The Petr Macek & Co. s.r.o. organization, ID: 04075081 (hereinafter Petr Macek & Co.), which develops and operates the Caflou website and application, declares that all personal data of users and visitors are considered confidential and this data is handled in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Czech law.

Caflou is fully prepared for GDPR. More information is here: https://www.caflou.com/gdpr

We do not sell personal data of our users and we do not share them with third parties, except for the service providers (sub-processors) listed below, which process data on our behalf solely to operate the Caflou service. No personal data are used or will be used for marketing purposes. Data obtained through Google APIs are subject to additional rules described in the section Google User Data.

Where are personal data saved?

All data (including user and account data in the Caflou application) and users’ personal data are stored centrally in safe repositories that are located in the European Union or the USA. Data do not in any way leave the European Union or the USA and are not kept anywhere outside the European Union or USA. 

We have valid data processing agreements with all partners. These are prominent and reliable partners that are registered in the Czech Republic, EU, or USA. They process data only on our instructions and may not use them for their own purposes. 

  • 1 
    • Technology: Amazon Web Services
    • Supplier: Amazon Web Services, Inc.
    • Location of data: EU
    • Contact: 410 Terry Ave North, Seattle , WA 98109-5210 , USA
    • Purpose: Application databases, back-up
  • 2 
    • Technology: DigitalOcean
    • Supplier: DigitalOcean
    • Location of data: EU
    • Contact: 101 Avenue of the Americas, 10th Floor, New York, NY 10013, USA
    • Purpose: Application server, back-up
  • 3 
    • Technology: Mailgun
    • Supplier: Mailgun Technologies
    • Location of data: USA
    • Contact: 535 Mission St., 14th Floor San Francisco, CA 94105, USA
    • Purpose: Sending system e-mails
  • 4 
    • Technology: Intercom
    • Supplier: Intercom, Inc.
    • Location of data: USA
    • Contact: 55 2nd St., 4th Fl., San Francisco, CA 94105, USA
    • Purpose: Communication with application users
  • 5 
  • 6
    • Technology: Zoho Sign
    • Supplier: Zoho Corporation B.V.
    • Location of data: EU
    • Contact: Beneluxlaan 4B, 3527 HT Utrecht, The Netherlands
    • Purpose: Electronic signing of documents, if the authorized user sent the document for digital signature
  • 7
    • Technology: OpenAI API
    • Supplier: OpenAI, L.L.C.
    • Location of data: USA
    • Contact: San Francisco, CA, USA
    • Purpose: Processing of user requests in the Caflou AI features, only when the user uses the AI features; Zero Data Retention – data are not stored by OpenAI after processing and are not used to train OpenAI models

More information on security can be found here: https://www.caflou.com/security/

Google User Data

This section describes how Caflou accesses, uses, stores and shares data obtained from Google APIs when a user signs in with Google or connects a Google account to Caflou (“Google User Data”).

What Google User Data do we access?

  • Google Sign-In (basic profile and e-mail address): your name, e-mail address and profile picture, used to create, identify and sign in to your Caflou account and to identify the connected Google account.
  • Gmail: Caflou includes an in-app e-mail client. If you connect a Gmail mailbox, Caflou reads e-mail messages, their metadata (sender, recipients, subject, date), labels and attachments in order to display them in Caflou and link them to contacts, companies, projects and tasks; modifies messages at your request (e.g. marking as read/unread, changing labels, archiving, moving to trash); and sends e-mails on your behalf when you send or reply to them from Caflou.
  • Google Calendar: if you connect a calendar, Caflou reads, creates, updates and deletes calendar events in order to synchronize them in both directions between Caflou and Google Calendar.
  • Google Drive: if you connect Google Drive, Caflou accesses the files and folders in your Drive in order to let you, at your request, search, open, attach and link files to projects, tasks and other records in Caflou, and to create, edit, move and organize your Drive files through Caflou project workflows and the Caflou AI assistant. This applies to your existing Drive files, not only to files created by Caflou. Caflou accesses Drive files only in response to an action you initiate.

