Privacy Notice

Controller

Process Song s.r.o., Company ID 27641368, registered office Rybná 716/24, Staré Město, 110 00 Praha ("we"). Privacy contact: roman.fiser@grcx.ai.

Data we process

First and last name, e-mail address, company name; and, when you use the service, technical data necessary for security (in particular IP address and sign-in records). We also store your unverified Czech phone number, consent choices and their timestamp and notice version. A necessary trial-history cookie lasts 400 days.

Purposes and legal bases

Setting up and managing your 30-day trial access to the e-book. Performance of a contract (Art. 6(1)(b) GDPR).

Securing the service and preventing abuse (including verifying that the registration is not automated). Our legitimate interest (Art. 6(1)(f) GDPR).

Sending commercial communications about GRCx products. Solely based on your voluntary consent (Art. 6(1)(a) GDPR), which you may withdraw at any time without affecting your trial access.

Retention

Account data is kept for the duration of the trial and for 12 months thereafter in case of future cooperation, then deleted or anonymised. Marketing data processed on the basis of consent is kept until that consent is withdrawn. Withdrawing analytics consent stops future collection and clears the local analytics identifier, but does not delete events or recordings already received by PostHog. Contact us at roman.fiser@grcx.ai to request deletion.

Recipients

Our contracted processors operating the service: identity management provider (ZITADEL, operated in the EU), hosting provider (Vercel), bot-protection provider (Cloudflare), and optional analytics provider PostHog.

Your rights

Access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time. You may also lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz). To exercise your rights, contact us at roman.fiser@grcx.ai.

Automated decision-making

None.

Optional analytics

With your optional consent, PostHog receives page visits, trial request attempts and outcomes, reader and chapter opening counts, active reading time, click coordinates and scroll depth for heatmaps, and masked session recordings of browser interactions. These use a random browser identifier and basic device information, without linking to your account. Text, form values and element attributes are masked before recording; images, embedded content and marked private areas are excluded. We do not send book or proprietary skill content, URL query parameters or fragments, network headers or bodies, or console logs. Login and invitation pages are not recorded. Masking reduces visual detail. PostHog processes this data in its EU region; recordings are currently retained for 30 days. The analytics identifier uses browser storage. Your choice expires after 180 days and can be changed in Privacy settings. Earlier consent that excluded recordings does not enable these features. Withdrawal stops future collection and clears the local analytics identifier; it does not delete events or recordings already received. Contact us to request deletion.