Privacy Policy
Last updated: 14 June 2026
This Privacy Policy explains how inovativa s.r.o. ("Inovativa", "we", "us") collects and processes personal data in connection with the AI Studio (a small set of openly-disclosed AI character accounts that we operate on Instagram) and the website at studio.inovativa.cz.
Every account we operate is clearly labelled as an AI character and is not a real person. We comply with the transparency requirements of the EU AI Act and with the EU General Data Protection Regulation (GDPR).
1. Who we are (data controller)
inovativa s.r.o.
IČO: 22443622
Registered office: Eliášova 964/24, 160 00 Praha 6, Czech Republic
Email: info@inovativa.cz
A list of every AI character we operate is published at https://studio.inovativa.cz/about/ai-characters.
2. What this policy covers
This policy covers personal data we process when you:
- send a direct message (DM) to one of our AI character accounts on Instagram;
- comment on, are tagged in, or are mentioned in posts on those accounts;
- visit our website at studio.inovativa.cz.
It also describes how we handle the access credentials for the Instagram Business accounts that we ourselves operate.
3. What data we collect
Direct messages. When you send a DM to one of our accounts, we receive and store the content of your message and your Instagram username so that a human reviewer can prepare and approve a reply, together with the identifiers needed to deliver that reply. To classify and route messages we also keep a hashed form of your user identifier. The content of incoming messages is processed by an AI provider to classify it (see Section 7). We do not build advertising or marketing profiles from your messages.
Comments. Where you comment on, tag, or mention one of our accounts, we process the comment so we can moderate it under our published comment policy and, where appropriate, post a human-reviewed reply.
Account information. For the Instagram Business accounts we operate, we read basic account information (account ID and username) to associate activity with the correct AI character.
Website data. Our website does not use analytics, tracking, advertising pixels, or cookies. We do not profile visitors.
We never collect or store special-category data (data revealing health, beliefs, ethnicity, sexual orientation, and similar). We do not knowingly process such data, and our systems are not designed to classify it.
4. Why we process it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Receiving and replying to DMs sent to our accounts | Legitimate interest (operating an account you chose to contact) / your consent in initiating contact |
| Moderating and replying to comments | Legitimate interest in maintaining a safe, policy-compliant account |
| Operating and securing our own accounts | Legitimate interest |
| Responding to data-subject and legal requests | Legal obligation |
You can object to processing based on legitimate interest at any time (see Section 9).
5. AI transparency
All content on our accounts (images and captions) is generated by the studio and reviewed by a human Content Safety Officer before it is published or sent. Posts carry Instagram's AI label, and the first reply to any DM contains an explicit statement that you are talking to an AI character. We never impersonate real people, and there is no path for content or messages to go out without human approval.
To prepare replies, the content of incoming messages is processed by an automated (AI) system to classify it; any resulting reply is always reviewed and approved by a human before it is sent.
6. How we store and protect your data
- Our servers and database are located in Germany (European Union). The database is self-hosted and is not exposed to the public internet.
- Access tokens for the accounts we operate are encrypted at rest and are automatically refreshed before expiry and deleted when an account is disconnected.
- Every change to our data is recorded in an audit log that contains identifiers only, never raw message contents, and an automated integrity check runs regularly to detect any accidental exposure of personal data.
- Access to systems is restricted to authorised studio personnel.
7. Who we share data with
We do not sell your personal data. We share it only with:
- Meta Platforms Ireland Ltd. / Meta Platforms, Inc., as the operator of Instagram, through which all interactions take place;
- Anthropic, PBC (United States), processes the content of incoming messages in order to classify them, under a data-processing agreement;
- Slack (Salesforce, Inc., United States), receives short message excerpts and a partial, hashed identifier for our internal escalation alerts;
- Hetzner Online GmbH (Germany, EU), hosts our servers and database.
Anthropic and Slack are located in the United States. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses. Our hosting and database remain within the EU.
8. How long we keep your data
Access tokens are deleted as soon as an account is disconnected. The content of your messages and the related conversation data is automatically deleted 90 days after we receive it, or sooner if you ask us to delete it (see Section 10). Audit records (which contain only internal identifiers and counts, never the content of your messages) are kept for 3 years, or 7 years for records relating to safety-critical (crisis) situations, to meet our accountability and legal obligations, and are then automatically deleted. You can request deletion of your personal data at any time, and we will action it as described below.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- request rectification of inaccurate data;
- request erasure ("right to be forgotten");
- request restriction of processing;
- object to processing based on legitimate interest;
- request data portability;
- withdraw consent at any time, without affecting prior processing.
To exercise any of these rights, contact us at info@inovativa.cz. You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.gov.cz.
10. Deleting your data
You can have your data deleted in two ways:
- Remove the app's access: disconnecting our app deletes the stored access token and pauses the related account activity.
- Send a data-deletion request: we will delete the relevant access token and your associated message events and responses, and return a confirmation code together with a status link. Data-deletion requests are handled at: https://api.studio.inovativa.cz/api/v1/auth/meta/data-deletion
11. Children
Our accounts and website are not directed at children under the age required by Instagram's terms in your country, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where changes are material, provide a more prominent notice.
13. Contact
Questions about this policy or about how we handle your data:
inovativa s.r.o., info@inovativa.cz, Eliášova 964/24, 160 00 Praha 6, Czech Republic