Caflou accesses only the data needed for the features you choose to enable. Connecting a Google account and each Google service is always voluntary and initiated by the user.

How do we use Google User Data?

Google User Data are used solely to provide and improve user-facing features of Caflou that are visible in the user interface – in particular the in-app e-mail client (displaying, organizing and sending your e-mails and linking them to contacts, companies, projects and tasks), two-way calendar synchronization, and working with your Google Drive files in projects, tasks and through the Caflou AI assistant. We do not use Google User Data:

  • for serving advertisements, including retargeting, personalized or interest-based advertising;
  • for determining credit-worthiness or for lending purposes;
  • for any purpose unrelated to the features described above.

Our employees do not read your Google User Data, unless (a) you give us explicit consent to do so for a specific message (e.g. when requesting support), (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data are aggregated and anonymized and used for internal operations.

With whom do we share, transfer or disclose Google User Data?

We do not sell Google User Data. We do not share, transfer or disclose Google User Data to any third party, except in the following cases:

  • Infrastructure sub-processors: Google User Data are stored and processed on servers of Amazon Web Services, Inc. (application databases and back-ups, location EU) and DigitalOcean (application servers and back-ups, location EU), solely to operate Caflou. These providers act only on our instructions under data processing agreements and have no right to use the data for their own purposes.
  • AI assistant provider: when you use the Caflou AI assistant to work with your Google Drive files (or other connected Google data), the content needed to fulfil your specific request is sent via the OpenAI API to OpenAI, L.L.C. (location of processing: USA) solely to generate the response or perform the action you requested. OpenAI processes this data only on our behalf under a data processing agreement, does not use it to train its models, and – under the Zero Data Retention arrangement we have in place – does not store it after the request has been processed.
  • Within your Caflou account: data from a connected Google account are visible to other users of your Caflou account according to the access rights set by you or your account administrator.
  • Legal requirements: if required by applicable law or by a valid request of a public authority, or if necessary to protect the security of Caflou and its users.
  • Business transfers: in connection with a merger, acquisition or sale of assets, with prior notice to users; the recipient remains bound by this Privacy Statement.

Google User Data are not shared with Mailgun, Intercom, Salt Edge, Zoho or any other provider not listed in this section. E-mails you send from Caflou through a connected Gmail account are sent via the Gmail API, not via third-party e-mail services.

AI / ML models

The Caflou AI assistant uses Google User Data only to carry out the specific request of the user who is using it, and only within that user's own account. We do not use Google User Data, including data obtained through Google Workspace APIs, to develop, improve or train generalized or non-personalized artificial intelligence and/or machine learning models, and we do not allow our AI provider to do so.

Limited Use

Caflou's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion of Google User Data

Google User Data are kept only as long as necessary to provide the features you use. You can disconnect your Google account in Caflou at any time; Caflou then stops accessing your Google account. Data already synchronized into Caflou can be deleted by you at any time in the application, and are deleted when you delete your Caflou account; they are removed from back-ups within 30 days. You can also revoke Caflou's access at any time at https://myaccount.google.com/permissions or request deletion of your data at support@caflou.com.

What personal data do we collect?

Petr Macek & Co. reserves the right but is not obliged to collect the following data. All data below are considered to be confidential and are subject to these terms and conditions of the protection of personal data.

