Privacy notice for administration users
Status: draft for legal review. English translation of Privacy_admin_users_hr.md. If the two differ, the Croatian text prevails. The text describes how the platform works on 24 October 2026. The technical descriptions must stay true: when the platform changes, this text changes too. Items marked [CHECK] depend on facts not yet confirmed.
This notice does not replace the visitors' notice (/Privacy). For visitors, the institution is the controller and Smak kolektiv d.o.o. only the processor.
1. Who this is for
This notice is for people who open an account on the Aristoqle platform or work in it for an organisation, as owners or editors ("you").
The notice for visitors who play the content is on the Visitors' privacy page (/Privacy).
2. Controller
Smak kolektiv d.o.o., [address], OIB [ ]
Privacy contact: [e-mail] [CHECK: same address as PRIVACY_CONTACT]
3. What we process
| When | Data |
|---|---|
| Sign-up | the organisation's name and web address; the kind of organisation (e.g. museum, heritage, nature), if you choose one; your first name, surname and e-mail address; your password, only as an irreversible cryptographic record (PBKDF2, 600,000 iterations); the chosen language; version and time of accepting the terms of use; the web page and campaign you came from, if the link carries them |
| Your account | username; role (owner or editor); time the e-mail address was confirmed; time of the last password change; whether you have been shown the guided tour of the administration; a technical session marker, which changes when the password or role changes |
| If you enter them | title, position, phone, mobile |
| Work in the administration | who started an AI generation, when, which step and what it cost; who marked content as verified or returned it to draft, and when; who granted credit |
| Quote request | the organisation's legal name and address, country, VAT number and the result of its check in the VIES system (the name and address VIES returns, the consultation number), the e-mail address for invoices, whether a purchase order is needed, the name of an EU project, the wished start and your description of your needs; who sent the request |
| "Report a problem" | the kind of report (something does not work, a question, an idea) and your text; the page you were on, the error reference (if you sent it from an error page), the browser and the language; your username and e-mail address, to which we reply |
| Errors you see | when the application shows you an error with a reference: the reference, the time, the page address, your username and organisation, the kind and description of the error |
| Abuse prevention | a pseudonymised record of the network you signed up from (see point 5); a pseudonymised record of your e-mail address and domain once a starting credit is granted; counters of sign-in and sign-up attempts, in memory only |
| Server logs | a shortened IP address. The full address is recorded only briefly, on a technical error |
We do not collect date of birth, home address, location or card payment data.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Opening and running the account, sign-in, address confirmation, password reset, providing the service | performance of a contract (1.b) |
| Charging AI credit and paid plans; reminders that a plan ends | performance of a contract (1.b) |
| A quote for a paid plan, at your request | steps prior to entering a contract (1.b) |
| Checking the VAT number in VIES; invoices and accounting records for paid plans | legal obligation (1.c) [CHECK: VIES may rather be legitimate interest] |
| Answering your problem report, question or idea | legitimate interest (1.f): supporting users and fixing errors |
| Preventing abuse: multiple free accounts, automated sign-ups, password guessing | legitimate interest (1.f): protecting the service and the costs abuse causes |
| System security and fixing errors | legitimate interest (1.f) |
| Records of who approved AI-generated content | legitimate interest (1.f) of your organisation and of us: editorial responsibility |
| Handling content reports and telling you about content taken off public access | legal obligation (1.c): Digital Services Act (Regulation (EU) 2022/2065), Art. 16 and 17 |
We do not send you marketing without your consent, and we do not sell data.
5. Review before the starting credit is granted
The starting AI credit is granted only after you confirm your e-mail address and a person on our team has reviewed the account. To help with that decision, the platform shows:
- the type of your address's domain: the organisation's own domain, a free mail service (e.g. gmail.com), or a throw-away mailbox service. Public domain lists are used for this;
- the number of other sign-ups from the same network. The network is your IPv4 address or, for IPv6, the first 64 bits of the address. We store neither, only a value computed with a secret key (HMAC). The address cannot be read from it, but it can be compared with other such values. It is deleted after 30 days;
- the number of other organisations with the same domain;
- whether the same address or domain already received a starting credit. To make this possible even after an account is deleted, values computed with a secret key from the address and the domain are stored when a credit is granted. The address and domain are not stored as text. These values are deleted after 3 years.
A person decides, not the system. The platform itself neither refuses nor grants credit. A refused credit does not end the account: it keeps working without artificial intelligence. You may object to this review (point 11).
