GDPR
Personal data protection
Information about personal data processing in compliance with GDPR regulations
Data controller
František Sirůčka
Company ID (IČ): 68890559, VAT ID: CZ7409140266, Pod Děvínem 2708/27, 150 00 Prague 5, Czech Republic
What data we process
We only collect data necessary for service operation
Registration data
Email address – used for login, communication and message delivery. Password – stored in secured form (hash).
Operational data
Account creation date and time, last login date, number of sent messages (usage statistics).
Message content
Text messages and files (encrypted in your browser; for password-locked capsules we do not have the key, for capsules without a password we keep the secret from the link encrypted so we can deliver the link), recipients' email addresses and phone numbers if given. When sending without an account, also the sender's name and email and a hashed IP address (for the daily limit).
Analytics data
We use Vercel Analytics for cookieless tracking – tracking only basic metrics without using cookies.
Data processing purpose
What we use your data for
Service provision
Enabling scheduled delivery of encrypted messages and files, user account management and authentication.
User communication
Sending message delivery notifications, expiration reminders, technical service status notifications.
Service improvement
Service usage analysis (without cookies) for performance and user experience optimization.
Legal requirements
Compliance with legal obligations, service abuse prevention, responding to legal requests from authorities.
Cookies and tracking
Cookieless solution for privacy protection
We don't use tracking cookies
We don't use tracking cookies on our website. Instead we use Vercel Analytics, which works without cookies and respects your privacy.
The only cookies we use are technical cookies necessary for login functionality (session cookies from NextAuth.js). These cookies are essential for providing the service and cannot be disabled.
Sharing data with third parties
Vercel
Application hosting, Vercel Analytics (cookieless), Vercel Blob Storage (encrypted files)
MongoDB Atlas
Database for storing encrypted messages and user accounts
Stripe
Payment gateway for processing payments (PCI DSS Level 1 certification)
WebSupport (email) and ClickSend (SMS)
Sending emails and optional SMS notifications; ClickSend receives the recipient's phone number and the message link.
We process data with these providers under their GDPR data protection terms. They receive message and file content from us only in encrypted form.
Your rights
What you can do with your data
Right of access
You have the right to know what personal data we process about you and request a copy of this data.
Right to rectification
You can request correction of inaccurate or incomplete personal data. Email can be changed in account settings.
Right to erasure
You have the right to request deletion of your personal data. You can delete your account directly in settings – everything will be permanently removed.
Right to data portability
You have the right to obtain your data in a structured, commonly used and machine-readable format.
Right to object
You have the right to object to processing of your personal data for reasons relating to your particular situation.
Right to restriction of processing
Under certain circumstances you can request restriction of processing of your personal data.
To exercise your rights, contact us at:
info@timemessenger.euOperational records
What we record so that emails arrive reliably and the service stays secure
Records of emails we send
For every email we send (capsule delivery, account verification, password reset, messages to organisations) we store the recipient address, subject, time sent, the mail server's response and the delivery or bounce status. The capsule content is not part of the record. This is for delivery, troubleshooting and protecting our sending domain. The legal basis is performance of the contract and legitimate interest. We delete these records after 90 days; records of contacting schools are kept together with the outreach record (see below).
Bounces and replies
The info@timemessenger.eu mailbox is read automatically for bounced messages, spam complaints and replies to our emails. We store only what is needed to handle them (address, bounce code and reason, time) and at most 300 characters of a reply. We stop using an address that cannot receive mail or whose owner complained. The legal basis is our legitimate interest in reliable delivery. Retention is the same as for the records of emails we send.
Admin security records
For actions in the service's administration (such as changing settings or issuing an organisation code) we record what happened and when, together with a hash of the IP address. This is for keeping the service secure and investigating unauthorised access. The legal basis is legitimate interest. We delete these records after 12 months.
Data retention period
User account
While the account is active. After account deletion, all data is permanently removed.
Messages and files
Until the expiry date (1 hour to 1 year after delivery, as you choose). They are then deleted automatically; from database backups they disappear once their retention period ends.
Analytics data
Vercel Analytics data is aggregated and anonymous, retained for 90 days.