Privacy Policy

The data controller is US Launchpad s.r.o., with registered office at Pernerova 697/35, Karlín, 186 00 Praha 8, company ID (ICO): 06837115 (the "Controller"). Contact for data-protection matters: system@uslaunchpad.com.

This policy describes what personal data the Controller processes when operating the Operations Checkpoint service, for what purpose, on what legal basis, for how long, and to whom it is disclosed, in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll.

Account data: e-mail address, name, language preference, and form of address.

Company and audit data: company name, website, size, industry, questionnaire answers, generated reports, and related state (including remediation data and audit history).

Payment and billing data: purchased entitlement status and transaction identifiers. Card details are processed directly by Stripe; the Controller has no access to them.

Technical data: access logs, IP address, and data necessary for operation, security, and abuse prevention (rate limiting).

Chat assistant conversation content, in order to provide answers and improve the Service.

Providing the Service and performing the contract (Art. 6(1)(b) GDPR): account management, running audits, generating reports, processing payments.

Compliance with legal obligations (Art. 6(1)(c) GDPR): in particular accounting and tax records.

Legitimate interest (Art. 6(1)(f) GDPR): securing the Service, preventing abuse, improvement, and customer support.

Consent (Art. 6(1)(a) GDPR): where required, in particular for non-essential cookies and any marketing communication. Consent may be withdrawn at any time.

The Controller uses the following processors, who act under a data-processing agreement:

Supabase, Inc. - database hosting, authentication, and server-side functions (application infrastructure).

Stripe Payments Europe, Ltd. - payment processing.

Google LLC (Gemini API) - processing of queries entered into the chat assistant in order to generate responses.

Google Cloud (region europe-west1) - hosting of the frontend application.

Some processors (in particular Stripe and Google) may process data outside the European Economic Area. Such transfers are based on appropriate safeguards under the GDPR, in particular the European Commission's Standard Contractual Clauses.

Account and audit data are retained for the duration of the account and thereafter for the period necessary to protect legal claims. After account deletion, data is erased or anonymised, unless a longer period is required by law (in particular accounting and tax documents for up to 10 years).

The User has the right to access their data, to rectification, erasure, restriction of processing, portability, to object to processing based on legitimate interest, and to withdraw any consent given.

These rights can be exercised by e-mail at system@uslaunchpad.com. The User also has the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (www.uoou.cz).

The Service uses essential cookies and similar technologies (e.g. local storage) necessary for login, security, and basic functionality. These do not require consent.

Non-essential cookies (e.g. analytics) are activated only after consent is given through the consent management banner. Your consent is stored on your device and can be changed at any time.

The Controller may update this policy. Material changes will be communicated via the Service. The current version is always available within the Service.