Privacy policy
Plainly and without legalese: who processes your data, what we collect, why, how long we keep it and what you can do about it.
Effective from 13 October 20261Who processes your data
The controller of personal data is Petr Andrýsek, company ID 17601037, registered office Grégrova 443/12, Nová Ulice, 779 00 Olomouc, sole trader registered in the Trade Register kept by the Olomouc City Council, trading as WE4 (“WE4” or “we”).
For anything concerning your data, write to pa.andrysek@gmail.com. We reply without undue delay and within one month at the latest.
We have not appointed a data protection officer; Article 37 GDPR does not require us to.
2What, why and for how long
An overview of everything the website and the platform do with personal data. Details follow below.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Company diagnosis | Website address, diagnosis result; email, phone and goals only if you provide them | Legitimate interest (Art. 6(1)(f)); consent for email and phone (Art. 6(1)(a)) | For the business relationship, at most 3 years from last contact |
| Contact and pilot requests | Email, message text | Steps prior to a contract at your request (Art. 6(1)(b)) | At most 3 years from last contact |
| Hiring | Name, email, phone, form answers, CV, message | Steps prior to a contract at your request (Art. 6(1)(b)); longer retention only with consent (Art. 6(1)(a)) | 6 months from submission; 12 months with consent |
| Contracts and invoicing | Identification and contact details, data on contracts and invoices | Performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) | For the contract term; documents as required by tax law (up to 10 years) |
| Admin account | Name, email, role, two-factor sign-in data, sign-in log | Performance of a contract (Art. 6(1)(b)), legitimate interest in security (Art. 6(1)(f)) | For the cooperation, then deleted |
| Service protection | Salted hash of the IP address, browser identification | Legitimate interest in preventing abuse (Art. 6(1)(f)) | Together with the record it belongs to |
- Purpose
- Company diagnosis
- Data
- Website address, diagnosis result; email, phone and goals only if you provide them
- Legal basis
- Legitimate interest (Art. 6(1)(f)); consent for email and phone (Art. 6(1)(a))
- Retention
- For the business relationship, at most 3 years from last contact
- Purpose
- Contact and pilot requests
- Data
- Email, message text
- Legal basis
- Steps prior to a contract at your request (Art. 6(1)(b))
- Retention
- At most 3 years from last contact
- Purpose
- Hiring
- Data
- Name, email, phone, form answers, CV, message
- Legal basis
- Steps prior to a contract at your request (Art. 6(1)(b)); longer retention only with consent (Art. 6(1)(a))
- Retention
- 6 months from submission; 12 months with consent
- Purpose
- Contracts and invoicing
- Data
- Identification and contact details, data on contracts and invoices
- Legal basis
- Performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c))
- Retention
- For the contract term; documents as required by tax law (up to 10 years)
- Purpose
- Admin account
- Data
- Name, email, role, two-factor sign-in data, sign-in log
- Legal basis
- Performance of a contract (Art. 6(1)(b)), legitimate interest in security (Art. 6(1)(f))
- Retention
- For the cooperation, then deleted
- Purpose
- Service protection
- Data
- Salted hash of the IP address, browser identification
- Legal basis
- Legitimate interest in preventing abuse (Art. 6(1)(f))
- Retention
- Together with the record it belongs to
3Company diagnosis
The website address is used so our system can open and read the site the same way an ordinary visitor or search engine would. We read only publicly available data: HTML pages, server headers, the TLS certificate, public DNS records and certificate transparency logs.
We never actively test anything. We do not try to sign in, scan ports, look for vulnerabilities or read the contents of exposed files. For paths that are publicly reachable, we only report that the address responds. We respect robots.txt.
We store the result so it can be shown and shared again and so that a repeated diagnosis of the same domain does not trigger another run. A shared link never contains security findings — only the person who entered their email sees those.
You give your email voluntarily in exchange for the full diagnosis. We use it to deliver the report and to follow up on the result. Phone and goals are optional. You can withdraw consent at any time by replying to any of our emails; processing before withdrawal remains lawful.
Do you manage a website someone else diagnosed and don’t want us to keep the result? Write to us and we will delete it.
4Contact forms
When you send us your email through the “Try it” form or any other message from the website, we use it only to reply and arrange the next step. We do not add you to any newsletter.
5Hiring
Applications from the careers page are read by a person, not an automated system. CVs are stored in private storage that only an administrator can access; we never issue a public link, only a temporary signed one.
We delete applications 6 months after submission. If you tick the consent to keep it for other positions, we keep it for 12 months. Deletion is automatic and includes the CV. You can withdraw consent by email at any time and we will delete it sooner.
6IP address and technical logs
We do not store IP addresses in readable form. We derive a one-way salted hash used only to limit how many diagnoses or forms can be sent from one network per hour. The IP address cannot be recovered from it.
Our hosting provider keeps short-term operational logs (request address, time, server response) to keep the service running and secure.
7Who we share data with
We never sell data. Only suppliers without whom the service cannot run work with it, under a data processing agreement:
- Vercel Inc. — website and application hosting
- Supabase Inc. — database, authentication and file storage
- Anthropic PBC — the language model that writes the diagnosis text and reads and sorts messages in the platform
- Resend (Plus Five Five, Inc.) — sending emails
Some of them are based in the USA. Transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses approved by the Commission.
We may also disclose data to public authorities where the law requires it.
8Platform client data
When WE4 processes a company’s emails, orders, invoices or its customers’ data, that company is the controller and we are the processor. This is governed by the data processing agreement that forms part of the client contract.
Each company’s data is isolated directly in the database. WE4 staff have no silent access: only with a stated reason, for at most 4 hours, and the client sees it in the log. When the cooperation ends, the client receives an export and we delete the data.
9Your rights
You have the right:
- to access your data and receive a copy,
- to have inaccurate data corrected,
- to erasure (“to be forgotten”),
- to restriction of processing,
- to data portability,
- to object to processing based on legitimate interest,
- to withdraw consent at any time without affecting processing before withdrawal.
Just write to pa.andrysek@gmail.com. If you believe we process your data unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.
We do not make automated decisions with legal effects on you. The company diagnosis is automated, but it only describes what is visible about a company on a publicly available website.
11Changes to this policy
When the way we work with data changes, we update this policy and the effective date at the top. We notify people we are in contact with about material changes by email.