This policy covers the cognivis.ai service and our commercial relationships and operation of the CogniVis Platform. It describes situations in which we determine the purposes of processing ourselves. Guest and employee data processed on behalf of a hotel or other customer is described separately below.
Controller and contact
The controllers are Dawid Adach and Michał Szymański, jointly trading as StartupFlow Dawid Adach, Michał Szymański S.C., ul. Kijowska 7/49, 03-738 Warsaw, Poland, NIP 1132911940, REGON 364673139, under the CogniVis brand. For privacy matters, exercising your rights or reporting incidents, write to support@cognivis.ai. The same address may be used to obtain information about safeguards for transfers of data outside the EEA.
When and what data we receive
- When you visit the website: your IP address, device and browser identifiers, the addresses of pages visited, approximate technical information, security-related events and your cookie choices. Optional analytics, advertising and embedded media operate in accordance with your consent settings.
- When you contact us, book a meeting, register for training, download materials or submit a form: your first name, surname, company, position, email address, telephone number, message and data needed to handle your request. If you use Google Calendar to book a meeting, you also provide data to that tool’s operator.
- When you order the Platform or use a trial: company details, details of its representatives and contact persons, address, NIP/VAT ID, country in which the business is conducted and place where the service is received, selected plan, configuration, and the history of orders, activations, support, payments and invoices. You enter card details in Stripe; we do not receive the full card number or CVC.
- When you have an account or contact support: identification and contact details, permissions, access logs, correspondence and information necessary to resolve the matter.
Data may come directly from you, your employer or a colleague ordering the service, from business correspondence, an enquiry or publicly available information about a company’s representation. If we receive your data from someone else, we limit its scope to what is needed for the business relationship.
Purposes and legal bases
| Purpose | GDPR legal basis |
|---|---|
| Responding to an enquiry, preparing an offer, arranging a meeting and taking steps before entering into a contract | Article 6(1)(b) where you act on your own behalf; otherwise Article 6(1)(f), our legitimate interest in handling the enquiry and the B2B relationship |
| Entering into and performing a contract, a trial, providing an account, support, billing and contact with customer representatives | Article 6(1)(b) for a person who is a party to the contract; for other persons, Article 6(1)(f), the proper performance of the customer relationship |
| Invoices, tax and accounting obligations, and handling legally required requests | Article 6(1)(c) |
| Website and Platform security, preventing abuse, auditing events, and pursuing or defending claims | Article 6(1)(f), protecting the services and the parties’ rights |
| Newsletters and other marketing communications where consent is required | Article 6(1)(a) and the appropriate consent for the communication channel; you may withdraw it at any time |
| B2B contact concerning our offer where separate consent for processing the data is not required | Article 6(1)(f), marketing our own services; we respect any consent required for the particular channel and any objection |
| Optional analytics, advertising and embedded-media cookies | Article 6(1)(a); essential cookies and recording your consent choice: Article 6(1)(f) |
Providing data in a form is voluntary, but without contact details we cannot respond or send materials. An order requires company details, details of an authorised person, the billing address and the data required to determine tax; without these, we cannot accept the order. Data required by tax legislation is mandatory to the extent required by that legislation.
Platform and customer guest data
A hotel or other customer generally determines the purposes and means of handling its guests, people they communicate with and employees. In this respect, it is the controller of the data, while CogniVis acts as a processor on the basis of a data processing agreement and documented instructions. This may include, for example, messages, recordings and transcripts from the AI Phone, documents in the Knowledge Base, or content transferred from the customer’s channels. This policy does not replace the customer’s privacy information for its guests or the data processing agreement. Questions about the content of a conversation, the basis for a recording or rights connected with a stay should first be directed to the property with which you were in contact. We will help it fulfil its obligations. As a separate controller, however, we handle our own commercial relationship, invoices, contact persons’ accounts and the security of our services.
Recipients and providers
Authorised CogniVis personnel and providers have access to data to the extent necessary to fulfil the relevant purpose:
- Stripe handles the payment form, payment method, subscriptions and invoices. Render handles the billing backend and order database; this is not the guest-conversation database.
- Google Workspace, provided in our relationship by Google Cloud Poland Sp. z o.o., is used for email, documents and organising meetings. Booking a meeting through Google Calendar also takes place within Google’s environment.
