Privacy Policy

We respect your privacy. This document explains how we process personal data in line with Regulation (EU) 2016/679 (GDPR).

1. Data controller

The controller is ROOT4U s.r.o., Company ID (IČO) 07669470, VAT ID CZ07669470, registered office Palackého 650, 512 51 Lomnice nad Popelkou, Czech Republic, recorded in the Commercial Register kept by the Regional Court in Hradec Králové, Section C, File 42802. Contact: [email protected], tel. +420 727 970 563, data box rmaqf4f.

2. What data we process and from where

• Registration and account: name, e-mail, company name, Company/VAT ID, password (stored encrypted).
• Billing and operational data entered into the system by the user (documents, contacts, products).
• Technical data: IP address, browser type, cookies and analytics identifiers. Server access logs contain the IP address, date and time of access, the URL visited and the browser identification.
• Payment data to the extent necessary to bill the subscription.

We obtain data directly from you (registration, use of the service) and automatically from your device (technical data, cookies).

3. Purposes and legal bases

• Contract performance — providing the MEFYS service and support (Art. 6(1)(b) GDPR).
• Legal obligations — accounting and taxes (point (c)).
• Legitimate interest — security, abuse prevention and service improvement (point (f)); on this basis we also keep server access logs containing IP addresses (see Section 7).
• Consent — analytics cookies and marketing (point (a)); consent can be withdrawn at any time.

4. Controller and processor roles

For data that a customer (a company using MEFYS) enters about its own clients, the customer is the controller and ROOT4U s.r.o. acts as a processor under a data processing agreement provided on request.

5. Recipients and processors

We disclose personal data only to vetted processors offering sufficient guarantees:

• the server-infrastructure provider (data centre in the EU),
• Cloudflare, Inc. — network and security infrastructure (protection against DDoS and automated attacks): the traffic of both the website and the application passes through Cloudflare servers, which process IP addresses and technical connection metadata in doing so,
• the e-mail service provider,
• Google Ireland Ltd. — Google Analytics web analytics (only after your consent),
• Microsoft Corporation — Microsoft Clarity analytics (only after your consent),
• Web3Forms — delivery and anti-spam protection of messages sent via the website contact form,
• Intuition Machines, Inc. (hCaptcha) — protection of the contact form against bots and spam,
• Anthropic, PBC — MEFYS AI features (AI document extraction and the in-app AI assistant): the content of a document uploaded to AI extraction, or the text of a question asked to the AI assistant together with the data retrieved to answer it, is passed to this AI service provider as a processor. The data is not used by this provider to train AI models.

We do not pass data to other third parties for their own marketing.

AI document extraction: If you use the AI extraction feature, the content of the uploaded document (typically a received invoice or receipt, which may contain the supplier's personal data) is processed by Anthropic, PBC as our processor, solely for the purpose of extracting the data into a document draft. The output is always reviewed and approved by the user.

In-app AI assistant: If you use the built-in AI assistant (“Ask MEFYS”), the text of your question and the data the system retrieves from your company’s records to answer it (e.g. summaries of invoices, contacts or stock, which may contain personal data of your customers and suppliers) are processed by Anthropic, PBC as our processor, solely for the purpose of composing the answer. The assistant only reads data, respects the signed-in user’s permissions and changes nothing in the system. We do not store the content of the conversation — the history exists only in your browser for the duration of your session; we retain only technical usage data (query counts and consumption) to enforce plan limits.

Connecting AI assistants (MCP): If you enable control of MEFYS via an AI assistant operated by a third party (e.g. over the MCP protocol), you originate that access: the personal data you request through the assistant is disclosed to that assistant's provider as a separate recipient chosen by you. MEFYS discloses data only within the scope of the permissions of the access key you created, and you can revoke that access at any time. The user is responsible for the selection and configuration of the third-party assistant.

6. Transfers outside the EU

Some processors (Google, Microsoft, Web3Forms, hCaptcha, Anthropic, Cloudflare) may process data outside the EU. In that case the transfer is safeguarded by appropriate measures, in particular the EU Standard Contractual Clauses.

7. Retention

We keep data for the duration of the contract and further for the period required by law (in particular accounting documents for 10 years). Analytics data are retained for the periods stated in the Cookie Policy. Once the purpose is fulfilled, we delete or anonymise the data.

Server access logs: records containing IP addresses are kept for 14 days and then deleted automatically. They serve solely for security, abuse prevention and operational diagnostics; they are not linked to user accounts and are not part of the application's data export.

8. Automated decision-making and profiling

We do not carry out automated decision-making or profiling that would produce legal effects concerning you or similarly significantly affect you.

9. Your rights

• right of access, rectification and erasure,
• right to restriction of processing and to data portability,
• right to object and to withdraw consent at any time,
• right to lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (uoou.cz).

10. Data Protection Officer (DPO)

Given the nature and scope of processing, we are not legally required to appoint a DPO and none is appointed. For data-protection matters, contact [email protected].

11. Security

We protect data with encryption of transport and passwords, two-factor login, permission management (roles) and database-level isolation of each company’s data. Data is stored in the EU. The service is additionally protected by Cloudflare security infrastructure (protection against DDoS and automated attacks) and by request rate limiting.

12. Contact

For personal-data matters contact [email protected] or see Contact.

Last updated: 31 July 2026.