Privacy policy

Who processes the data

The controller is Jan Kraus, Business ID (IČO) 07853211, Plaňanská 405/14, 108 00 Praha 10. Contact: info@obhlidka.cz, tel. +420 604 530 017.

What data and why

Signing in to the app: your e-mail address and the one-time link with a code that we send you. Once you are signed in, your browser remembers the sign-in in a cookie for 30 days from your last visit.
Password: if you set one. I never store it in readable form, only its hash, made with the scrypt algorithm and a random salt, from which the password cannot be recovered. When you set a password, I check whether it has appeared in leaked password databases (the Have I Been Pwned service): only the first 5 characters of the password’s hash (SHA-1) leave my server for it, never the password, your e-mail address or any other information about you; the comparison takes place on my server. I delete the password when your account is cancelled. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Passkey: if you add one. Your fingerprint, face or device PIN never leave your device; the device sends me only a signature, which I verify. I store the passkey’s public key, its identifier, the device name (derived from the browser; you can change it), when you added it and when you last signed in with it, and the technical data the standard requires (the signature counter, whether the passkey syncs between devices, the device type designation). I delete a passkey when you remove it in Profile or cancel your account; from the password manager on your device, you delete it there. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Protection against misuse: when you sign in, the Cloudflare Turnstile service checks that the form isn’t being filled in by a robot; in doing so, Cloudflare, as my processor, processes data about your browser and your IP address. To prevent accounts from being created in bulk, I count new accounts per day by the network they come from. I don’t store the IP address for this, only its hash (a keyed hash) and the number of new accounts. I remember failed attempts to sign in with a password for 15 minutes against the e-mail address they were for, to prevent password guessing. Legal basis: legitimate interest in protecting the service against misuse (Art. 6(1)(f) GDPR).
Where you came from: when you sign up, I store with your account where you came to Obhlídka from: the campaign label in the link's address (its utm parameters), otherwise only the domain of the page that linked to Obhlídka, or the fact that you signed up through the extension or an AI assistant. The website stores nothing on your device for this. Legal basis: my legitimate interest in knowing where people come from (Art. 6(1)(f) GDPR).
Using the app: with your account I record which parts of a property’s assessment and the search map you opened, and when. Together with what I already know about the account (searches, properties, credit history, viewings), I use it to compute aggregate statistics on where people stop in the app. Nothing is stored on your device for this. Legal basis: legitimate interest in improving the service (Art. 6(1)(f) GDPR).
Unfinished sign-ups: when you ask for a code to sign up an address that has no account yet, I record the time, where you came from (as above) and whether an account was created. Legal basis: legitimate interest in knowing how many people don’t finish signing up (Art. 6(1)(f) GDPR).
Content you upload: the description of what you are looking for, listing texts, photos and documents. It is used solely to assess your properties. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Buying credits: e-mail address, pack, amount, date and a link to Stripe’s receipt. I neither see nor store your card number. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for payment records also compliance with the legal obligation to keep tax records (Art. 6(1)(c) GDPR).
Credit history: credits added, used and refunded, including gift codes redeemed. Legal basis: performance of a contract; after your account is cancelled, I keep it for possible claims and disputes on the basis of legitimate interest (Art. 6(1)(f) GDPR).
Website traffic: anonymous statistics without cookies (Cloudflare Web Analytics). They don’t identify you.
Ad measurement: only if you allow it in the banner on the website or in the app, the Google Ads tag (a script of Google’s) records whether your visit from a Google ad led to a sign-up, a first assessed property or a purchase of credits (with its amount). Until you allow measurement, no script of Google’s loads. I record your answer under a random identifier so that I can prove the consent. Legal basis: your consent (Art. 6(1)(a) GDPR; for storing the cookie, § 89(3) of Act No. 127/2005 Coll., on Electronic Communications). You can withdraw your consent at any time with the “Cookie settings” link in the website’s footer or in the app under Profile; withdrawal doesn’t affect the lawfulness of the processing before it.

Who else has access to the data

The data is processed by these processors, only to the extent necessary to run the service:

Cloudflare, Inc. – hosting, database, file storage, sign-in, bot checks (Turnstile), e-mails and assessment with Workers AI models through AI Gateway.
Google (Gemini models), through Cloudflare AI Gateway – assessment of the uploaded content (texts, photos, documents).
Seznam.cz, a.s. (Mapy.com) – converting the property’s address into coordinates. Only the address is sent, not your data.
Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland – card payments. For the payment itself it is my processor; for fraud prevention and to meet its own legal obligations (e.g. against money laundering) it is an independent controller under its own policy at stripe.com/privacy.

If you allow ad measurement, data about your visit from an ad also goes to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For conversion measurement it is not my processor but an independent controller under the Google Ads Controller-Controller Data Protection Terms, and follows its own policy at policies.google.com/privacy. Google may transfer the data to Google LLC in the USA; the transfer is covered by the EU–US Data Privacy Framework.

Cloudflare, Google and Stripe may also process the data outside the EU (Stripe transfers data to Stripe, LLC in the USA); the transfer is covered by standard contractual clauses and the EU–US Data Privacy Framework.

