Effective 2 October 2026
Privacy
This Policy explains how Cusu handles personal data when you visit the website, use the platform, or communicate with us. It also distinguishes situations in which Cusu determines the purposes of processing as a controller from those in which it processes Customer data only on the Customer’s instructions.
1. Who Is Responsible for the Data
The controller of data relating to website visitors, platform users, prospects, and business contacts is David Vurbs, Company ID 05405289, VAT ID CZ9601251671, Horní Slivno 25, 294 79 Horní Slivno, Czech Republic. The privacy contact is hello@cusuai.com. For messages and other end-customer data processed through the widget or integrations, the controller is generally the business that deployed Cusu, and Cusu acts as its processor.
2. Data We Process
Depending on how the Service is used, we may process identity and contact data (name, email, telephone number, organisation), account and sign-in data, profile image, billing and transaction data, support communications, Service settings, technical and security data (IP address, browser, device, time, and event records), and usage data. Valid payment card details are processed by Stripe and are not ordinarily stored by Cusu.
3. End-Customer Data
Depending on the Customer’s configuration, the widget and integrations may process a visitor identifier, external customer ID, name, email, telephone number, gender and other customer attributes, message and note content, attachments, links, conversation history, reactions, connected-tool outputs, and voice transmission or its transcript. Where the Customer enables partners, related ticket context may also be included in outbound partner messages. The Customer determines the scope and is responsible for the lawful basis, transparency, and data-minimisation settings. End users should normally direct their requests to that business.
4. Partner Communications
If the Customer enables partner features, Cusu may, on the Customer’s instructions, email Customer-configured partners and include end-customer or ticket data necessary for that communication. Those partners are recipients designated by the Customer, not Cusu suppliers chosen for Cusu’s own purposes. The Customer remains responsible for telling end customers about such disclosures where required, for the lawful basis of the disclosure, and for any agreement with the partner. Cusu processes that transmission as a processor for the Customer and does not decide independently whom to contact as a partner.
5. Purposes and Legal Bases
We process user data primarily to enter into and perform the agreement, create and secure accounts, provide support, bill Customers, and operate the Service. We rely on legitimate interests for abuse prevention, Service protection, limited operational measurement, and the establishment or defence of legal claims, in each case after considering the impact on individuals. We retain accounting and tax records to comply with legal obligations. Product marketing is sent only on the basis of separate consent, which may be withdrawn at any time. End-customer content is processed on behalf of the Customer to provide the Service under its documented instructions, including partner outreach the Customer enables.
6. Use of Artificial Intelligence and Voice
Conversation content may be sent to selected AI and voice providers where necessary for a feature enabled by the Customer, including drafting or summarising messages for end customers or partners. Current providers may include Anthropic, OpenAI, and ElevenLabs. Cusu does not use Customer conversation content to train general-purpose AI models and selects and configures suppliers so that they do not use it for such training. Cusu itself does not make decisions producing legal or similarly significant effects for an end user without the Customer’s involvement.
7. Cookies and Local Storage
The website derives its language from the browser and stores a locale cookie only when a visitor changes the language. Website analytics (Aptabase, EU) does not use cookies or local storage; the session remains in browser memory only. The widget on this website and on the Customer’s website may use a cusu_vid identifier and local storage to preserve a visitor and conversation history. The platform uses cookies necessary for sign-in and security, including a secure HttpOnly refresh cookie and a temporary OAuth cookie. The Customer is responsible for appropriate notice and for obtaining consent on its website where required.
8. Recipients and Suppliers
We disclose data only to personnel and suppliers who need it for the relevant purpose. Current categories and providers include hosting, databases, and object storage on Zerops; website analytics through Aptabase in the EU; AI services from Anthropic and OpenAI; voice services from OpenAI and ElevenLabs; payments through Stripe; sign-in through Google; transactional and channel email infrastructure (including Plunk and Customer-configured sending domains or mailboxes); and integrations selected by the Customer. Where the Customer enables partners, end-customer or ticket data may also be disclosed by email to those Customer-designated partners. Data may also be disclosed to advisers, public authorities, or an acquirer of the business where necessary and legally permitted.
9. Transfers Outside the EEA
The principal application infrastructure is operated in the European Union. Some suppliers may process data in the United States or other countries outside the European Economic Area. In that case, we require appropriate safeguards under GDPR, including an adequacy decision, the EU–US Data Privacy Framework, European Commission Standard Contractual Clauses, and supplementary technical and organisational measures where appropriate. A Customer-configured partner may be located outside the EEA; any such transfer is determined by the Customer’s choice of partner and remains the Customer’s responsibility as controller.
10. Retention
We retain account and operational data for the contractual relationship and afterwards only as necessary to settle obligations, protect legal rights, or comply with law. When an account is terminated, active copies of Customer conversations and attachments are deleted or anonymised without undue delay. Residual copies may remain in secured backups for up to 30 days and are not used in the ordinary course. Accounting and tax records are retained for the period required by law. Marketing consent is recorded until withdrawal and thereafter only to the extent needed to demonstrate that the opt-out is respected.
11. Security
We use technical and organisational measures appropriate to risk, including access controls, separation of Customer accounts, encryption in transit, secure authentication, widget-origin restrictions, audit records, backups, and ongoing maintenance. No system can be guaranteed absolutely secure. Customers must protect credentials and integration secrets and report incidents promptly.
12. Your Rights
Depending on the circumstances, you may have the right to confirmation and access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent at any time without affecting prior lawfulness. Send a request to hello@cusuai.com; we may reasonably verify your identity first. If a request concerns another business’s widget, we will forward it to the relevant controller or direct you to it.
13. Complaints and Supervisory Authority
We encourage you to contact hello@cusuai.com first. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz, or the supervisory authority for your habitual residence, place of work, or place of the alleged infringement.
14. Changes to This Policy
We may update this Policy when the Service, suppliers, or legal requirements change. The current version and effective date will always be published here. Registered users will be informed by email of material changes at least 15 days in advance unless law or an urgent security situation requires a shorter process. The Czech version prevails in the event of inconsistency.
David Vurbs, a sole trader, Company ID 05405289, VAT ID CZ9601251671, registered office at Horní Slivno 25, 294 79 Horní Slivno, Czech Republic
hello@cusuai.com