Privacy Policy

1. Who processes your data?

The controller is:

Referred to below as "we" or "the Controller". Introxis is a product of Venus Projekt Modrany s.r.o.

Data protection officer: we have not appointed one, because we are not required to under Article 37 GDPR. Data protection matters are handled by the managing director at the email address above.

2. What does this policy cover?

• the Introxis website and its subpages (the "Website");
• the user account you can create on the Website;
• buying Introxis, payment and invoicing;
• downloads, the licence and updates;
• email contact and customer support.

It does not cover services of other companies, even if we link to them from the Website or the app (for example Claude or Stripe). These have their own privacy policies.

3. What data do we process, for what purposes and on what legal basis?

Legal bases under Article 6(1) GDPR:

• (a) consent;
• (b) performance of a contract, or steps taken before entering into a contract;
• (c) compliance with a legal obligation;
• (f) legitimate interests.

Where we rely on legitimate interests, we will send you the outcome of our balancing test on request.

3.1 Browsing the Website (technical data)

Our security provider (Cloudflare) may set a short-lived, strictly necessary cookie (__cf_bm, 30 minutes) to filter out bot traffic. Details are in the Cookie Policy.

3.2 Visitor statistics (our hosting provider's built-in measurement)

We use no other audience measurement, advertising or tracking tool (such as Google Analytics or tracking pixels), and we do not load external content (such as a YouTube player): the demo video is played from our own hosting, and the fonts are your browser's own fonts.

3.3 Signing in (by email, or with Apple or Google)

Signing in with Apple or Google. If you choose this, Apple Distribution International Ltd. (Ireland) or Google Ireland Limited (Ireland) authenticates you. The provider shares your email address with us (if you choose so, Apple gives us a private relay email address instead) and possibly your name. They are independent controllers for their own processing, under their own privacy policies: https://www.apple.com/legal/privacy/ · https://policies.google.com/privacy

3.4 Demo video

The Website's demo video is played from our own hosting (with our hosting and backend provider), without an external video provider. Playing it involves no processing beyond the technical data described in section 3.1.

3.5 User account

You can also ask us by email for a machine-readable copy of your data (data portability).

3.6 Purchase and payment (Stripe)

After successful payment, we automatically email you the confirmation of the contract: the order summary (product, price, date, licence), the two declarations you made at checkout with their timestamps, the version of the Terms and the full text of the Terms in force at the time of purchase (in the language of the purchase). The email is sent as "Introxis" from our own domain.

We do not see or store your card details. You enter them directly in Stripe's secure payment form, which is embedded in our purchase page (/buy); your card details go directly to Stripe. Stripe operates in line with the PCI DSS card security standard. On the purchase page, Stripe may set cookies that are strictly necessary for fraud prevention (see the Cookie Policy).

When processing the payment, Stripe acts on our behalf (processor). As an independent controller, Stripe also processes data for its own purposes: fraud prevention, anti-money-laundering and other legal obligations, risk management, and developing its services.

If you use Stripe's Link service at checkout (saving payment details for use across online stores), Stripe's own terms apply, and Stripe is responsible for that data.

Stripe privacy policy: https://stripe.com/privacy

3.7 Invoicing and accounting

3.8 Product delivery, licence and updates

3.9 Withdrawal, warranty claims, complaints

3.10 Contact and customer support

Please do not send sensitive data in messages (such as passwords, health data or card numbers) that is not needed for your case.

3.11 Legal claims and requests from authorities

• Purpose: we may use the necessary data from the above to establish, exercise or defend our legal claims. Legal basis: legitimate interests (Article 6(1)(f) GDPR).
• Requests from authorities: we may disclose data in response to a lawful request from an authority or court. Legal basis: legal obligation (Article 6(1)(c) GDPR).
• Retention: until the end of the limitation period or the final closure of the proceedings.

3.12 What we don't do

• We do not send newsletters, and we do not send marketing messages without consent. You will receive system messages related to your purchase and account (for example the sign-in link or code, the confirmation of your purchase or withdrawal, and notices of important changes).
• We do not sell data, and we do not use advertising tracking pixels (such as the Meta Pixel).
• We do not process special categories of data (such as health data).

4. The Introxis app and your data

Introxis is an app that runs on your Mac. From a data protection point of view, it works as follows:

• No usage tracking. The app does not send us usage statistics, error reports or content. Your projects, files, conversations and settings stay on your computer. We have no access to them.
• Activation and licence check (where the app asks for it). To activate, the app opens your browser, where you sign in to your account and approve that Mac. Our server then stores only an irreversible SHA-256 hash of the device token, together with the computer's name and model, the macOS and app versions, the time of activation and the time it was last seen. The app keeps the token itself on your Mac, encrypted in the macOS Keychain, together with a signed licence ticket valid for 30 days, so that it also works without an internet connection. When the computer is online, the app refreshes the licence about every 12 hours. This tells us which computers the licence is active on (up to 3 Macs at a time), which you can see and manage in your account (/account). Legal basis: performance of a contract (Article 6(1)(b) GDPR). Retention: while the computer is activated, then until the account is deleted.
• Claude (Anthropic). Introxis starts Claude through your own Anthropic account. What you type or dictate to Claude, and the files Claude accesses, go directly from your computer to Anthropic. This is governed by the contract between you and Anthropic and by Anthropic's privacy rules. We take no part in this processing.
• Dictation. Speech recognition runs on your computer. The audio recording does not reach us.
• Updates. From time to time the app fetches information about the latest available version from our server and downloads the update. This creates the technical data described in section 3.8.
• Optional connections. If you enable another service in the app with your own account or key (for example Telegram notifications or another AI provider), data flows directly between your computer and that provider. The app may also download public lists from third parties (for example the models.dev model registry). In that case, that provider sees your IP address.

