Privacy Policy — sulla.work
Effective date: 25 August 2026
This Privacy Policy explains how we process personal data when you visit sulla.work, create an account, or use the SULLA service (the "Service") — an API that lets you add an AI assistant to your product.
1. Who we are (data controller)
Ing. Andrej Arťuchov, a sole trader (OSVČ) registered in the Czech Republic
Business ID (IČO): 05846757
Registered office: Přemyslovská 1925/40, Žižkov, 130 00 Praha 3, Czech Republic
Contact for privacy matters: support@sulla.work
We have not appointed a data protection officer; given the scale of our processing, we are not required to. You can reach us about anything in this Policy at the address above.
2. Two roles: our data and your users' data
- We act as controller for data about you: site visitors, account holders, and people who contact us.
- We act as processor for content that your application sends to the Service on behalf of your end users. You (our customer) are the controller of that data; we process it only to provide the Service, under the data-processing terms in our Terms of Service, section "Data processing on your behalf". Your end users should be informed by your privacy policy, not this one.
3. What we process, why, and for how long
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data — email address, password credentials, account settings | Creating and operating your account | Art. 6(1)(b) — contract | Life of the account; deleted within 30 days of closure, except records listed below |
| Billing records — top-up amounts, bank transfer reference, payer name and account number as shown on our bank statement, invoices where issued | Receiving payments, accounting and tax compliance | Art. 6(1)(c) — legal obligation (Czech accounting and tax law); Art. 6(1)(b) | Up to 10 years, as required by Czech tax and accounting legislation |
| Usage and metering data — API request metadata, token counts, timestamps, API key identifier | Metering prepaid credits, preventing abuse | Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interest (service integrity) | 3 years (Czech civil limitation period for billing disputes) |
| Assistant configuration and your own test content — assistant instructions (prompts), messages you send from your own account | Providing the Service | Art. 6(1)(b) — contract | Until you delete them or close the account |
| Server logs — IP address, browser user agent, request timestamps | Security, fault diagnosis | Art. 6(1)(f) — legitimate interest | Up to 12 months |
| Support correspondence — your messages to support@sulla.work and our replies | Handling your requests | Art. 6(1)(b) or 6(1)(f) | Up to 3 years after the last contact |
We do not collect data from third-party sources about you. We do not use your content to train AI models.
4. Recipients and sub-processors
We share personal data only with the providers we need to run the Service:
| Provider | What for | Location | Transfer safeguard |
|---|---|---|---|
| OpenAI Ireland Ltd (and OpenAI affiliates) | AI model inference — the content of assistant conversations is sent to the model provider to generate replies | Ireland / USA | EU Standard Contractual Clauses incorporated in OpenAI's Data Processing Addendum |
| Stripe Payments Europe, Ltd / Stripe, Inc. | Card payment processing (from the date card payments become available) | Ireland / USA | EU–U.S. Data Privacy Framework (Stripe, Inc. is an active participant) |
| Hetzner Online GmbH | Hosting of the website, the Service and our self-hosted email infrastructure (including the support@sulla.work mailbox) | Germany (EU) | Processing within the EU/EEA — no third-country transfer |
Our bank processes the data accompanying your bank transfer as an independent controller under payment regulation; it does not act on our instructions.
We do not sell personal data and do not share it with advertisers.
5. Transfers outside the EEA
Where a provider above processes data in the United States, the transfer is protected by the safeguard listed in the table: the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) or the EU–U.S. Data Privacy Framework adequacy decision (Art. 45 GDPR). You can request details or a copy of the relevant safeguard at support@sulla.work.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, where processing is based on consent — withdrawal does not affect processing before it (Art. 7(3)).
To exercise any right, write to support@sulla.work. We respond within one month.
You also have the right to lodge a complaint with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz.
7. Automated decision-making
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Credit metering is mechanical billing arithmetic, not profiling.
8. Cookies
The site uses only cookies strictly necessary for it to work; there are no analytics or marketing cookies and no tracking. Details: Cookie Notice.
9. Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact support@sulla.work and we will delete it.
10. Changes to this Policy
If we change this Policy, we will publish the new version on this page with a new effective date and, for material changes affecting account holders, notify you by email before they take effect.
This document was prepared as a good-faith disclosure based on a documented checklist. It is a working document of the site operator, not legal advice, and does not replace review by a qualified lawyer in your jurisdiction.