauses approved by the European Commission — these protect the transfer independently of the certification status. Anthropic Ireland is based in the EU, but its parent company Anthropic, PBC and further processors in the USA also process the content of AI assistant conversations; that transfer is protected by the Standard Contractual Clauses approved by the European Commission, which are part of the data processing agreement with Anthropic. Switzerland, where Migadu is based, is covered by a European Commission adequacy decision. We will provide a copy of the relevant safeguards on request.

You have the right of access to your data, to rectification or erasure, to restriction of processing and to data portability. Send requests to tomas@iterus.cz; we reply within one month.

Right to object: you may object at any time to processing based on legitimate interest (Art. 6(1)(f) GDPR). We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

You can lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

This version is effective from 17 October 2026. The previous version was effective from 23 September 2026. We publish changes on this page and give each version the date from which it applies.