For how long

I delete requests for access from the time when access was by invitation no later than 12 months after they were made.
I delete network hashes and counts of new accounts after the end of the day they belong to.
I delete records of failed attempts to sign in with a password after 15 minutes.
I keep searches, properties and uploaded files until you delete them or ask for your account to be cancelled.
I keep payment records (amount, date, link to the Stripe receipt) for 5 years from the end of the year in which the payment was made, for tax records (§ 7b of the Income Tax Act, zákon o daních z příjmů; § 148 of the Tax Code, daňový řád).
I delete the credit history no later than 3 years after your account is cancelled.
I keep the records of how you use the app (which parts you opened) until you ask for your account to be cancelled; I delete them when it is cancelled.
For an unfinished sign-up, I keep the e-mail address only while the code is valid (10 minutes) and delete it at most an hour after the code expires; I delete the record without the e-mail after 90 days.
Google’s ad-measurement cookies (_gcl_au, _gcl_aw and similar) last 90 days, the cookie with your answer to the banner 12 months.
I keep the record of your answer to the banner (a random identifier, the time and the answer, without your IP address and without a link to an account) for 4 years: the answer’s lifetime plus the general limitation period, so that I can prove the consent.

Cookies

The website uses lang, a strictly necessary cookie that remembers the site’s language for a year so that the home page doesn’t redirect you again. The app uses strictly necessary cookies, without which signing in and connecting an AI assistant or the extension wouldn’t work.

The website and the app remember your answer to whether I may measure ads in the obhlidka_consent cookie on obhlidka.cz and app.obhlidka.cz for 12 months. This cookie only keeps your choice, so it needs no consent. Google’s cookies _gcl_au, _gcl_aw and similar are stored only if you allow measurement, and last 90 days. Google may also store the same ad-click data in the browser’s local storage (keys starting with _gcl_), likewise only after you consent.

You can change your choice at any time with the “Cookie settings” link in the website’s footer or in the app under Profile. When you withdraw your consent, the website and the app delete the Google cookies they can reach, and with them its _gcl_ entries in the browser’s local storage.

Stripe’s payment page uses its own cookies for fraud prevention; they are governed by Stripe’s policy.

Browser extension

The Obhlídka in your browser extension for Chrome (and other Chromium-based browsers) and Firefox adds a listing to your search straight from the listing’s page.

Where it runs: only on the www.sreality.cz and www.bezrealitky.cz pages. On other pages it reads and sends nothing.
Before you sign in: until you sign in to the extension, it sends nothing anywhere.
After you sign in: when you open a listing on one of these sites, the extension sends its address to app.obhlidka.cz to find out whether you already have it in one of your searches, and loads the list of your searches. It doesn’t send the page’s content, only its address. When you click “Analyse”, the listing is added to the chosen search just as if you had pasted the link in the app; from then on, what I say above about content you upload applies to it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Listing addresses: I don’t store the address of a listing you don’t add. The exception: when the query fails on my server, the address is written, together with your e-mail address, to the error log at Cloudflare, which is deleted after 7 days.
Signing in: you sign in with a code or a link from your e-mail, a password or a passkey, just as in the app, in an Obhlídka window; the extension doesn’t see your e-mail address. It stores the sign-in tokens in the browser: the refresh token in the extension’s storage on your computer, the short-lived access token only in memory until the browser is closed. It also stores which search you used last. Only the extension itself reads the tokens; the portals’ pages have no access to them. The permission you gave the extension is stored on my server; you can see it in the app under Profile → Connections.
No tracking: the extension has no analytics, advertising or cookies, and loads nothing from third parties.
Disconnecting and uninstalling: in the app under Profile → Connections, click Disconnect next to “Obhlídka in your browser”; this signs the extension out. When you uninstall the extension, the browser deletes its storage along with the tokens. The permission on the server remains, however, until you disconnect it under Profile → Connections, or until it goes unused for 30 days.

You install the extension in Chrome from the Chrome Web Store (Google) and in Firefox from Firefox Browser Add-ons (Mozilla). Google and Mozilla follow their own policies in doing so.

Connecting an AI assistant

You can connect Obhlídka to an AI assistant (for example Claude or ChatGPT) as a connector at the address https://app.obhlidka.cz/mcp. The page Obhlídka in your AI assistant describes how.

What the assistant may do: it reads your searches and adds properties. It sees your searches (what you are looking for: budget, location, criteria) and the properties in them (address, link to the listing, price) with their assessment and the checklist for the viewing. It can add a property by a link or by pasted text and have it assessed again; the new assessment replaces the previous one. Credits are used just as in the app. It cannot delete searches or properties, change your requirements, upload photos and documents, or buy credits.
Signing in: you sign in with a code or a link from your e-mail, a password or a passkey, just as in the app, in an Obhlídka window, and confirm that you allow the assistant access. Your browser remembers your permission in a strictly necessary cookie for 30 days, so when you connect the same assistant again, the confirmation is skipped. The assistant receives only sign-in tokens; Obhlídka doesn’t send it your e-mail address.
The assistant’s provider: what the assistant reads from Obhlídka, and what you write to it in the conversation, is processed by its provider (Anthropic for Claude, OpenAI for ChatGPT) under its own terms and policies. You choose and connect the assistant yourself; the provider is not my processor, and I have no influence over what it does with the data.
What I store: with your account (with your e-mail address), the permission you gave the assistant: which assistant, when and to what extent. You can see it in the app under Profile → Connections. A property the assistant adds is stored just as if you had pasted the link in the app; from then on, what I say above about content you upload applies to it. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Error log: when an assistant’s request or its sign-in fails, it is written, together with your e-mail address and a description of the error (for a lookup by link, also the listing’s address), to the error log at Cloudflare, which is deleted after 7 days.
Disconnecting: in the app under Profile → Connections, click Disconnect next to the assistant; the assistant then loses access. Removing the connector in the assistant’s settings may not revoke the permission on my server: it remains until you disconnect it under Profile → Connections, or until it goes unused for 30 days.

Connecting an assistant adds no processors other than those listed above.

Your rights

You have the right of access to your data, to its rectification, erasure, restriction of processing and portability, and the right to object. Just write to info@obhlidka.cz. If you believe the processing breaches the law, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).