1. Personal data controller
The controller of personal data is Lusam shop, s.r.o., Company ID (IČO) 22515259, with its registered office at Korunní 108, 101 00 Prague, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 416917 (the “controller” or “we”), the operator of the GoApp service and the goapp.cz website.
For matters relating to the protection of personal data, contact us at info@goapp.cz.
2. Visiting the goapp.cz website
The goapp.cz sales website does not use third-party analytics or advertising tools. Fonts and images are hosted directly on the website. Content from a third-party server is loaded only for the inquiry form, namely the Cloudflare Turnstile bot protection (see Inquiry form).
With every request, the server on which the website runs automatically records technical data: the IP address, the time of the request, the requested address, and the browser identification. These records serve to ensure the security and operation of the website on the basis of our legitimate interest (Article 6(1)(f) GDPR) and are retained for 14 days. We retain the technical logs of the application (errors and traffic) for 60 days.
3. Non-binding inquiry form
When you send us the “Get in touch” form, we process the name, email, company name, website or online store address, selected interest, and message text that you fill in, as well as the IP address, browser identification, and time of submission. We use this data to handle your inquiry, arrange a demo, and communicate with you. The legal basis is your consent given in the form (Article 6(1)(a) GDPR) and steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). We retain inquiries for 12 months from the last contact. You may withdraw your consent at any time by email to info@goapp.cz.
We send one automatic confirmation of receipt of the inquiry to the address you provided. To protect against abuse, we count form submissions by IP address; in the rate-limit files, the IP address is stored only as a one-way hash, and the records are deleted after two days at the latest.
The form is protected by the Cloudflare Turnstile service, which verifies that it is being submitted by a human. It is loaded only when the form is displayed and processes the IP address and technical data about the browser and device (legitimate interest in protection against spam and abuse, Article 6(1)(f) GDPR).
4. Personal data of application users
When you register for and use the app.goapp.cz application, we process the following categories of data:
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, email, company, phone, password (stored only as a hash) | Setting up and maintaining the account, providing the service, communicating with you | Performance of a contract, Article 6(1)(b) GDPR | For the duration of the account and for no more than 30 days after its cancellation. An account without a paid subscription is deleted 12 months after the end of the paid period (Terms and Conditions, clause 5.10). |
| IP address, login times, records of actions and requests performed | Security of the account and the service, prevention of misuse, resolution of any disputes | Legitimate interest, Article 6(1)(f) GDPR | Audit logs of actions in the account for 30 days, technical logs of the application for 60 days |
| Plan, credits and their usage, and orders of plans and credits | Billing, checking plan limits, notifications about running out of credits | Performance of a contract, Article 6(1)(b) GDPR | For the duration of the account |
| Billing details (name, company, company ID, tax ID, billing address) | Issuing tax documents and keeping accounting records | Legal obligation, Article 6(1)(c) GDPR | For the period required by accounting and tax regulations (up to 10 years) |
| Content of email communication and of support messages in the application, including attachments | Handling questions and requests | Performance of a contract or legitimate interest, Article 6(1)(b) and (f) GDPR | 3 years from the resolution of the request |
5. Content you enter into the service
We process the product catalog, texts, images, and other content that you enter into the service or synchronize from your online store solely for the purpose of providing the service. If this content contains personal data of third parties, you are the controller of that data and we process it as a processor according to your instructions (personal data processing terms, clause 8.5 of the Terms and Conditions).
Therefore, do not enter any personal data into the service that is not needed to create outputs.
At your request, for example through a “Do it for me” (Udělejte to za mě) request in support, the GoApp team may work directly in your account. Every such action is logged and is visible on the affected outputs and tasks.
6. Recipients and processors
We make personal data available only to the extent necessary to the following recipients:
- AI providers – Anthropic (Claude models), OpenAI (GPT models), and Google (Gemini models): the content of a specific request to create an output, i.e., product data, texts, and, where applicable, images. We do not pass on your account data to them. We use the paid APIs of these providers, under whose contractual terms the data sent is not used to train models.
- Cloudflare – protection of the application’s forms (for example, registration and login) and of the inquiry form on the goapp.cz website against bots (the Turnstile service); it processes the IP address and technical data about the browser and device.
- Accountants and tax advisors, as well as public authorities, to the extent required by law.
- Your connected systems (online store, website) – we transfer outputs to them on your instruction via the module, the plugin, or the API.
7. Transfers outside the European Union
AI providers and Cloudflare may also process data in the United States of America. Transfers take place on the basis of the European Commission’s adequacy decision (EU–US Data Privacy Framework) for certified recipients or, alternatively, on the basis of standard contractual clauses.
8. Cookies and browser storage
The goapp.cz website itself does not use cookies. The Cloudflare Turnstile protection of the inquiry form is loaded only with the form and may use technically necessary data in the browser for verification.
The app.goapp.cz application uses only a technically necessary session cookie, which keeps you logged in and protects forms against forgery, and the browser’s local storage for appearance settings and drafts in progress. The application cannot function without them; therefore, under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications, they do not require consent. We do not use analytics or advertising cookies.
9. Automated decision-making
The artificial intelligence in the service creates texts and other content based on your instructions. There is no automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.
10. Security
Communication with the service is encrypted (HTTPS). We store passwords only as a hash, and access keys and secrets in encrypted form. Access to data is separated for individual accounts, important actions are logged, and requests are protected by limits against abuse.
11. Your rights
In connection with the processing of personal data, you have the right:
- to access your personal data (Article 15 GDPR),
- to rectification of inaccurate data (Article 16 GDPR),
- to erasure (Article 17 GDPR),
- to restriction of processing (Article 18 GDPR),
- to data portability (Article 20 GDPR),
- to object to processing based on legitimate interest (Article 21 GDPR),
- to withdraw your consent where the processing is based on consent.
You can exercise your rights by email at info@goapp.cz. We will respond without undue delay and in any event within one month. You also have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7.
12. Changes to this policy
We may update this policy, in particular when the service or legal regulations change. We will inform users of material changes by email or in the application. The current version is always published on this page.