Privacy policy
This policy explains which personal data the app processes, why, who we share it with, how long we keep it and what your rights are.
1. Who processes the data
The app is operated by Central Import s.r.o., Company ID 03034399, VAT ID CZ03034399, registered at Husařská 134/8, Libuš, 142 00 Praha 4, Czech Republic, trading as OlympicSoft. Contact for privacy questions: support@olympicsoft.com.
If you use the app within an organisation that set it up for you (for example as an employee), that organisation is the controller of your communication content. We process the data on its behalf and according to its instructions, so you may also contact it about your account and content.
2. Data we process
- Account and sign-in: name, e-mail address and account identifier from the OlympicSoft central sign-in (auth.olympicsoft.com). For a local account, the e-mail and a secure password hash; we never store the password itself.
- Communication content: messages, voice messages, attachments, reactions and read receipts. In shared mailboxes also e-mails (sender, recipients, subject, text and attachments), drafts, labels and mailbox rules. This includes names and e-mail addresses of the people you correspond with.
- Mailbox activity log: who opened, sent or changed a thread. Only mailbox administrators see it, and only if they switch it on.
- Device notifications (only if you turn them on): a Web Push subscription address and encryption keys, or an APNs token and random iOS installation identifier; also your language and notification preferences.
- Technical data: normal server logs (IP address, time and address of the request, browser type) for security and troubleshooting. Who is currently connected is kept only in server memory and is not stored.
- Device settings: a sign-in cookie, a language cookie and appearance settings in local browser storage. We use no advertising or analytics cookies and do not track you across websites.
3. Why we process the data
- To provide chat and mail, i.e. to deliver, store and display messages and e-mails (performance of a contract; when deployed in an organisation, its legitimate interest in working communication).
- For security and reliable operation, protection against abuse and troubleshooting (legitimate interest).
- Device notifications are sent only if you turn them on. You can turn them off at any time in the app (🔔 in chat, account menu → Notifications in mail) or in your phone or browser settings.
We do not sell the data and do not use it for advertising or profiling.
4. Artificial intelligence features
The app lets you communicate with AI assistants and virtual employees and may offer AI-generated reply drafts and e-mail summaries. These features apply only where they are switched on: in a conversation that has an AI participant, or in a mailbox where an administrator enables them. In that case the content of the conversation or e-mail is sent for processing to the language model provider xAI (Grok model).
5. Who we share the data with
When contextual translation is enabled, xAI receives the text being translated, up to 15 preceding messages and their accepted translations, relevant glossary terms and available participant profile details needed for language and addressing. Manage automatic translation, target language and conversation overrides in Account → Translations. Original messages are not rewritten.
The data is processed only by our processors, to the extent needed for operation:
- Contabo GmbH (Germany): servers and backups of the app in the EU.
- Amazon Web Services (Amazon SES, EU – Frankfurt region): receiving e-mails into mailboxes.
- Oracle (Oracle Cloud Infrastructure Email Delivery, EU – Frankfurt region): sending e-mails.
- Notification delivery services of browser and phone makers (Google Firebase Cloud Messaging, Apple, Mozilla, Microsoft). Web Push content is end-to-end encrypted to the device. Native iOS notifications go to Apple APNs over a protected connection, including the title, short preview and conversation link; their content is not end-to-end encrypted against Apple.
- xAI: only when artificial intelligence features are used (see section 4).
Otherwise we share data only where the law requires us to.
6. Transfers outside the EU
The app's servers and backups are in the EU. Some processors (for example Amazon, Oracle, Google, Apple, Microsoft and xAI) are companies based or operating in the USA. Where their services involve a transfer of data outside the EU, it takes place under GDPR safeguards, i.e. a European Commission adequacy decision or standard contractual clauses.
7. How long we keep the data
- Messages, e-mails and attachments for as long as the account or mailbox exists, until you or an administrator delete them. Deleted e-mails stay in the trash for 30 days (the mailbox administrator may change this), spam for 30 days.
- A notification subscription until you turn it off, uninstall the app or the service invalidates it; the record of sent notifications for 7 days.
- Backups are taken daily and rotated; the oldest backup is kept for at most 6 months.
- Server logs only as long as needed for security and troubleshooting.
When an account is closed or the service ends, we delete the data unless the law requires us to keep it longer.
8. Security
Connections to the app are encrypted (HTTPS). Web Push uses end-to-end encryption; native iOS notifications use APNs as described above. The app runs in an isolated environment, only authorised people can access the servers and passwords are stored only as hashes.
9. Your rights
You have the right to access your data and to have it corrected, erased, restricted and ported, the right to object to processing and to withdraw consent (for notifications, simply turn them off). Write to support@olympicsoft.com, or contact the organisation that set the app up for you. We reply without undue delay and within one month at the latest.
You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
10. Closing your account and deleting data
To close your account and delete related data, e-mail support@olympicsoft.com from the address you use the account with (or ask your organisation's administrator). We delete the account and data tied only to you within 30 days. Messages you sent to shared conversations and mailboxes may remain available to the other participants unless the organisation asks otherwise; they disappear from backups within 6 months at the latest.
11. Children
The app is intended for work and business communication and is not intended for children under 15.
12. Communication rules and reporting
Harassment, bullying, threats, hateful or illegal content and spam are prohibited. Select a chat message and choose Report message, or report a user from their profile. Only authorized MSG moderators can view the report and referenced content. They review reports and may hide a message or restrict a user's messaging. Reports include your identity and stated reason and are not visible to the reported user.
A contact's profile lets you block new direct messages in both directions. You can also remove a block in the account menu → Safety and reporting. History and messages in shared groups remain available.
AI translations are disabled without consent. Before content and context are first shared with xAI, a disclosure and explicit confirmation are shown. We record the consent, policy version and withdrawal for your account. Withdraw consent in the account menu to stop new processing; original messages remain unchanged.
13. Changes to this policy
The current version is always available at this address. We will inform you about significant changes in the app or by e-mail.