Privacy Policy
Last updated: June 22, 2026
1. Data Controller
The Data Controller for personal data processing is:
Fl1 s.r.o.
operating under the trade name "Pixarts"
Registered office: Moskevská 1464/61, Vršovice, 101 00 Praha 10, Repubblica Ceca
IČO (Partita IVA ceca): 04626664
Email: bo2@fl1.cz
Data Protection Officer (DPO): not appointed, as the mandatory conditions set out in Article 37 GDPR do not apply. For any matter relating to the protection of personal data you may contact the Controller at the details indicated above.
2. Types of Data Collected
2.1 Data voluntarily provided by the user
Through the contact form we collect:
Required data
- • Full name
- • Email address
- • Phone number
Optional data
- • Project description
- • Estimated budget
- • Desired timeline
2.2 Automatically collected data
During website navigation, the following data is automatically collected:
- • IP address (anonymized)
- • Browser type and device
- • Operating system
- • Pages visited and time spent
- • Traffic source (referrer)
- • Site interaction data
2.3 Data collected via cookies
For detailed information about cookies used, please see our Cookie Policy.
2.4 Data collected through the referral program
When a visitor lands on the site via a partner's referral link, we store:
- • pixarts_ref cookie (30-day lifetime, first-touch) containing the partner code
- • Anonymous click record (SHA-256 hashed IP, user agent, source URL)
- • If the visitor submits a contact or quote form while the cookie is active, the lead is saved linked to the partner for commission calculation
Purpose: running the partner programme and calculating commissions. Legal basis: performance of the contract with the partner (art. 6.1.b GDPR). The pixarts_ref cookie holds only the partner's code, not an advertising identifier, and is never used to profile you or to serve you ads: without it we could not tell which partner a commission is owed to, so the programme simply would not work. That is why it is set when you open a partner link, regardless of your advertising preferences. Retention: 30 days for the cookie; 24 months for the click record.
2.5 Data collected by the conversational assistant
On some pages (home page, /web, /agent-lead, /ai-solutions, /idea-to-launch) a conversational assistant is available for you to describe your project. The widget is loaded only after you have made a choice on the cookie banner — whether you accepted or rejected — and after your first interaction with the page or five seconds. You are not required to use it: the forms and email remain available at all times.
If you choose to write to it, we collect the details you leave in the chat (name, email, phone, company) and the full text of the conversation, together with the number of messages exchanged, the language and an automatically generated summary of your enquiry.
The full transcript is stored in our database and kept for 12 months; after that the text is deleted and only counters remain. Please do not enter special category data in the chat (for example about health or personal beliefs) or data about other people: we do not need it in order to answer you.
The assistant runs on agentlead.fl1.it, infrastructure belonging to Fl1 s.r.o.: it is not a third-party service we hand your data to. The language model that produces the replies is, however, provided by Anthropic (United States), which receives the content of the conversation. If you would rather avoid that, simply do not use the chat: the forms and email are always available and get you to the same place.
Purpose: answering your enquiry and understanding what you need before we get back to you. Legal basis: the pre-contractual steps you request by starting the conversation yourself (Art. 6.1.b GDPR). The assistant's replies are generated automatically and may contain errors: they do not constitute a contractual offer.
2.6 Where your data comes from
| Channel | Where it is | What we collect |
|---|---|---|
| Contact form | Only on the Contact page. It is not on the home page or on any other page | Name, email address, project type and acceptance of this privacy policy. Nothing else |
| Quote configurator | Quote page | The project type, features and timeline you choose, then first name, last name, email address, phone number and acceptance of this privacy policy |
| Call booking | Book a call page | First name, last name, email address, phone number, company, role, the message you write, the date and time you choose and acceptance of this privacy policy |
| Conversational assistant (chat) | Every page of the public website, only after you have made your choice on the cookie banner | The full content of the conversation, including any contact details you decide to type into the chat |
| Partner program application | Become a partner page | Name, email address, phone number, the password for your partner account and the reason why you want to apply |
| Request to exercise your privacy rights | GDPR request page | First and last name, email address, phone number if you wish to give it, type of request, details of the request, the email address you had used with us and the declarations with which you confirm your identity |
3. Purposes and Legal Basis of Processing
| Purpose | Legal basis | Data processed |
|---|---|---|
| Responding to contact requests | Art. 6.1.b GDPR | Name, email, phone, project details |
| Providing requested services | Art. 6.1.b GDPR | Identification data, billing data |
| Invoicing and tax compliance | Art. 6.1.c GDPR | Billing data |
| Anonymous statistical analysis | Art. 6.1.f GDPR | Anonymized navigation data |
| Direct marketing (newsletter) | Art. 6.1.a GDPR | |
| Advertising profiling | Art. 6.1.a GDPR | Navigation data, interests |
4. Processing Methods
Personal data is processed using electronic and/or paper tools, with logic strictly related to the purposes indicated above and, in any case, in a way that guarantees the security and confidentiality of the data.
