Privacy policy

1. Who we are

MadHoney s.r.o., Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, Company ID 23023937, VAT ID CZ23023937, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File 143835 ("MadHoney", "we", "us"). We have not appointed a data protection officer; you can reach us about personal data at sales@guard-ai.eu.

2. Our role

• For data of customer contacts, company administrators and website visitors, MadHoney is the controller.
• For data of employees trained by our customers, the customer (the employer) is the controller and MadHoney is its processor. Employees should direct requests primarily to their employer; we will forward requests we receive and assist the employer.

3. What data we process

• Company and order data: company name, billing country and the name and e-mail of the administrator given at checkout.
• Account data of administrators and employees: name, e-mail, department, role, preferred language, password hash (Argon2id) and sign-in information.
• Training data: assigned courses, training progress, quiz answers and results, number of attempts, issued certificates and dates of completion.
• Audit log: records of important actions (e.g. invitations, seat changes, course assignments, completions) with time and author, which form the evidence of training.
• Communication: e-mails we send (invitations, reminders, notifications) and your messages to us.
• Technical data: IP address and server logs needed for security and operation of the Service.

4. Purposes and legal bases

• Providing the Service and managing the subscription: performance of a contract (Art. 6(1)(b) GDPR).
• Training records and the audit trail on behalf of customers: processing on the customer's instructions; the customer's legal basis is usually its legal obligation under Article 4 of the AI Act or its legitimate interest.
• Invoicing and accounting: legal obligation (Art. 6(1)(c) GDPR).
• Security of the Service, prevention of abuse and defence of legal claims: legitimate interest (Art. 6(1)(f) GDPR).

5. Payments

Payments are processed by Paddle.com Market Ltd as the Merchant of Record. Payment card and billing details are entered directly with Paddle and processed under Paddle's privacy policy; we receive only information about the order and the subscription status, never the full card details.

6. Processors and recipients

• Paddle.com Market Ltd (United Kingdom) - orders, payments, invoicing and taxes as Merchant of Record.
• ZONER a.s. (Czech Republic) - SMTP server for delivering transactional e-mails (invitations, reminders, notifications); data centres in Brno.
• Hostinger International Ltd. (Cyprus) - rental of the virtual private server (VPS) that runs the Service; the server and database are in a data centre in Germany (EU).
• Umami - cookieless, aggregated visitor statistics for the guard-ai.eu website; not used in the application. We run our own instance on our server at Hostinger in Germany (EU); the data is not shared with the Umami vendor or any other third party.
• Public authorities, where required by law.

Transfers outside the EU/EEA take place only on the basis of an adequacy decision of the European Commission (e.g. the United Kingdom, or the EU-U.S. Data Privacy Framework) or standard contractual clauses. We do not sell personal data and do not use it for advertising.

7. Retention

• Account, training data, certificates and the audit log: for the duration of the customer's subscription, so the customer can prove training. When an employee is removed, the records needed for the audit trail are kept until the end of the subscription.
• After the subscription ends, data is deleted within 90 days, unless the customer asks for earlier deletion. Until then the administrator can still sign in, but only to export reports and training evidence.
• Invoicing and accounting records: for the period required by law (up to 10 years).
• Server logs and backups: typically up to 30 days.

8. Cookies

We use only cookies that are strictly necessary: a secure, HTTP-only session cookie to keep you signed in and a cookie to remember your language. During checkout, Paddle may use its own cookies needed for the payment. We do not use advertising cookies. We measure aggregated traffic with Umami, a cookieless analytics tool that stores nothing on your device and cannot identify you. You can review this at any time via Cookie settings in the footer.

9. Security

Data is transferred over encrypted connections (HTTPS), passwords are stored only as Argon2id hashes, sessions are protected and access to data is limited to authorised persons. The Service and all data run on a server in Germany (EU). Quiz answers are graded on the server, so correct answers are never sent to the browser.

10. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Contact us at sales@guard-ai.eu; we will reply within one month. You also have the right to lodge a complaint with a supervisory authority, in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz), or with the supervisory authority of the country where you live.

11. Automated decision-making

Quizzes are graded automatically against predefined answers. The result only records whether the training was completed and has no legal effect on the employee by itself; any decisions are made by the employer.

12. Public certificate verification

Anyone who has a certificate number can check it on the public page guard-ai.eu/verify. The purpose is to let the holder prove completed AI literacy training under Article 4 of the AI Act to employers, auditors and business partners, and to protect them against forged certificates.

The legal basis is the legitimate interest of the customer (the employer) and of the certificate holder in proving the training (Art. 6(1)(f) GDPR). Only the following is shown: the holder's first name and the initial of the last name, the course name, the company name, the date of issue, the validity end and whether the certificate is valid or expired. No e-mail, results or other data are shown.

A certificate can only be found by its exact number, a long random code that cannot be guessed; the holder controls who learns it by sharing the certificate. Lookups are limited per IP address and verification results are not indexed by search engines.

You can object to this processing or ask for erasure through your employer, which is the controller of your training data, or by writing to us at sales@guard-ai.eu.

13. Changes

We may update this policy. The current version is always available on this page with its effective date; we will inform administrators of material changes by e-mail.