  1. User data
    • E-mail of the user – during registration (mandatory and necessary for use of the account, signing in to the application); if the user registers via his/her Facebook profile or Google account, the e-mail is obtained from that account
    • Name and surname of the user – voluntary; the system does not request data (the system uses data to personalize the account and communication) 
    • Data from connected Google accounts – only if the user connects them; see Google User Data
  2. Account data (this concerns invoicing data that we use only for invoicing for using of the service/application (in the event of voluntary upgrade to a paid package); it is personal information in the case of a physical person)
    • Company name or personal name – mandatory only for paid accounts
    • Address – mandatory only for paid accounts
    • ID and VAT ID no. – not mandatory
    • Invoicing e-mail – mandatory only for paid accounts
  3. Petr Macek & Co. uses third party payment gateways for certain types of payments (e.g. payment by credit card). If the user uses payment by credit card, via PayPal, or another payment method, the numbers of credit cards or other sensitive payment information are in all cases processed by the payment gateway of the third party. Petr Macek & Co. does not save credit card numbers or any other sensitive payment information and has no access to them.
  4. Personal data of visitors: Visitors to the caflou.com website may enter their personal data into the live chat either directly in the conversation or can be requested to fill in data before the conversation begins.
  5. Technical data: Certain technical data on users and visitors such as IP address, type of internet browser, type of operating system, approximate location, etc., may be automatically obtained and collected by Petr Macek & Co. This information is not used for identification of any person.

Caflou application users can store data in the application including personal data (and the personal data of third party entities). The Client (user/owner of the account in the Caflou application) continues to be the administrator. The Client is not freed of the responsibility for the processing of personal data by using the Caflou application.

How are personal data secured?

Petr Macek & Co. protect personal data of users via modern industry standards. Security of data and information stored on user accounts is described in detail on the Security page or at https://www.caflou.com/security. Caflou has successfully completed the independent ADA CASA security assessment required by Google for applications accessing restricted Google API scopes.

  • Our employees are aware of the necessity to secure data and are trained in data protection; we require two-phase authentication to access all our systems
  • We protect all data with strong security and these data are stored in safe repositories; we exclusively use an HTTPS encoded connection
  • For user access to the application, strong passwords are required, which are encoded and may not be retrieved; voluntary two-phase authentication is available 
  • You will find three levels of security in the application: 
    1. User log-in
    2. User authorization for the account
    3. User rights in the account and in objects

Editing of or access to personal data on the part of the user is always allowed only after logging in to the account of Caflou’s Service at app.caflou.com.

How do we use cookies?

While using Caflou’s services and products, temporary files called “cookies” may be saved which may contain data on the visitor. While processing cookies, the personal data of the visitor may be linked to information contained in the cookie. These data are used exclusively for purposes of improving Caflou’s service. Petr Macek & Co. respects the privacy of its users and adheres to relevant laws while processing cookies.

The visitor may prevent cookies from being saved by opening the Caflou website in an anonymous mode. Anonymous modes are supported by all modern internet browsers and no cookies are collected in this mode. While using an anonymous mode in the browser, the full functionality of Caflou’s products and services may not be ensured and using these products and services in such a way may lead to non-standard behavior.

How can personal data be edited or deleted?

After logging in to their account at https://app.caflou.com, the user can edit or delete any data, delete his/her profile, or delete his/her account.

At the user’s request, we can:

  • Delete the user’s personal data (deleting the profile, account)
  • Hand over personal data to the user 
  • Inform the user on how we use personal data
  • Correct the user’s personal data 
  • Stop using data for direct contact
  • Stop processing/using the user’s personal data
  • Stop using messages based on “profiling” and use of the application

Requests can be sent to support@caflou.com; we may request authentication of identity based on information available to us. 

The process of complete deletion of a Caflou profile and/or account is irreversible and is carried out only at the request of the user. The user may be requested by Petr Macek & Co. to authenticate ownership of the profile and/or account according to the data entered during registration.

If a visitor to the caflou.com website wants to delete specific personal data concerning their person, they can send a request to support@caflou.com. The visitor may be called upon to prove their identity to authenticate that the personal data do in fact relate to their person.

General Terms and Conditions

Use of Caflou’s Service conforms to the General Terms and Conditions that can be found at https://www.caflou.com/general-terms-and-conditions.

Final Provisions

Petr Macek & Co. reserves the right to edit this document on the protection of personal data and general terms and conditions without prior notice. Users and visitors can always find the current version of the general terms and conditions and updated information on the protection of personal data at https://www.caflou.com.

Last update: 11. 10. 2026.