Mountable Privacy Policy

1. Who we are

WriteIt.ai s.r.o., ID No. 04518136, with its registered office at Na Folimance 2155/15, Vinohrady, 120 00 Prague 2, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 247717 ("we" or "us"), operates Mountable (mountable.io, the "Service"). We are the controller under the GDPR (Regulation (EU) 2016/679) for the processing in this Policy, except for the files described in section 3. Contact us about this Policy or your rights at support@mountable.io or by post at our registered office.

This Policy covers website visitors, people who sign in to the Service or are invited to it, members of customer organisations, billing contacts, and anyone who contacts us. Section 3 explains our different role for files that customers store. Terms with capital letters have the meaning given in the Terms of Service.

2. What we process and why

We receive invitation email addresses, assigned roles and organisation details from the customer organisation or from the member who invites you. An organisation may also give us its billing and contact details, which can be about you. Sign-in identity data comes from the identity provider you select. Technical and usage records are generated through use of the Service.

Card details are entered directly with our payment processor. We do not receive full card numbers.

We may also use any of this data where needed to comply with the law or to establish, exercise or defend legal claims. The legal basis is then a legal obligation or our legitimate interest.

You do not have to give us your data, but we need sign-in data to give you an account and billing data to provide paid use. Without them we cannot provide the Service.

3. Files that customers store

Files, paths and file metadata stored in the Service ("Customer Content") may contain personal data. For that data, the customer that stores it is the controller, or a processor acting for its own controller. We are its processor or sub-processor. We process it under the processing terms in section 18 of the Terms, only to provide the Service, and not for our own purposes. The customer decides what to store and who can access it. It is also responsible for informing the people concerned and for having a lawful basis.

If your personal data is in an organisation's files, please contact that organisation. If you contact us instead, we may forward your request to the organisation or help it to respond.

4. Who receives data

We do not sell personal data. We share it only as follows:

• Our staff and contractors who need it for their work and are bound by confidentiality.
• Service providers acting for us: hosting and data-centre providers, cloud storage and backup providers, software development and automation platforms that run our deployment and backup jobs, DNS and network providers, monitoring and error-tracking providers, our website analytics provider, and email and support providers.
• The identity provider you choose for sign-in. It receives your sign-in request and gives us your identity data under its own privacy terms.
• Our payment processor, which processes billing and payment data for us. It may also act as an independent controller for its own fraud prevention and legal obligations.
• Other members of your organisation, who can see your name, email address, role, and the API keys and sessions you create, to the extent the Service shows them.
• Professional advisers such as accountants, auditors and lawyers, and tax authorities.
• Authorities and courts, where the law requires it or where it is needed to protect rights, safety or the Service.
• A buyer or successor in a merger, acquisition, reorganisation or sale of our business.

On request, we tell you the names of the current recipients.

5. Transfers outside the EEA

Some recipients, or their own providers, may process personal data outside the European Economic Area, including in the United States. Where the destination country has no adequacy decision of the European Commission, we rely on appropriate safeguards. These are usually the Commission's standard contractual clauses, or the EU-U.S. Data Privacy Framework for certified recipients. You can ask support@mountable.io for details and a copy of the safeguards.

6. Infrastructure and governmental access

This section gives the information required by Article 28 of the EU Data Act.

• Jurisdictions. The runtime and database infrastructure of the Service is in Germany. Service backups are stored with Google Cloud in Belgium. Backup copies made by the database host are stored with Google Cloud in the European Union.
• Backup transfer. Service backups are transferred to that storage by automation run by GitHub, Inc., a United States company. We cannot choose where it runs, so it may run outside the European Economic Area. The safeguards offered in GitHub's data protection terms apply to it (the EU-U.S. Data Privacy Framework or standard contractual clauses). When GitHub's service is unavailable, the transfer can instead run on infrastructure we operate in Germany.
• Measures against conflicting governmental access. Access to systems and data is limited to authorised personnel, and data is encrypted in transit. We disclose data to a public authority only in response to a legally binding request. We review each request for its legality and disclose only the narrowest data the request requires. We inform the affected customer before disclosure, where the law allows.

7. How long we keep data

We keep personal data only as long as the criteria below allow, then delete or anonymise it.

