Privacy Policy
Last updated: August 15, 2026
Who we are
This website and the Implenova service ("Implenova", "we", "us", "our") are operated by Bc. Bektur Aibekov, a sole trader (OSVČ) registered in the Czech Republic, IČO 29522471, with a place of business at Příčná 1892/4, 110 00 Praha. You can contact us at hello@implenova.ai.
We are the data controller for personal data collected through this website. For personal data you (as a customer) put into the Implenova product about your own clients and projects, we act as a data processor on your behalf — see "Data we process on behalf of customers" below.
This policy explains what personal data we collect, why, on what legal basis, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Czech data-protection law.
What we collect and why
Information you give us directly. When you request access, join a waitlist, contact us, or sign up, we collect the information you submit — typically your name, email address, company name, and anything you write in a message. We use this to respond to you, manage early access, provide the service, and communicate with you about it.
Legal basis: performance of a contract or steps taken at your request before entering a contract (Art. 6(1)(b) GDPR); and our legitimate interest in responding to enquiries (Art. 6(1)(f)).
Marketing communications. We do not currently send marketing email, and the product sends no email of any kind. If we introduce it, we will ask for your consent first, name the provider in this policy, and include an unsubscribe link in every message.
Legal basis: your consent, if and when you give it (Art. 6(1)(a) GDPR).
Technical and usage data. When you visit the site we may collect limited technical data such as IP address, browser type, device information, and pages viewed. We measure aggregated site usage — page views, referring website, approximate location (country, region and city), browser and operating system and version, device type, and whether a pilot request form was successfully submitted (the fact of the submission only, never its contents) — using Vercel Web Analytics, provided by our hosting provider Vercel Inc. This measurement sets no cookies and stores nothing on your device: your IP address and browser details are converted into an anonymous identifier when the request is received and are not retained in identifiable form, and you are not tracked across other websites. See our Cookie Policy.
Legal basis: our legitimate interest in understanding, securing and improving our website (Art. 6(1)(f)); your consent for any non-essential cookies (Art. 6(1)(a)).
Account and billing data (for customers). If you become a paying customer, we process account details and billing information needed to provide and bill the service.
Legal basis: performance of a contract (Art. 6(1)(b)); compliance with legal/accounting obligations (Art. 6(1)(c)).
Data we process on behalf of customers (product data)
When you use Implenova to run implementation projects, you may input data about your projects, your organisation, and your own clients — which can include personal data of individuals (for example names and contact details of client staff). For this data, you are the controller and we are the processor. We process it only to provide the service to you and on your documented instructions. We offer a data processing agreement covering this relationship — request it at hello@implenova.ai and we will execute it before onboarding.
Connecting a client's Odoo instance. If you connect an Odoo system, we authenticate to it using credentials you supply and read configuration and usage information from it into our database, so that the copilot can reason about the live system. This means the product also reads data out of that system, not only what you type in. The Odoo API keys you supply are encrypted before storage and are never returned to your browser.
How long product data is kept. Project data is kept for as long as your workspace exists; we do not delete it automatically. Deleting a project removes its records from our database. If you close your account, contact us at hello@implenova.ai and we will delete your workspace and its files — we do this manually today and will confirm completion in writing. Deleted data may persist in encrypted database backups until those backups expire.
Use of AI providers
To deliver the service, Implenova sends content you provide to third-party artificial-intelligence providers, which act as our sub-processors: Anthropic, PBC (the Claude models used to generate responses) and Voyage AI, a MongoDB company (the embedding models used for search and retrieval). This includes the full extracted text of documents you upload and the messages you write in the product; we do not currently redact or filter that content before it is sent.
Where this processing happens. It takes place in the United States. Anthropic operates its API from the United States and does not offer an EU endpoint for it, and Voyage AI may transfer and process data in the United States. Your data is stored in the EU (see "Where your data lives"), but AI processing is not.
Training. Anthropic's Commercial Terms state that Anthropic may not train its models on customer content submitted through its API. Voyage AI's terms permit training by default; we have exercised Voyage's organisation-level opt-out, so content we send to Voyage is not retained after processing and is not used to train its models. We do not train any models of our own on your data, and we do not permit any provider to do so.
Transfer safeguards. Anthropic's data processing agreement is incorporated into its Commercial Terms and applies the European Commission's Standard Contractual Clauses. Voyage AI does not currently offer a data processing agreement; we are pursuing one and will update this policy when that changes.
Who we share data with
We do not sell your personal data. We share it only with:
- Service providers (sub-processors) who help us operate:
- Railway Corporation (United States) — hosts the application and the managed PostgreSQL database, in Railway's EU West region in Amsterdam.
- Cloudflare, Inc. (United States) — Cloudflare R2 object storage for documents you upload and PDFs the product generates, on Cloudflare's EU-jurisdiction endpoint.
- Anthropic, PBC and Voyage AI (United States) — the AI models described above.
- Google LLC (United States) — web fonts loaded by the application, which discloses your IP address and browser details to Google. No project content is sent.
- Vercel Inc. (United States) — hosting and cookieless usage measurement for this marketing website only. Vercel holds no product data.
- Formspree, Inc. (formspree.io, United States) — receives the contents of forms submitted through this website in order to deliver them to us.
- Authorities, where required by law.
A current list of sub-processors is available on request at hello@implenova.ai.
Where your data lives
The application and its database run in Railway's EU West region in Amsterdam. Documents you upload and PDFs the product generates are stored in Cloudflare R2 on Cloudflare's EU-jurisdiction endpoint. AI processing is the exception: as described under "Use of AI providers", it takes place in the United States.
International transfers
Some of our providers process data outside the EEA. Where they do, we rely on mechanisms recognised under GDPR, such as an adequacy decision or Standard Contractual Clauses. Anthropic's data processing agreement applies the European Commission's Standard Contractual Clauses. Voyage AI does not currently offer a data processing agreement; we are pursuing one.
How long we keep data
We keep personal data only as long as necessary for the purposes above: enquiry and waitlist data for as long as needed to handle your request and a reasonable period after; customer account and billing data for the life of the contract and as required by Czech accounting and tax law; marketing data until you withdraw consent. We review and delete data we no longer need; we do not currently run automated deletion, and deletion is performed manually on request at hello@implenova.ai.
Your rights
Under GDPR you have the right to: access your data; rectify inaccurate data; erase data; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing). To exercise any of these, contact hello@implenova.ai.
You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz).
Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
Changes
We may update this policy from time to time. The "Last updated" date shows the latest version, and material changes will be communicated where appropriate.
Contact
Questions about this policy or your data: hello@implenova.ai.
← Back to home