6. Who receives data
| Recipient | Why | Which data | Where |
|---|---|---|---|
| Hetzner Online GmbH [CHECK] | server and storage | all data in point 3 | [Germany / Finland] [CHECK] |
| Mailjet SAS [CHECK] | sending platform messages | your e-mail address, name and the message | European Union [CHECK] |
| OpenAI [CHECK: legal entity] | AI content generation | only material you send for processing, and a pseudonymised organisation identifier (HMAC) so the provider can limit abuse by one organisation. Your name, e-mail address and username are not sent. | USA |
| European Commission, VIES system | checking the VAT number in a quote request | the organisation's VAT number, and ours as the requester | European Union |
| accountant, tax authority [CHECK] | accounting | invoice data for paid plans | Croatia |
When you start an AI generation, the documents, texts and web pages you name are sent to the AI provider. Do not send material containing personal data you may not pass on.
The administration pages load nothing from other servers: fonts, icons and scripts are served from our own server.
7. Transfers outside the European Economic Area
The AI provider is based in the USA. The transfer relies on [the EU–US Data Privacy Framework / standard contractual clauses]. [CHECK]
8. How long we keep data
| Data | Period |
|---|---|
| The account and sign-up data | while the account exists; after closing or deletion at most 30 days, plus [14] days in backups |
| An account whose address was never confirmed | deleted after 30 days |
| A closed account | deleted with all its content and media 30 days after closing, whether the owner or we closed it |
| The answer to the question when an account is closed (reason, your text, plan, days as a client) | kept after the account is deleted, with no link to the account or a person; do not put personal data in it |
The public demo (/demo): the page address you pasted, the games made from it, and a value computed from your network with a secret key |
the games and the address are deleted after 48 hours, the build record after 3 days; if you open an account, the games move into it |
| Sign-up and usage steps for the funnel (e.g. "confirmed the address", "first unit"; no names or addresses) | while the account exists; after deletion without a link to the account |
| The network record from sign-up | 30 days |
| Address and domain records after a starting credit | 3 years |
| Sign-in and sign-up attempt counters | up to 1 hour, in memory only |
| Records of content approval | while the account exists |
| Records of AI credit use (the cost and charge of each call) and of credit grants | while the account exists; after the account is deleted they stay with no link to the organisation or a person (no username, no notes), to reconcile with the AI provider's invoices |
| A quote request | while the account exists [CHECK: period after the quote has been sent] |
| Problem reports, questions and ideas | 180 days after they were handled |
| Records of errors you saw | 90 days |
| Messages in the sending queue | the recipient's address is cleared as soon as the message has been sent; the message record 30 days |
| Decisions on reported content (a unit taken off and put back on public access, the ground and the reasons) | while the account exists |
| Invoices and accounting records | [11 years] under accounting law [CHECK] |
| Record of accepting the terms | while the account exists and [5 years] after, for possible disputes [CHECK: the platform currently deletes it with the account] |
| Server logs | limited in size (five files of 10 MB per part of the system) and overwrite themselves; the application's log is saved on the server at each update and kept 30 days |
9. Cookies and local storage
The administration uses only necessary cookies:
- Sign-in: remembers that you are signed in. It lasts 8 hours from your last action, or until you sign out.
- Administration language: remembers the chosen language, for up to a year.
- Form security: protects against forged form submissions. It is removed when you close the browser.
For our own administrators only, one more cookie lets them work during maintenance while the platform is closed to others (up to 3 days).
Your browser's storage (not our server) keeps only display settings: the width of the menu, the open branches of the menu, and whether you closed the maintenance notice.
There are no advertising or analytics cookies.
10. Messages we send you
The platform sends only messages needed for the account:
- address confirmation and invitations for new users;
- password reset;
- confirmation that the account was closed;
- notice that AI credit was approved;
- warnings when you near the monthly number of visits the plan includes;
- reminders that the plan ends: 30, 7 and 1 day before, and after it has ended (owners only);
- notice that a unit was taken off public access after a report, with the reasons, and notice that it is available again (owners only);
- the answer to your problem report, question or idea;
- notice of changes to the terms.
Planned maintenance is announced in the administration. The number of messages per recipient per day is limited.
11. Your rights
You may ask for:
- access to your data and a copy of it;
- correction of inaccurate data. You change your e-mail address and password yourself on "My account"; the account owner changes other user details in the user list;
- erasure, where there is no longer a basis for keeping the data;
- restriction of processing;
- portability of data you gave us. You can also download the content of each unit yourself at any time ("Download content": the texts in every language as JSON, and the pictures and sounds), on every plan.
You may object to processing based on legitimate interest (points 4 and 5).
Send requests to [e-mail]. We reply within one month. If you believe your data are not processed lawfully, you may complain to the Croatian Personal Data Protection Agency (azop.hr) or to the supervisory authority in your country.
12. Security
The protection measures are:
- all traffic is encrypted (HTTPS);
- passwords are stored only as an irreversible record;
- each organisation's data are kept separate from the others';
- password guessing is slowed down and temporarily blocked;
- changing a password or role ends other open sessions;
- confirmation and reset links are single-use and time-limited;
- the database is backed up daily.
13. Changes
We change this notice when the way the platform works changes. We inform account owners of significant changes by e-mail.
Applies from [date].