Privacy Policy

This Privacy Policy explains how Majestic Group s. r. o. processes personal data in connection with the Akviro platform, websites, applications and related services (the “Service”). It should be read together with our Terms of Service. This is an early version (0.2) of this Policy and it will be revised and expanded over time.

1. Who is responsible

The operator of the Service is Majestic Group s. r. o., K Železnej studienke 7599/28, 811 04 Bratislava, Slovak Republic, Company ID (IČO): 47 669 551, registered in the Commercial Register of the Slovak Republic, Section Sro, Insert No. 96870/B (“we”, “us”). Contact: info@akviro.ai.

2. Two roles: controller and processor

We process personal data in two distinct roles:

• As controller — for data about our own customers, users and website visitors (account data, billing data, usage data, communications). Sections 3–10 describe this processing.
• As processor — for personal data that our customers store or generate in their Akviro workspace (in particular prospect and CRM data such as names, business contact details, roles and companies). For this data, the customer is the data controller and determines the purposes and means of processing; we process it only to provide the Service in accordance with the customer's instructions and our Terms of Service. Responsibility for the lawfulness of that processing — including the lawfulness of any outreach sent by or on behalf of the customer — rests solely with the customer. Section 11 explains what this means if your data appears in a customer's workspace.

3. Data we collect as controller

• Account data — name, email address, phone number (used for mandatory SMS verification), company details, language preference, authentication data (including sign-in via Google or Microsoft if you choose it).
• Billing data — plan, invoices, payment status. Card payments are processed by Stripe; we do not store full card numbers.
• Usage and technical data — log data, IP address, device and browser information, actions performed in the Service, credit consumption, security events.
• Communications — support requests, emails and, where you enable it, messages exchanged with the Service via channels such as WhatsApp.
• Cookies and local storage — we use strictly necessary storage for authentication and simple preferences (such as language and billing-period selection). The public website does not use advertising trackers.

4. Browser extension (Akviro LinkedIn Sender)

We offer an optional Chrome browser extension, Akviro LinkedIn Sender, which connects your Akviro account to your own LinkedIn session so that LinkedIn messages, connection requests and posts you have approved in Akviro can be delivered from your browser, and replies to those messages can be stored back in your workspace. In connection with the extension we process:

• Sign-in data — your Akviro email address and password (and SMS verification code, where required) are transmitted to our servers solely to authenticate you; the extension does not store your password.
• Outreach content — the content of messages, invitation notes and posts you approve, and delivery results (sent, failed and the failure reason), processed within your workspace.
• Replies — the extension reads, from your own LinkedIn inbox, replies to conversations started through Akviro (sender name and message text) and stores them in your workspace so they appear next to the original conversation.
• Local settings — your sending preferences (language, sending hours and limits) and daily action counters are stored locally in your browser and are not transmitted to us.

The extension communicates only with our servers (app.akviro.ai) and operates only on linkedin.com. It does not track your browsing, does not collect data from other websites, and never sends anything on LinkedIn without your explicit approval and confirmation. Data processed via the extension is part of your workspace data, to which the roles described in Section 2 apply. LinkedIn is a third-party service; your use of it remains subject to LinkedIn's own terms and policies.

5. Purposes and legal bases

• Providing the Service (contract performance, Art. 6(1)(b) GDPR) — account creation and verification, operating the platform and its agents, billing, support.
• Security and abuse prevention (legitimate interest, Art. 6(1)(f)) — logging, rate limiting, fraud and abuse detection, protecting the Service and other customers.
• Product improvement and analytics (legitimate interest, Art. 6(1)(f)) — understanding how the Service is used in order to improve it.
• Legal obligations (Art. 6(1)(c)) — accounting, tax and other regulatory requirements.
• Marketing to our own customers and prospects (legitimate interest or consent, as applicable) — you can object or opt out at any time.

6. Sharing and subprocessors

We share personal data only as needed to run the Service, with providers acting on our behalf, including: EU-based hosting and infrastructure providers; Stripe (payments); SMS delivery providers (phone verification); Meta/WhatsApp (if you enable WhatsApp features); AI-model providers used to power the Service's agents; email and communication providers; and professional advisers or authorities where required by law. We do not sell personal data.

7. International transfers

The Service is hosted in the European Union. Where a provider processes data outside the EU/EEA, we rely on an adequacy decision or appropriate safeguards such as the EU Standard Contractual Clauses.

8. Retention

We keep personal data for as long as your account is active and thereafter only as long as necessary for the purposes above — in particular, billing records for statutory retention periods and security logs for a limited period. Customer workspace data is deleted or anonymised within a reasonable period after account termination, as described in the Terms of Service.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation and monitoring. However, no method of transmission or storage is completely secure, and to the maximum extent permitted by applicable law we do not warrant or guarantee absolute security and accept no liability for unauthorised access, loss or alteration of data resulting from events beyond our reasonable control. You are responsible for keeping your credentials confidential.

10. Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing is based on consent. To exercise these rights, contact info@akviro.ai. You also have the right to lodge a complaint with a supervisory authority — in Slovakia, the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR, dataprotection.gov.sk).

11. If your data appears in a customer's workspace

12. Children

The Service is a B2B tool and is not directed at children. We do not knowingly process personal data of persons under 16 years of age.

13. Changes to this Policy

We may update this Policy at any time. The current version will always be published on this page with its version number and effective date. Material changes will be notified through the Service or by email.

14. Contact

Majestic Group s. r. o., K Železnej studienke 7599/28, 811 04 Bratislava, Slovak Republic · info@akviro.ai