5. Who receives the data? (recipients and processors)

Processors may only process data on our instructions, under a contract (Article 28 GDPR).

6. Transfers outside the European Economic Area (EEA)

Some of our providers or their sub-processors may also process data outside the EEA, mainly in the United States. In such cases the data is protected by safeguards under Chapter V GDPR:

• The adequacy decision under the EU-US Data Privacy Framework, where the recipient is certified. This applies to Stripe, LLC, Google LLC and Cloudflare, Inc.
• The European Commission's Standard Contractual Clauses, with supplementary technical measures (such as encryption), where certification does not apply. These are part of the providers' data processing agreements.

Our hosting and backend provider and some of its sub-processors are US companies. We store the database, user accounts and files in the EU (Frankfurt, Germany); where the provider or its sub-processors access the data from outside the EEA, the transfer is covered by the Standard Contractual Clauses and, where the recipient is certified, by the EU-US Data Privacy Framework.

Our transactional email delivery provider is also a US company. It delivers the confirmation emails from an EU sending region (Ireland); where the provider accesses the data from outside the EEA, the transfer is covered by the Standard Contractual Clauses and, where the provider is certified, by the EU-US Data Privacy Framework.

We will provide information about these safeguards on request.

7. How long do we keep the data? (summary)

When the retention period ends, we delete the data or anonymise it so that it can no longer be linked to you.

8. How do we protect your data?

• Encrypted connection (HTTPS/TLS) on the Website and at checkout.
• We store no passwords. On our server, the device tokens of activated Macs are kept only in irreversible (SHA-256 hashed) form; on the Mac, the token is stored encrypted in the macOS Keychain. Sign-ins are logged for security purposes.
• The database is stored in the EU (Frankfurt); every customer can only access their own data. Payment data stays with Stripe.
• Only authorised persons can access our systems, using two-factor authentication and strong passwords.
• We also select our providers with data security in mind. Payments are processed in line with the PCI DSS standard.
• We keep a record of personal data breaches. Where required, we report them to the supervisory authority within 72 hours and, if there is a high risk, we also notify the people affected.

9. Your rights

You can exercise the rights below at any time: email viktor@theweblab.hu. This is also how you can ask us to delete your account or to send you a machine-readable copy of your data.

• Access (Article 15): you can ask whether we process data about you. If we do, you can get a copy and find out for what purposes, for how long and to whom we have disclosed it.
• Rectification (Article 16): you can ask us to correct inaccurate data and complete incomplete data.
• Erasure (Article 17): you can ask us to erase your data if it is no longer needed, if you have withdrawn your consent, or if we process it unlawfully. Data we must keep by law (for example invoices) cannot be erased until the end of the retention period.
• Restriction of processing (Article 18): you can ask us to only store your data temporarily, for example while we check the accuracy of disputed data.
• Data portability (Article 20): you can receive the data we process by automated means on the basis of a contract or consent in a machine-readable format (for example JSON or CSV), or ask us to transfer it directly to another provider.
• Objection (Article 21): you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. We will then stop the processing unless we can demonstrate compelling legitimate grounds or the need to establish, exercise or defend legal claims.
• Withdrawal of consent (Article 7(3)): at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before it.

Deadline: we will respond to your request without undue delay and within 1 month at the latest. Where necessary, this can be extended by a further 2 months; we will inform you of this within 1 month. Handling requests is free of charge. If we have doubts about your identity, we may ask for additional information to identify you, for example to write from the email address linked to your account.

10. Complaints and remedies

If you feel we have infringed your data protection rights, please write to us first. We will try to resolve the problem quickly. You also have the right to lodge a complaint with a supervisory authority.

Slovak supervisory authority (the authority of our registered office):
Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic
Phone: +421 2 32 31 32 14 · Email: statny.dozor@pdp.gov.sk
Web: https://dataprotection.gov.sk

You can also lodge a complaint with the authority of the EU Member State where you live or work, or where the alleged infringement took place. For example, in Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, the Hungarian National Authority for Data Protection and Freedom of Information, 1055 Budapest, Falk Miksa utca 9-11., https://naih.hu).

You can also go to court.

11. Do you have to provide your data?

• Providing the data needed for the purchase and the account (for example your email address and billing details) is a condition of entering into the contract. Without it, we cannot complete the purchase.
• Billing details are required by law.
• You do not need to provide any personal data to browse the Website.

12. Automated decision-making and profiling

We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you, and we do not carry out profiling.

At checkout, Stripe, as an independent controller, may apply automated fraud screening, which may decline a payment in suspicious cases. If this happens, write to us and we will help you resolve it.

13. Children

The Website and Introxis are not intended for people under 16, and we do not knowingly collect data from them. If we become aware that we are processing the data of a person under 16 without parental consent, we will delete it.

14. Cookies

We use cookies and storage that are strictly necessary for the Website to work, and our hosting provider's visitor statistics cookie (session-id). Details are in the Cookie Policy.

15. Changes to this policy

If our processing changes, we will update this policy and show the effective date at the top. Users with an account will also be notified of material changes by email. Previous versions are available on request.

Venus Projekt Modrany s.r.o. · Modrany č. 178, 946 33 Modrany, Slovak Republic · viktor@theweblab.hu