Privacy Policy of the Legamik Service

Version: 1.4 Effective from: 1 August 2026 Last updated: 1 August 2026

This is an English translation provided for convenience. In the event of any discrepancy, the Czech version prevails.

This policy describes what personal data we process when providing the Legamik service, for what purpose and on what legal basis, to whom we disclose it, and what rights you have. We value your trust and process only the data we genuinely need.

1. Data Controller

The controller of personal data under Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") is Hey Wox s.r.o., Company ID (IČO): 10866957, registered office at Veslařská 563/197, Pisárky, 637 00 Brno, Czech Republic, registered in the Commercial Register kept by the Regional Court in Brno, Section C, Insert 123208 (the "controller" or "we").

Contact: support@legamik.com.

The controller has not appointed a data protection officer, as it is not required to do so under Article 37 GDPR.

2. What Personal Data We Process

We process only the data necessary to provide the service:

• Contact data: the e-mail address you enter for delivery of the letter and communication about the order (may differ from the payer's e-mail).
• Content of your matter: the description of the problem you enter and the data needed to draft the letter — in particular the sender's name and address (if you provide them) and the grammatical gender for correct linguistic phrasing. This content may contain personal data that you yourself include in it.
• The generated letter and related correspondence (including any follow-up letter).
• Uploaded documents (where you use this feature): a document you upload to the case (e.g. a decision, a notice or a fine) and the key data automatically summarised from it.
• Sharing and referral: if you use letter sharing or the referral programme, we process the share/referral code and related technical data about its use (e.g. view and click counts).
• Payment data: transaction data (amount, currency, transaction identifier). We do not process or store payment-card data — payment is processed by the payment-gateway provider.
• Marketing contact: whether you, as a customer, did not object to receiving commercial communications about our own similar services when your contact was obtained (a "soft opt-in" under Section 7(3) of Act No. 480/2004 Coll.) — this is not consent; you may object or unsubscribe at any time.
• Feedback and outcome: any rating, comment or information about the outcome of your matter, if you share it with us.
• Technical data: IP address (processed as a secure hash), browser data, operational logs and data necessary for the operation and security of the website.

3. Special Categories of Data and Third-Party Data

Special categories and criminal-matter data. Please do not enter special categories of personal data (e.g. data on health, religion or trade-union membership) or data on criminal matters and offences into the description of your matter unless necessary for the purpose of the letter. If you do include such data yourself as a necessary part of asserting or defending your claim, we will process it solely to create the letter. For special categories of data, the legal basis is performance of the contract (Article 6(1)(b) GDPR) in conjunction with the exemption for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR). Data on criminal matters and offences (Article 10 GDPR) is processed only to the extent necessary to create the letter by which you assert your claim — on the basis of the same exemption (establishment, exercise or defence of legal claims) and in accordance with Act No. 110/2019 Coll., on Personal Data Processing.

Third-party data. The description of your matter may contain personal data of third parties (e.g. recipients of the letter, a trader's employees, public officials or witnesses). The source of this data is you as the user; we process it only to draft the letter, for the duration and under the conditions set out in this policy. Given the nature of the service and the disproportionate effort that informing each such person would require, we fulfil our information duty towards them by publishing this policy (Article 14(5)(b) GDPR). The user is responsible for the lawfulness of including third-party data (see Article 3.3 of the Terms).

4. Purposes and Legal Bases of Processing

Where consent is the legal basis, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing before withdrawal.

5. Recipients, Processors and Independent Controllers

To provide the service, we disclose the necessary data to vetted recipients. Most of them act as processors — processing data under a data processing agreement (DPA) and only on our instructions. The payment-gateway provider Stripe acts as an independent controller for payment processing (in particular to meet its own obligations in the area of payment services and fraud prevention).

The artificial-intelligence providers process the transmitted text solely to generate the letter (and related auxiliary functions) under a data processing agreement (DPA) and do not use it to train their models. Note: we may use OpenAI for auxiliary functions (e.g. embeddings and de-identification) even if you select Anthropic to generate the letter.

Transfers to third countries. Some processors (in particular OpenAI and Anthropic) process data in the United States. The transfer is secured by the EU Standard Contractual Clauses (Article 46(2) GDPR), or other appropriate safeguards; where the recipient is certified under the EU–US Data Privacy Framework, on the basis of the European Commission's adequacy decision. We will provide a copy of the relevant safeguards, or further information about them, on request at support@legamik.com.