- Kit (formerly ConvertKit) handles sign-up forms and the sending of materials or newsletters where such a form is made available.
- Website-hosting and security-tool providers and, only following the appropriate consent, providers of analytics, advertising and embedded media. Depending on the page used and your settings, these may include Google, Microsoft Clarity, Meta and YouTube.
- MDBS Dawid Adach, Michał Szymański, Sebastian Kaczmarek s.c. (NIP 1133081877) may support us with individual configurations and integrations, with limited access to the data needed.
Depending on the selected Platform configuration, subprocessors of data entrusted by the customer may include OpenAI Ireland Ltd, Eleven Labs Inc. and Twilio Ireland Limited. Integrations with Meta, such as WhatsApp, Messenger and Instagram, use that operator’s accounts and services; in selected activities, Meta may process data under its own rules. CogniVis’s own servers are located in Warsaw. OVH sp. z o.o. is a possible not currently active provider of backup copies; we do not present it as a current recipient of data. The current list of Platform subprocessors forms part of the applicable data processing agreement.
We also disclose data to public authorities, courts and accountants where this is necessary and legally justified. A payment provider, communication-channel operator or booking tool may also act as a separate controller under its own privacy policy.
Transfers outside the EEA
The mere location of a server in Poland or selection of an EU region does not mean that every operation by a provider remains within the EEA. Support, metadata and certain services may involve access from outside the EEA. If we transfer data to a third country, we use an appropriate mechanism under Chapter V of the GDPR: an adequacy decision, including in relation to an eligible recipient under the EU-US Data Privacy Framework, or appropriate safeguards, such as standard contractual clauses together with any necessary supplementary measures. You may request information about the specific transfer mechanism by email at the address indicated above.
How long we retain data
- We retain enquiry and contact data for the time needed to handle the matter and for any subsequent justified business relationship, and thereafter only for the period necessary to defend or pursue claims.
- We retain contract, account, support and order data for the duration of the service and subsequently to the extent required by law and necessary for possible claims. We retain tax and accounting documents for the statutory period, generally until the tax liability becomes time-barred.
- We retain newsletter data until you withdraw your consent or the mailing ends; data used for legitimate-interest marketing until an effective objection is made or that purpose ends. We retain a minimal record of your refusal so that we can comply with it.
- We retain the cookie-settings record for up to 180 days, unless you change your decision earlier or delete it in your browser. Third-party providers’ cookie periods may differ.
For data processed on a customer’s behalf, the standard data processing agreement separately provides for 30 days for enabled audio recordings and 90 days for text conversations, transcripts and security logs, with the rules for returning, deleting and copying data set out in that agreement. These are not the retention periods for CogniVis invoices or contact data held by us as controller.
Cookies and embedded content
Essential mechanisms ensure that the website operates, maintain security and remember your privacy choices. You may enable the other categories separately: analytics (usage statistics), marketing (advertising measurement and possible matching of advertising audiences) and external media (for example, YouTube videos). By default, you do not consent to these three categories. YouTube video is loaded after consent to media has been given. You may change your settings at any time using the cookie-settings button displayed on the website. Withdrawal of consent applies going forwards; we also try to remove known optional first-party cookies, but cookies set by other domains may require settings with their operators or in your browser.
Your rights
You may request access to your data, its rectification or erasure, restriction of processing and, where the relevant conditions are met, data portability. You may object to processing based on our legitimate interest on grounds relating to your particular situation; you may always object to direct marketing. You may withdraw your consent without affecting the lawfulness of processing carried out before its withdrawal. To exercise your rights, write to support@cognivis.ai. We may ask for information necessary to confirm your identity. We will respond within the period prescribed by the GDPR, generally within one month.
You have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland or another competent supervisory authority in the EEA. More information is available at uodo.gov.pl.
Automated decisions and changes to this policy
We do not make decisions concerning visitors or people purchasing the service based solely on automated processing that produce legal effects or similarly significantly affect them. The price calculator and preliminary tax calculation do not replace verification of an order. If we change this policy, we will publish the new date and content on this page; we will notify the appropriate people of significant changes requiring separate notification.