Privacy Policy

The data controller is MMXXV Labs s.r.o., Company ID No. (IČO) 11945320, VAT ID (DIČ) CZ11945320, registered office at Hasičská 930/53, Hrabůvka, 700 30 Ostrava, entered in the Commercial Register maintained by the Regional Court in Ostrava, Section C, Insert 87316 (hereinafter the "operator").

Contact for everything related to data protection: info@arev.app. The operator has not appointed a data protection officer, as it does not meet the conditions of Article 37 GDPR.

For part of the data, the operator acts in a different role: personal data that a customer enters into the register about their own people or business partners is processed by the operator as a processor for the customer, and is handled only according to the customer's instructions and to the extent necessary to operate the service. The operator will provide a data processing agreement on request.

• Account: first and last name, e-mail, phone (optional), role, application language, date of agreeing to the terms, time of last activity. The password is stored only as an irreversible hash.
• Company: name, company ID (IČO), tax ID (DIČ), registered office, billing address, cost centres and notification e-mails.
• Inspection technician: certificate number and its validity, inspection company, proof of professional qualification uploaded to private storage, image of stamp and signature, price list of services.
• Register and inspections: equipment data, photographs taken during an inspection, inspection reports and equipment record cards including the technician's name, certificate number, stamp and signature.
• Orders and communication: inspection inquiries, messages within an order, a record of contacting the customer.
• Operational records: who performed which action in the application and when, an immutable audit log of changes, feedback submitted through the application's form including an optional screenshot and page address, votes on the public roadmap.
• Technical data: IP address, browser and device type, application error logs.

The operator does not process special categories of data under Article 9 GDPR (health status, biometrics and similar) and they have no place in the application.

• From the user - from registration, their profile and whatever they enter into the application.
• From the public ARES register, when the user has company details filled in automatically based on the company ID (IČO).
• From an inspection technician, when they set up a customer's company on site, or from an e-shop handing over a sold product.
• Automatically from the operation of the application - the technical and operational records described above.

An objection to processing based on legitimate interest can be filed at the contact e-mail.

The application uses only essential cookies: the login session and the saved choice of light or dark appearance. We do not deploy any third-party advertising or analytics cookies, which is why no consent banner is shown either.

We do not sell data or pass it on for third-party marketing. The following processors take part in operating the service:

Only the text of the feedback itself is sent to Anthropic as a processor - never a screenshot or the contents of the register. The data is not used to train models and the model has no access to the database.

Some providers are companies based in the USA. Transfers of data outside the EU take place on the basis of standard contractual clauses under Article 46 GDPR, or on the basis of the EU-US Data Privacy Framework.

We also pass on data only when required by law or requested by a public authority acting within its powers.

By scanning the QR code on the equipment label, anyone can see, without logging in, the item's identification, the inspection result and validity, the name of the company operating the equipment, and the name and certificate number of the inspection technician who issued it. The purpose is so that an inspector at the equipment can verify that an inspection exists and is valid.

The rest of the register, photographs, the technician's stamp and signature, and contact details are not public.

After an account is cancelled, personal data is deleted or anonymised within 90 days, except for data that must be retained by law or as proof of an inspection carried out.

• Each company's data is separated from other companies' data by rules built directly into the database, not just in the application.
• The operator's administrator does not see individual companies' equipment registers or inspections. They work with aggregate numbers and account administration.
• Data transfer is always encrypted (HTTPS). Documents, stamps and photographs are kept in private storage and are only opened through a temporary signed link.
• Passwords are stored as an irreversible hash. The operator does not know them and cannot display them.
• Access by the operator's staff to production data is limited to the necessary minimum and is used only to resolve operational issues.

If a security breach were nevertheless to occur that poses a risk to users' rights, the operator will report it to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) within 72 hours and will inform the affected users.

• Know what data we process about you and obtain a copy of it.
• Have inaccurate data corrected and incomplete data completed.
• Request erasure, if the data is no longer needed and we do not retain it because of a legal obligation or as proof of an inspection.
• Request restriction of processing until an objection or a dispute about accuracy is resolved.
• Receive the data you have provided to us in a machine-readable form and transfer it elsewhere.
• Object to processing based on legitimate interest.
• Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out before that.

You can exercise these rights by e-mail at info@arev.app. We will deal with them within one month; for more complex requests we may extend this period and will let you know why.

You can also file a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, uoou.gov.cz.

We do not carry out automated decision-making with legal effect, nor profiling. A language model is used only to classify feedback on the operator's internal board; a human decides what happens with each piece of feedback.

This policy may change as the service evolves. We will announce a material change by e-mail or in the application in advance.

This is version 1.0, effective from 9. 9. 2026.