Security measures adopted:
- ✓SSL/TLS encryption for all communications
- ✓Data access limited to authorized personnel
- ✓Regular encrypted backups
- ✓Database and file storage on servers located in Ireland, therefore inside the European Union (Supabase, region eu-west-1): the data you send us with the forms and with the chat is stored here
- ✓Security incident management procedures
5. Data Retention Period
| Data type | Retention period |
|---|---|
| Contact enquiries that did not become clients | 24 months from the last contact, then automatic anonymization of the data that identifies you (see the note below the table) |
| Client, contract and billing data (enquiries that became projects) | 10 years from the end of the relationship, for tax and accounting obligations. This data is excluded from the 24-month anonymization |
| Quote requests sent through the online configurator | 24 months from submission |
| Transcripts of conversations with the website assistant | 12 months |
| Log of the commercial emails we have sent you | 24 months from sending |
| Draft content and proposals generated by our internal tools | 30 days after the draft's expiry date |
| Technical logs of the website and its features | 12 months |
| Records of the automated calls between our systems (webhooks) | 90 days |
| Clicks on referral program links | 24 months |
| Internal log of the activities carried out on the data | 24 months |
| Google Analytics — event data (page views, clicks) | 2 months |
| Google Analytics — user-level data | 14 months, with the count restarting from zero every time the same user is active again |
6. Data Recipients
6.1 Service providers (Data Processors)
| Provider | Service | Data received | Location |
|---|---|---|---|
| Supabase | Database and file storage for the website: contact enquiries, quotes, bookings, chat transcripts, images | All the data you send us through the forms and through the chat | Ireland (European Union), region eu-west-1 |
| Anthropic | Language model that generates the answers of the website's conversational assistant | The full content of the conversation, therefore also the data you decide to type into the chat. This is the flow with the most personal data in the whole system | United States |
| Anthropic | Language model of our internal tools: first qualification of enquiries and drafting of content | Only name, company and the text of the enquiry. Email address and phone number are not transmitted | United States |
| OpenAI | Generation of the images for our marketing content | Photograph of our legal representative and marketing copy written by us. No data about the people who contact us | United States |
| Google Ireland Limited | Google Analytics 4 and Google Tag Manager: statistics on how the website is used | Browsing data such as pages viewed, device type and approximate geographic area, only if you accept analytics cookies | Ireland (European Union) |
| Google Ireland Limited | Google Calendar and Google Meet: management and running of the calls you book from the website | Name, email address and time of the appointment | Ireland (European Union) |
| Zernio | Publication of our posts on social channels | Only the texts and images that we publish ourselves. It does not receive the data of the people who contact us or use the chat | Does not process data of website visitors |
| Application hosting provider | Server on which the website and its features run | The data you send passes through the server at the moment you use a form or the chat; it is then stored in the database in Ireland | We indicate the category of recipient, as Article 13 GDPR allows. If you want to know which provider we are using, write to us at bo2@fl1.cz and we will tell you |
6.2 Other recipients
- • Competent authorities, upon legitimate request
- • Legal and tax consultants, for mandatory compliance
7. Extra-EU Data Transfers
Some of our service providers are located outside the European Economic Area (EEA), particularly in the United States.
For these transfers we rely on:
- •European Commission adequacy decision - EU-US Data Privacy Framework for certified providers
- •Standard Contractual Clauses (SCC) - Transfers outside the European Union concern only two providers, both in the United States: Anthropic, which supplies the language model of the conversational assistant and of our internal tools, and OpenAI, which generates the images for our marketing content. Everything else stays in Europe: the database and the file storage, where the data you send us is kept, are located in Ireland. For these two providers the instrument provided for by the GDPR is the European Commission's standard contractual clauses, contained in the data processing terms that both of them publish; the formal verification of that documentation for our accounts is still in progress, and we prefer to tell you rather than treat it as settled. In the meantime we keep to a minimum what leaves the European Union: OpenAI receives no data about the people who contact us, and our internal tools receive only name, company and the text of the enquiry, never an email address or a phone number. The exception is the conversational assistant, which in order to work sends the content of the conversation to Anthropic: if you prefer not to use that channel, you can write to us at bo2@fl1.cz or use the form on the Contact page.
- •Supplementary measures - of technical and organizational security
8. Data Subject Rights
Under Articles 15-22 of the GDPR, you have the right to:
Access (Art. 15)
Obtain confirmation of processing and a copy of your data
Rectification (Art. 16)
Correct inaccurate or incomplete data
Erasure (Art. 17)
Request deletion of your data
Restriction (Art. 18)
Restrict processing in certain circumstances
Portability (Art. 20)
Receive your data in a structured, readable format
Objection (Art. 21)
Object to processing based on legitimate interest
How to exercise your rights
You can exercise your rights by sending a request to:
Email: bo2@fl1.cz
We will respond to your request within 30 days. In complex cases, the deadline may be extended by an additional 60 days, with prior notice.
Complaint to Supervisory Authority
You have the right to lodge a complaint with the Data Protection Authority:
For users in Italy:
Garante per la Protezione dei Dati Personali - www.garanteprivacy.it
For users in Czech Republic:
Úřad pro ochranu osobních údajů (ÚOOÚ) - www.uoou.cz
9. Data Provision
Providing data marked as mandatory in the contact form is necessary to respond to your request. Failure to provide this data makes it impossible to process the request. Optional data allows us to provide a more personalized service but is not essential.
10. Automated Decision-Making
We do not carry out decision-making based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. The advertising profiling listed in the purposes table is carried out solely with your prior consent (marketing cookies), is used to show you more relevant ads and does not constitute automated decision-making with legal effects: you can object to it or withdraw your consent at any time.
11. Minors
Our services are intended for a professional audience (businesses and professionals). We do not knowingly collect personal data from minors under 16 years of age. If you believe we have collected data from a minor, please contact us immediately.
12. Changes to Privacy Policy
We reserve the right to modify this Privacy Policy at any time. Changes will be published on this page with an indication of the last modification date. For substantial changes, we will notify you via a notice on the site or, if we have your email address for marketing purposes, via direct communication.
13. Contacts
For any questions regarding this Privacy Policy or the processing of your personal data:
Fl1 s.r.o. (Pixarts)
Moskevská 1464/61, Vršovice
101 00 Praha 10, Repubblica Ceca
Email: bo2@fl1.cz
This Privacy Policy complies with Regulation (EU) 2016/679 (GDPR) and applicable data protection legislation.