Privacy policy

01

Controller and contact

The controller is Leadora Technologies s.r.o., company ID 24624136, Hostěradice 44, 252 82 Kamenný Přívoz, Česká republika, registered in the Commercial Register maintained by the Municipal Court in Prague, section C, file 444314. For privacy matters contact [email protected] or write to our registered office.

02

Website visitors and enquiries

mhruby.eu uses no cookies and no analytics or advertising scripts. The site is hosted by Vercel, which processes technical data (for example your IP address, request time and request details) to deliver and protect the website.

The contact form and mini-audit prepare a message in your email application; we receive it only after you send it yourself. We process your name, email address, optionally phone number and message to reply and prepare a proposal. The legal basis is steps taken at your request before entering a contract (GDPR Art. 6(1)(b)) or our legitimate interest in business communication (point (f)). We do not use this data for newsletters.

03

Business outreach to online shops

We occasionally write to online shop operators with a specific finding about their website. We use only a publicly listed business contact (an email address published on the shop’s website) and public information about the shop, such as the content of its pages and the public ARES register. The legal basis is our legitimate interest in direct business contact (GDPR Art. 6(1)(f)). You can reply “STOP” at any time and we will not write again; your address is then added to a suppression list so we do not contact you again. You have the right to object and to request erasure.

04

Mhruby Outreach and Google user data

Mhruby Outreach is an internal application that sends approved business emails from the operator’s Gmail account ([email protected]) and monitors replies. It accesses Gmail through the official Gmail API and OAuth with the scopes gmail.send, gmail.readonly and gmail.compose. Only the account owner grants access. A detailed description is on the application page.

Google data we process: sender, subject and text of messages from contacted addresses, delivery failures, threads started by the application and messages containing an explicit request to stop contact (e.g. “STOP”, “unsubscribe”); sent messages. We read no other mail.

How we use it: solely to send an approved email, to recognise a reply, a bounce or a request to stop contact, and to stop further messages. We use it for nothing else.

What we store and where: from incoming messages only the Gmail message ID, the sender address when they asked us to stop, the reply time and the resulting label. Message text is not stored. The sign-in token is encrypted (Windows DPAPI) on the operator’s work laptop.

Sharing: we do not transfer Gmail data to anyone, do not sell it and do not use it for advertising. We do not send it to any AI model or train models on it. No human reads the messages except the mailbox owner, apart from cases required by law or for security.

Limited Use: use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revocation and deletion: access can be revoked at any time at myaccount.google.com/permissions. We delete stored data and the token on request at the address below.

05

Recipients and transfers outside the EEA

Data may be processed by providers we use: Vercel (hosting), Google (Gmail and email communication) and, where cooperation follows, accounting or legal service providers. We disclose data to public authorities where the law requires. Google and Vercel may process data outside the EEA, in particular in the USA, on the basis of adequacy decisions (including the EU–US framework) or contractual safeguards. We will describe the specific safeguards on request.

06

Retention

We keep correspondence while an enquiry or business discussion is handled and afterwards only as long as a contract, a legal obligation or the protection of legal claims requires. An address on the suppression list is kept as long as needed so that we do not contact you again. When the purpose ends, we delete or anonymise the data.

07

Your rights and complaints

You have the right of access, rectification, erasure or restriction, the right to object to processing based on legitimate interest and the right to data portability where applicable. Send your request to [email protected]; we usually reply within one month. You may complain to the Czech Office for Personal Data Protection (uoou.gov.cz) or another EU supervisory authority. We make no automated decisions with legal or similarly significant effects.