6. Retention Period

We retain personal data only for as long as necessary:

• Case data (description, letter): for the duration of the service; the generated letter is available to you usually for one year. We then retain the data for the ordinary limitation period (usually 3 years) from the provision of the service for the defence of legal claims, and longer only where a dispute or proceedings are ongoing; thereafter it is deleted or irreversibly anonymised.
• Unfinished (unpaid) draft: 30 days from your last activity on the draft. If you do not complete it, we delete it automatically and irreversibly once that period expires (storage limitation, Article 5(1)(e) GDPR). Before deletion we may keep an anonymous record of the nature of the problem (see Article 7) — not your draft and not your contact details.
• Content of sent e-mails: 2 years (731 days).
• Delivery and interaction details for e-mails (e.g. IP and device data for opens or clicks): 90 days.
• Uploaded documents (original): at most 90 days after the case is closed, then deleted; the extracted summary is part of the case data and is deleted together with the case.
• Accounting and tax documents: for the period set by law (usually 10 years).
• Marketing contact: until you object or unsubscribe. The record that you unsubscribed (objected) is retained even after your case is erased, solely as a secure hash of your email address (data minimisation), so that we honour your objection for any future cases as well.
• Operational logs and backups: short-term, for the necessary period (usually up to 90 days).
• Security and audit records (including the record of the moment your generated letter was made available — time, browser data and the IP address solely as a secure hash; used for service security and the defence of legal claims): 365 days; longer only for as long as necessary where a dispute or proceedings are ongoing.

After the retention period, data is deleted or irreversibly anonymised.

7. Service Improvement and De-identified Samples

To improve the service, we may create de-identified (pseudonymised) samples from resolved cases, stripped of direct identifiers, to enhance the quality of generated letters. We do not use non-anonymised case data to train artificial-intelligence models without a separate legal basis. The legal basis is our legitimate interest in improving the service (Article 6(1)(f) GDPR); you may object at any time (see Article 10).

Similarly, before an unfinished draft is automatically deleted (see Article 6) we may keep an anonymous record of the nature of the problem — the type of case, the type of institution, how far you got in the wizard, and a machine-anonymised description stripped of names, addresses, contact details and numbers. That record contains no identifier of you and no reference to your case (it cannot be linked back to you), so once the draft is deleted it is no longer personal data within the meaning of the GDPR. If anonymisation does not complete reliably, no record is created — the draft is deleted either way.

8. Cookies and Technical Data

The Legamik website uses only essential (technical) cookies, without which the service could not function properly:

• login and session cookies (maintaining the wizard session, access to your case),
• security cookies (protection against fraudulent requests, e.g. CSRF),
• a country/language preference cookie.

These cookies are processed on the basis of necessity for providing the service you have requested, or our legitimate interest in the security of the website, and do not require consent.

To measure traffic we use our own cookieless analytics that neither reads nor stores any identifiers from your device; the IP address is processed only as a secure hash. We use no marketing or third-party tracking cookies, and therefore the website does not display a cookie banner.

You can manage or disable the storage of cookies in your browser settings; restricting essential cookies may, however, affect the functionality of the service.

9. Automated Decision-Making

The letter, and any informational score, are generated automatically using artificial intelligence; however, this does not constitute automated individual decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR. The score and the letter are only an informational basis; the final decision on how to proceed and on the use of the letter is always made by you, and you approve the letter before use.

10. Your Rights

Under GDPR you have the right to:

• access your data (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest, including direct marketing (Art. 21),
• withdraw consent, where processing is based on consent.

You exercise these rights by e-mail at support@legamik.com. We will handle them without undue delay, no later than within one month. You also have the right to lodge a complaint with the supervisory authority — the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

11. Security

We have adopted technical and organisational measures appropriate to the state of the art, in particular:

• encryption of data in transit and at rest,
• minimisation of personal data in operational logs (e-mail addresses and IP addresses are replaced with a secure hash in logs; passwords, tokens and other sensitive values are redacted),
• access control and logging, multi-factor authentication for administrators,
• the principle of least privilege; only authorised persons bound by confidentiality have access to the data.

12. Children

The service is intended for persons over 18 years of age, or for minors only with the consent of their legal guardian. We do not knowingly process children's data without such consent.

13. Changes to this Policy

We may update this policy from time to time; the current version is always available on the website and governs processing from the moment it is published.

Version History