Privacy Policy

Last updated: 7 August 2026

This Privacy Policy explains how inovativa s.r.o. ("Inovativa", "we", "us") collects and processes personal data in connection with the AI Studio (a small set of openly-disclosed AI character accounts that we operate on Instagram) and the website at studio.inovativa.cz.

Every account we operate is clearly labelled as an AI character and is not a real person. We comply with the transparency requirements of the EU AI Act and with the EU General Data Protection Regulation (GDPR).

1. Who we are (data controller)

inovativa s.r.o.
IČO: 22443622
Registered office: Eliášova 964/24, 160 00 Praha 6, Czech Republic
Email: info@inovativa.cz

A list of every AI character we operate is published at https://studio.inovativa.cz/about/ai-characters.

2. What this policy covers

This policy covers personal data we process when you:

• send a direct message (DM) to one of our AI character accounts on Instagram;
• comment on, are tagged in, or are mentioned in posts on those accounts;
• visit our website at studio.inovativa.cz.

It also describes how we handle the access credentials for the Instagram Business accounts that we ourselves operate.

3. What data we collect

Direct messages. When you send a DM to one of our accounts, we receive and store the content of your message and your Instagram username so that we can prepare and approve a reply, together with the identifiers needed to deliver that reply. To classify and route messages we also keep a hashed form of your user identifier. The content of incoming messages is processed by an AI provider for two purposes: to classify the message, and to draft a reply in the character’s voice (see Section 7). So that a reply follows on from what was already said, the last few messages of the same conversation are read alongside it — always within the ninety-day window in Section 8, after which the conversation is deleted. We do not build advertising or marketing profiles from your messages, or any other summary of you as a person; we work with the messages themselves, not with a profile assembled from them.

Comments. Where you comment on, tag, or mention one of our accounts, we process the comment so we can moderate it under our published comment policy and, where appropriate, post a human-reviewed reply.

Account information. For the Instagram Business accounts we operate, we read basic account information (account ID and username) to associate activity with the correct AI character.

Website data. Our website does not use analytics, tracking, advertising pixels, or cookies. We do not profile visitors.

We never collect or store special-category data (data revealing health, beliefs, ethnicity, sexual orientation, and similar). We do not knowingly process such data, and our systems are not designed to classify it.

4. Why we process it and our legal basis

You can object to processing based on legitimate interest at any time (see Section 9).

5. AI transparency

All content on our accounts (images and captions) is generated by the studio and reviewed by a human Content Safety Officer before it is published or sent. Posts carry Instagram's AI label, and the first reply to any DM contains an explicit statement that you are talking to an AI character. We never impersonate real people, and nothing is ever published to a feed without human approval.

For direct messages, the content of your message is processed by an automated (AI) system that classifies it and drafts a reply. By default every reply is approved by a person, and an individual character may be allowed to answer the safest kind of message on its own (an ordinary compliment, an on-topic question). Even then, messages the system reads as sensitive — distress, repeated boundary-testing, crisis signals — are never answered automatically and always reach a person.

An automated reply has no legal or similarly significant effect on you: it decides nothing about access to a service, pricing, or anything comparable. It is therefore not automated decision-making within the meaning of Article 22 GDPR. You can always write again or ask to speak to a person.

6. How we store and protect your data

• Our servers and database are located in Germany (European Union). The database is self-hosted and is not exposed to the public internet.
• Access tokens for the accounts we operate are encrypted at rest and are automatically refreshed before expiry and deleted when an account is disconnected.
• Every change to our data is recorded in an audit log that contains identifiers only, never raw message contents, and an automated integrity check runs regularly to detect any accidental exposure of personal data.
• Access to systems is restricted to authorised studio personnel.

7. Who we share data with

We do not sell your personal data. We share it only with:

• Meta Platforms Ireland Ltd. / Meta Platforms, Inc., as the operator of Instagram, through which all interactions take place;
• Anthropic, PBC (United States), processes the content of incoming messages in order to classify them and to draft a reply, under a data-processing agreement;
• Slack (Salesforce, Inc., United States), receives short message excerpts and a partial, hashed identifier for our internal escalation alerts;
• Hetzner Online GmbH (Germany, EU), hosts our servers and database.

Anthropic and Slack are located in the United States. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses. Our hosting and database remain within the EU.

8. How long we keep your data

Access tokens are deleted as soon as an account is disconnected. The content of your messages and the related conversation data is automatically deleted 90 days after we receive it, or sooner if you ask us to delete it (see Section 10). Audit records (which contain only internal identifiers and counts, never the content of your messages) are kept for 3 years, or 7 years for records relating to safety-critical (crisis) situations, to meet our accountability and legal obligations, and are then automatically deleted. You can request deletion of your personal data at any time, and we will action it as described below.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate data;
• request erasure ("right to be forgotten");
• request restriction of processing;
• object to processing based on legitimate interest;
• request data portability;
• withdraw consent at any time, without affecting prior processing.

To exercise any of these rights, contact us at info@inovativa.cz. You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.gov.cz.

10. Deleting your data

You can have your data deleted in two ways:

1. Remove the app's access: disconnecting our app deletes the stored access token and pauses the related account activity.
2. Send a data-deletion request: we will delete the relevant access token and your associated message events and responses, and return a confirmation code together with a status link. Data-deletion requests are handled at: https://api.studio.inovativa.cz/api/v1/auth/meta/data-deletion

11. Children

Our accounts and website are not directed at children under the age required by Instagram's terms in your country, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where changes are material, provide a more prominent notice.

13. Contact

Questions about this policy or about how we handle your data:
inovativa s.r.o., info@inovativa.cz, Eliášova 964/24, 160 00 Praha 6, Czech Republic