1. Controller and contact
Mirabilia s. r. o., Brodská 6, 841 04 Bratislava, Slovakia, company identification number 47 518 316, registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, file 94107/B ("Mirabilia", "we"), is the controller of personal data processed through Flawian.
Privacy requests: support@flawian.com. Telephone: +421 948 233 312.
2. Data we process, purpose and legal basis
We process only data needed for the following purposes:
| Data | Purpose | GDPR legal basis |
|---|---|---|
| Email address, display name, account ID, credentials or Google sign-in identifiers | Create, authenticate, secure and administer the account | Contract; legitimate interests in security |
| Company profile and wizard answers | Provide and personalize the requested decision-support service through Mirabilia's rule-based evaluation engine | Contract |
| Saved free-check result: email, optional name, free-check answers and result, and the source or campaign of the link you arrived through | Send the saved result with a registration link so you can continue without starting over | Consent; legitimate interests (source and campaign) |
| Account-linked rating and optional feedback text | Understand use and improve Flawian internally | Legitimate interests; you may object |
| Subscription, transaction and Paddle customer references | Provide paid access, reconcile orders, support billing and comply with accounting law | Contract; legal obligation; legitimate interests |
| Login, security, device, IP and application logs | Protect Flawian, prevent abuse and diagnose errors | Legitimate interests in security and reliability |
| First-party usage events, including the pages visited and the IP address and approximate location of a visit | Understand and improve product use | Consent |
| Email, company profile and use of Flawian | Send and tailor marketing or product messages | Separate consent |
| Support and privacy correspondence | Answer requests, resolve issues and establish legal claims | Contract; legal obligation; legitimate interests |
Providing account and service data is necessary to deliver the requested features. If it is not provided, the relevant account or feature cannot operate. Marketing is optional and refusal does not affect the service.
3. What you must not submit
Do not enter personal data about other people or special-category, highly sensitive, confidential or unlawfully obtained personal data into the company profile, wizard or feedback. The product does not automatically recognize every such entry. If you submit it despite this rule, contact us promptly so we can assess and remove it where appropriate.
4. How the evaluation works
Your profile and answers are evaluated by Mirabilia's own rule-based, deterministic engine on Mirabilia's EU infrastructure. The engine applies fixed, configured rules; it does not learn from your data, and the same answers always produce the same result. Flawian does not use automated processing to make legal or similarly significant decisions about individuals.
5. Recipients and providers
Access is limited to authorized Mirabilia personnel and providers that need the data for their assigned purpose:
| Recipient | Role and purpose | Main location/status |
|---|---|---|
| Hetzner | Hosting and database infrastructure | EU |
| Paddle | Independent merchant of record for paid orders; payment, tax, invoice, billing and refund administration | International; Paddle's own notice applies |
| Google account sign-in, if you choose it | International; safeguards apply | |
| Google reCAPTCHA | Bot and abuse prevention on registration, password-reset and free-check forms | International; safeguards apply |
| Migadu | Sending account, security and purchase e-mail; receiving and storing e-mail you send to our flawian.com addresses | Switzerland (EU adequacy decision) |
Mirabilia operates its own monitoring and error tracking. Backups are kept by Mirabilia on a portable device in Slovakia that is normally offline, stored in a locked location and accessible only to Mirabilia.
We do not sell personal data for money and do not share it with advertising networks. No advertising or third-party analytics technology is used; should one be introduced, it will be added to this notice and to the Cookie Settings and used only after your consent.
We may also disclose the minimum necessary information to professional advisers, authorities or counterparties where required by law, to establish legal claims, or in a corporate transaction subject to appropriate safeguards.
6. International transfers
Google may process sign-in and reCAPTCHA data outside the EU/EEA, including in the United States. We rely on an adequacy decision where available, including a valid EU-US Data Privacy Framework certification, or the European Commission's Standard Contractual Clauses with supplementary safeguards as required. Paddle processes billing data under its own notice as an independent merchant of record. Contact us for information about the relevant safeguard.
