This page explains what personal data Smart Library processes, why, how long we keep it and what rights you have. It covers the website, the app and the connector through which AI assistants such as Claude or ChatGPT connect to the library.
Effective from 28 October 2026. The Czech version prevails.
Who is responsible for your data
The controller is SWEHQ s.r.o., company ID 06756107, registered at Beníškové 1285/11, Košíře, 150 00 Prague 5, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, section C, file 288006. For anything about personal data, write to smart-library@swehq.com.
Your account
- What we keep: the name and email Google or Apple give us when you sign in, when you signed up and last signed in, your subscription or trial, and your app settings.
- Why: so you can sign in and use the service as your subscription allows.
- Legal basis: we can’t provide the service without it (performance of a contract, Art. 6(1)(b) GDPR).
- How long: as long as you have an account. If you ask us to close it, we delete the data within 30 days.
The terms of service cover the rules for your account, the trial and subscriptions.
Signing in
To recognise you, your browser stores sign-in cookies. Signing in doesn’t work without them, so they need no consent. A sign-in lasts 30 days, then you sign in again.
The Google and Apple sign-in buttons load straight from those companies, so they see your IP address and browser type. Their own privacy policies explain what they do with it.
Chat and search in the app
- What we keep: your chat questions and the answers, including the library passages an answer is based on, how you rated the answers, and what your questions cost. We don’t keep what you type into search.
- Why: so you can come back to your chats, so we can enforce your spending limit, and to improve the answers.
- Legal basis: providing the service; improving the answers is our legitimate interest (Art. 6(1)(f) GDPR).
- How long: as long as you have an account. We delete chats when the account is closed.
The answers are written by language models from Google (Gemini) or OpenAI, so we send them the text of your question. For search by meaning, we send the search terms to OpenAI, which turns them into a form we can compare with the library’s text.
Please don’t put clients’ names, national ID numbers or patients’ health data into questions. We don’t need them to answer.
Connecting an AI assistant
You can connect the library to your AI assistant, such as Claude or ChatGPT. You confirm the connection with us. The assistant can then only search and read the library, never change it. After 30 days you confirm the connection again.
We don’t see your conversation with the assistant. We only get what the assistant sends us when it uses the library, such as what it searches for.
- What we keep each time the library is used:
- your account and the app the assistant came from,
- what the assistant searched for or read,
- a short note from the assistant on why it uses the library (we ask it to leave out names of people), and which model it is,
- a conversation label, so we can tell which requests belong together,
- which documents the assistant got (without their text), how long it took and whether there was an error,
- technical details of the connection, such as the IP address and the app’s name, never passwords or keys,
- which document you opened from a link in the assistant’s answer,
- feedback the assistant sends us, for example that something was missing from the library.
- Why: to keep the service running and secure, to charge usage, and to add to the library what people look for and can’t find.
- Legal basis: providing the service; security and improving the service are our legitimate interests.
- How long: 90 days, then the records are deleted automatically.
Search terms go to OpenAI, just as with search in the app. We don’t use connection data for advertising or to build profiles, and we don’t sell it.
You disconnect the assistant in its settings. If you want us to revoke its access on our side too, write to us. The assistant’s provider explains in its own policies what happens to data inside the assistant.
Analytics
If you agree, we use PostHog to see which pages and features are used. The data is stored in the EU (Frankfurt). If you don’t agree, we only count the visit anonymously. The Cookies page has more and lets you change your choice.
- Legal basis: your consent (Art. 6(1)(a) GDPR and § 89(3) of the Czech Electronic Communications Act). You can withdraw it at any time. Counting a visit anonymously without consent is our legitimate interest in knowing how many people visit.
- How long: 1 year.
Server logs
For every request, our servers note the IP address, the time and the page visited. We need this to deal with errors and attacks. We delete these logs after 90 days at the latest.
Error reports
When something goes wrong in the app or on a server, a report goes to Sentry, an error monitoring tool we run ourselves on servers in the EU. The report describes the error, where in the program it happened and how long each step took. If you’re signed in, it carries your account’s internal number and your kind of access, not your name or email. Your questions, texts, documents and IP address are never put in a report.
- Legal basis: our legitimate interest in keeping the service running and fixing its errors (Art. 6(1)(f) GDPR). Error reports from the browser are necessary for the app to work, so they need no consent (§ 89(3) of the Czech Electronic Communications Act). Nothing is stored in your browser.
- How long: 90 days, after which reports are deleted automatically.
Who receives your data
Only companies that help us run the service get data:
- a hosting provider (servers in the EU): the service runs on its servers,
- OpenAI (USA): language models; gets the text of questions and search terms,
- Google (USA): Gemini language models, which get the text of questions, and Google sign-in,
- Apple (USA): Apple sign-in,
- PostHog (data in the EU): analytics; without your consent only an anonymous count of the visit.
Under their terms, neither OpenAI nor Google uses the text of questions to train their models. They keep it only briefly to detect abuse, OpenAI for 30 days at most. We don’t sell personal data or use it for advertising.
Transfers outside the EU
OpenAI, Google, Apple and PostHog are US companies. Transfers to the USA follow rules approved by the European Commission: the EU–US Data Privacy Framework or standard contractual clauses.
Your rights
You can ask us:
- what data we have about you, and for a copy,
- to correct inaccurate data,
- to delete your data, including closing your account,
- to restrict processing,
- to hand over your data in a common format, so you can take it elsewhere.
You can object to processing we do out of legitimate interest. You can withdraw consent at any time; processing before the withdrawal stays lawful.
Write to smart-library@swehq.com, and we reply within a month. If you’re not satisfied with us, you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
Automated decisions
No computer makes important decisions about you on its own, without a person involved, and we don’t profile you.
Security
Connections to the service are always encrypted. Scripts on the page can’t read the sign-in cookies, and AI assistant connections are secured with the OAuth standard.
Changes
If we start handling data differently, we update this page and the date at the top. We point out important changes in the app.