Let’s talk

Privacy and enquiries

This notice explains how we handle personal data when you visit shortfridays.com or contact us about our work. Individual apps have their own privacy notices. Visiting this website does not create an app account.

Who is responsible

Short Fridays s.r.o., náměstí 14. října 1307/2, Smíchov, 150 00 Praha 5, Czech Republic, company ID (IČO) 30191441, registered in the Commercial Register maintained by the Municipal Court in Prague, section C, file 458775, is the controller responsible for this processing.

For privacy questions or requests, email [email protected]. Effective date: 27 October 2026.

When you visit the website

Cloudflare delivers and protects the website. It processes technical information such as your IP address, requested page, request time and browser information to send you the page and detect misuse. Our legal basis is our legitimate interest in operating a secure, reliable website, under Article 6(1)(f) GDPR.

The website has no account registration or contact form. We do not use advertising trackers. Our legal basis for optional analytics is your consent under Article 6(1)(a) GDPR. Optional analytics starts only after you explicitly accept it in Analytics settings. If the website does not offer this choice, measurement is off. Declining or closing the controls does not start measurement or limit use.

After acceptance, we record the page type, language, an approved campaign code and selected completed actions. A random session identifier in sessionStorage expires after 30 minutes of inactivity. We do not send full URLs, email contents, names or contact details. An email click is not a received enquiry. localStorage remembers your choice and its version for up to 180 days. You can withdraw consent in Analytics settings at any time without affecting the lawfulness of processing before withdrawal. Waiting events are removed immediately. Analytics events are kept for up to 90 days. Private statistical summaries and the minimal pseudonymous link needed to erase their contribution have no fixed expiry while needed to understand the service’s development. These records are not necessarily anonymous. An erasure request is retried when connectivity fails. Minimal consent and erasure records remain while needed to demonstrate the choice and prevent erased data from being reimported or restored. They are not used for optional measurement. Ordinary business records have a separate purpose.

If you accept the expanded measurement after a new consent request, we also record screen and viewport dimensions in CSS pixels, recognised device type and manufacturer, browser, operating system, language, time zone, approximate country, region and city from verified delivery-provider data when available, referring website domain and pre-approved campaign codes including campaign keywords. Unknown values remain unknown. We do not obtain organic search queries or precise location. We retain these expanded details for up to 90 days and do not add them to long-term statistical history. An earlier consent does not enable this expanded collection.

Cloudflare may set the strictly necessary cf_clearance cookie after a security challenge is completed. The challenge passage is set to 30 minutes. It supports protection against abuse, not optional analytics. Our analytics uses the browser storage described above.

When you contact us

We use your email address, name if supplied, message, attachments and correspondence details to understand your enquiry and reply. Sending an initial enquiry is voluntary. Without contact details and enough information about your request, we may be unable to reply or assess it. You do not need to provide a full specification.

If you ask us to take steps towards a contract with you personally, the legal basis is Article 6(1)(b) GDPR. For general questions and contacts acting for another business, it is our legitimate interest in answering relevant enquiries and managing business relationships, under Article 6(1)(f).

We do not add you to a marketing mailing list because you contacted us. Please keep an initial enquiry to the information needed to discuss the work. Do not include passwords, identity documents or health information.

Who helps us handle data

The founder currently uses existing personal service accounts for company work. Authorised people and these providers can access data as needed for their tasks. We may also disclose relevant records to professional advisers or authorities when necessary to meet a legal obligation or establish, exercise or defend a legal claim.

Our legal basis for AI-assisted review and drafting is our legitimate interest in handling relevant business enquiries efficiently under Article 6(1)(f) GDPR. We limit task context to the correspondence needed for the enquiry and exclude unnecessary sensitive information. You can object to this use for reasons relating to your situation. AI assistance does not make decisions about you that have legal or similarly significant effects. It does not authorise a contract or send a reply on its own.

Processing outside the EEA

Our providers operate internationally. Personal data may be processed outside the European Economic Area, including in the United States and Australia. Fastmail’s published processing terms and Cloudflare’s data processing addendum include standard contractual clauses for relevant transfers. OpenAI’s Europe privacy policy describes reliance on adequacy decisions or standard contractual clauses for its onward transfers. Ask us at [email protected] for information about applicable safeguards and how to obtain a copy. OpenAI also accepts safeguard requests at [email protected]. EU hosting locations do not mean that every provider operation remains in the EU.

How long we keep data

Our retention rule for a closed enquiry that does not become a project is no more than 12 months after the last substantive exchange. We review correspondence and related working copies monthly, prepare removal by that limit and obtain individual approval for each deletion. This is a manual procedure, not an automatic purge or an assurance that every provider copy disappears immediately. A later unsent draft does not restart the period. Continuing enquiries and project records are reviewed for their separate purposes. If a project begins, we explain the retention of relevant contract, delivery and accounting records for that relationship.

We may retain necessary records longer where a specific legal duty or legal claim requires it. We restrict their use to that purpose and delete them when the reason ends. The applicable legal basis is Article 6(1)(c) for a legal duty, or Article 6(1)(f) for our legitimate interest in protecting legal rights.

Website security logs, email backups and AI task records have separate storage and deletion arrangements. Fastmail describes a seven-day restore window for deleted messages and drafts. It does not guarantee a physical purge deadline for some backup and search-index copies. Deleting an email does not by itself delete a separate AI conversation, local task record or other copies. Related AI task records and separately saved working copies are included in our enquiry review. Archiving a task does not delete it. OpenAI’s personal-service policy allows retention for service provision, safety, security and legal purposes. Its published deletion rule generally allows up to 30 days after deletion, with stated exceptions. Cloudflare’s processing terms retain service data until the service ends or processing is no longer needed for the parties’ service obligations, whichever comes first, subject to legal requirements. These provider rules are separate from our active-copy review. We identify residual copies when handling a deletion request.

Your choices and rights

You can ask us for access to your personal data, correction of inaccurate data, deletion or restriction of processing. You can object, for reasons relating to your situation, to processing based on legitimate interests. Where the legal conditions apply, you can receive data you provided in a portable format.

Send your request to [email protected]. We may need proportionate information to verify your identity. We respond without undue delay, normally within one month. If a lawful extension is needed, we explain it within that first month. This is the statutory privacy-request procedure, not a promised response time for business enquiries.

You can complain to the Czech Office for Personal Data Protection (ÚOOÚ), or another competent data protection authority. You do not have to contact us first.