• Account and organisation data, including the sign-up source: while the account or organisation exists. After that, until the limitation period for claims arising from the Agreement ends, or until a pending claim is finally resolved.
• Billing and accounting records: for the periods required by Czech accounting and tax law, which can be up to 10 years from the end of the relevant tax period.
• Rate-limit records derived from IP addresses: about 30 days.
• Other technical and security logs: until newer log entries overwrite them under a fixed size limit. Records needed for a specific recorded security investigation are kept until it is closed and any resulting claim is resolved.
• Communications and notices: until the request or notice is resolved, then until the limitation period for related claims ends.
• Customer Content: until the customer deletes it through the Service or its erasure request is completed, and as described in sections 12 and 18.2 of the Terms. Deleting a filesystem or an organisation in the console ends access, but does not by itself erase stored files. To request erasure, contact support@mountable.io.
• Backups: service backups include Customer Content. We normally retain one successful daily checkpoint from each of the latest two backup dates, deleting older service checkpoints after a replacement succeeds. If backups fail, we retain the last successful copies while investigating the failure. The shared database host's backup copies of our databases are kept for up to 60 days and then deleted automatically. Backup retention does not suspend erasure obligations. Where erasure from a backup copy is not technically feasible, the copy is kept out of use and deleted when that backup expires.

Copies kept under a specific legal duty, such as for a claim or an authority's order, are restricted to that purpose and erased when the duty ends.

8. Your rights

Under the GDPR you have the right to access your personal data and the right to have it corrected or erased. You can also ask us to restrict its processing, ask for data portability, and object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time; this does not affect processing before the withdrawal.

Send requests to support@mountable.io or to our registered office. We may need to verify your identity. We respond within the time limits of the GDPR.

You may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz) or to the supervisory authority where you live or work.

9. Automated decisions

The Service applies some contract rules automatically: access permissions, quotas and rate limits, and restricting features when invoices are overdue. These rules are needed to perform the contract. You can ask a person to review such a decision, give your view or contest it by writing to support@mountable.io. We do not use profiling.

10. Security

We use technical and organisational measures appropriate to the risk, for example access controls, encryption in transit and short-lived credentials. No system is completely secure, and we cannot guarantee absolute security. Customers are responsible for protecting their own Credentials. If a personal data breach occurs, we notify the supervisory authority and the people affected where the law requires.

11. Cookies

Cookies and similar storage are used without consent only where they are needed to transmit a communication or are strictly necessary for a feature you expressly request. Other cookies require your prior consent where the law requires it.

• Sign-in: a cookie that secures the sign-in transaction expires after 10 minutes.
• Console session: the session cookie expires after 7 days. Server-side access also ends after 24 hours of inactivity.
• Website analytics: we measure visits to our website with PostHog, hosted in the European Union, in cookieless mode. It sets no cookies and stores nothing in your browser's local or session storage: it only checks storage is available by writing and immediately deleting a fixed test value. To count unique visitors without storing an identifier on your device, PostHog computes on its servers a hash of your IP address and browser user agent with a value that changes every day, so a visit cannot be linked to visits on other days. IP addresses are anonymised and not stored with the analytics data. Page addresses are recorded without sign-in codes or other parameters, except campaign (UTM) parameters. We do not use analytics to identify you or to build a profile of you.
• Sign-up source: when you create an account, we store with it the referring website's domain and the campaign (UTM) parameters of the visit that led to it, or that the visit was direct. The website passes them to sign-in in the page address, not in a cookie or browser storage. An existing account keeps the source recorded when it was created.
• Card form: the card form is provided by Stripe and loads only when you add a card. Stripe may set payment and fraud-prevention cookies on our site and on its own domains. Their names, purposes and durations are described in Stripe's cookie policy.

12. Children

Accounts and direct use of the Service are restricted to people aged 18 or over. This does not prevent a customer from storing personal data about children where it has a lawful basis and complies with applicable law. Such data is processed under section 3 and the processing terms. If we learn of an ineligible account, we may restrict or close it and handle its personal data under applicable law and the retention rules above.

13. Changes

We may update this Policy. We publish each version with its effective date, and we notify you of material changes where the law requires.