7. Retention
We retain data only for the purpose and period below, then delete or irreversibly anonymize it unless a legal hold requires longer retention:
| Record | Retention |
|---|---|
| Account identifiers and credentials | While the account is active; removed when the verified account-deletion workflow completes, except narrowly retained evidence below |
| Company profile, wizard answers and evaluation results | While needed to provide the active business account; after account deletion, deleted, anonymized, unlinked or retained under the relevant organization's authority according to the record's purpose and legal obligations |
| First-party analytics events | Up to 180 days; the IP address and approximate location of a visit up to 30 days |
| Feedback | While useful for documented product improvement or until a successful objection, then deleted or anonymized |
| Saved free-check result not converted into an account | Up to 365 days after the request |
| Marketing-consent and withdrawal evidence | At least 4 years after withdrawal, or longer if needed for a live claim |
| Minimal contract, acceptance, security and legal-claim evidence | Up to 5 years after the relationship or relevant event |
| Accounting and transaction records | 10 years where Slovak accounting law requires it |
| Offline backups | Rolling maximum of 1 year; deletion takes effect as backups expire unless restoration is required earlier |
Deletion of an account does not retain the whole account for five years. Only the minimal evidence needed for law, security or claims is separated and restricted. If an old backup is restored, deletion requests recorded since that backup are reapplied.
8. Cookies and similar technologies
Flawian uses strictly necessary technologies without consent where permitted. They support authentication, security, load management, consent choices and core service operation. Blocking them may prevent the service from working. Google reCAPTCHA loads only when you submit a protected form and is used solely to prevent abuse; Paddle's checkout script loads where prices are shown (the pricing section of the home page and the billing page) and when a Paddle payment link opens the home page, to show prices and run the checkout.
First-party analytics events are recorded only after your consent. They measure visits and account-linked product events; no advertising or third-party analytics technology is used. Cookie Settings let you reject optional technologies as easily as accept them and later change your choice.
Flawian stores the following in your browser. We do not place an optional technology before the corresponding consent; withdrawing consent deletes the analytics identifiers and does not affect earlier lawful processing.
| Name | Purpose | Duration | Consent |
|---|---|---|---|
| FlawianAuth (cookie) | Keeps you signed in | 30 days, renewed while you use Flawian | Not required (strictly necessary) |
| .Flawia.Antiforgery (cookie) | Protects forms against requests sent from other sites | Until you close the browser | Not required (strictly necessary) |
| Temporary sign-in cookies | Complete a Google sign-in you started | For the sign-in step | Not required (strictly necessary) |
| flawia_consent_given, flawia_consent_categories, flawia_consent_timestamp (browser storage) | Remember your cookie choice | Until you change it or clear browser data | Not required (strictly necessary) |
| flawia_language, theme, flawia-color-theme (browser storage) | Remember your language and appearance | Until you change them or clear browser data | Not required (your choice) |
| wizard_draft, wizard_offline_queue and similar working entries (browser storage) | Keep unsaved answers, your place on a page and what changed since your last visit | Until saved or replaced, the end of the browser session, or clearing browser data | Not required (strictly necessary) |
| flawia_analytics_anonymous_id, flawia_analytics_acquisition_context, flawia_session_id, flawia_analytics_stitch, flawia_landing_view entries (browser storage) | First-party usage measurement | Until you withdraw consent or clear browser data; session entries until you close the browser | Analytics consent |
Flawian does not currently treat a browser Do Not Track setting as a separate consent instruction; use Cookie Settings to control optional technologies. Paddle and Google may receive information across services when you use their checkout, sign-in or security features, as described in their notices.
9. Emails
Service emails necessary for the account, security or purchase do not require a marketing subscription. This includes a single reminder about an action you started yourself, such as confirming your email address or returning to a result you asked us to save, even before you have an account. If you are on a paid plan, a weekly check-in about your own plan is part of the service; you can turn it off at any time with one click or in Settings. Marketing is limited to recipients for whom we have the required separate permission, and each message has an unsubscribe method. Subject to that choice, automated or manually selected messages may use the account email, company profile and activity within Flawian to make the message relevant. We do not use unrelated external profiling data for this purpose.
10. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. The account provides self-service export and deletion controls; you may also email support@flawian.com. We may verify identity and will respond within the legally required period.
You may complain to your local supervisory authority. Mirabilia's lead contact is the Office for Personal Data Protection of the Slovak Republic, Galvaniho 7/B, 821 04 Bratislava, Slovakia (dataprotection.gov.sk).
11. Security
We use access controls, transport protection, tenant isolation in the database, offline backups, operational monitoring and other measures proportionate to the risk. No system is completely secure. Notify support@flawian.com immediately if you suspect unauthorized access.
12. Children
Flawian is for persons aged 18 or older. We do not knowingly offer it to children. Contact us if you believe a child has provided data.
13. Changes
We may update this notice to reflect legal, provider or product changes. The current version and effective date are published here, and material changes are notified through the service or by email where appropriate.