1. Controller and contact
Mirabilia s. r. o., Brodská 6, 841 04 Bratislava, Slovakia, company identification number 47 518 316, registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, file 94107/B ("Mirabilia", "we"), is the controller of personal data processed through Flawian.
Privacy requests: support@flawian.com. Telephone: +421 948 233 312.
2. Data we process, purpose and legal basis
We process personal data for the following purposes:
| Data | Purpose | GDPR legal basis |
|---|---|---|
| Email address, display name, account ID, credentials or Google sign-in identifiers | Create, authenticate, secure and administer the account | Contract; legitimate interests in security |
| Company profile and wizard answers | Provide and personalize the requested decision-support service through Mirabilia's rule-based evaluation engine | Contract |
| Company profile, wizard answers and evaluation results | Check the quality of the evaluation and develop Mirabilia's rules | Legitimate interests in improving the service |
| If you connect an assistant: the account data it reads on your instruction, including free-text answers; new answers and corrections it sends to be saved to your company profile, which Flawian instructs it to have confirmed in the conversation first; and records of the connection and calls (time, assistant host, tool and result, without their content) | Provide the connection you request: let your assistant read your data, save the answers it sends so your diagnosis can be updated from them, and show you its activity record | Contract, performed on the instruction of the account owner or administrator |
| If you use the free check in your assistant: the questionnaire options your assistant sends, a conversation identifier supplied by the platform or a check key issued by Flawian, and the service making the request | Return your preview and prevent abuse | Legitimate interests in providing the requested preview and protecting the service |
| If you choose to continue on flawian.com: the answer options received in the check, the originating assistant service and a one-time code stored as a hash | Carry your answers to the website without answering again | Steps taken at your request before a contract |
| Saved free-check result: email, optional name, free-check answers and result, and the source or campaign of the link you arrived through | Send the saved result with a registration link so you can continue without starting over | Consent; legitimate interests in knowing which link or campaign a request came from |
| Account-linked rating and optional feedback text | Understand use and improve Flawian internally | Legitimate interests in improving the service |
| Subscription, transaction and Paddle customer references | Provide paid access, reconcile orders, support billing and comply with accounting law | Contract; legal obligation; legitimate interests in reconciling orders and resolving billing questions |
| Login, security, device, IP and application logs, including minimal server page-request logs and declared-robot labels | Protect Flawian, distinguish automated traffic and diagnose service availability and errors | Legitimate interests in security and reliability |
| First-party usage events, including the pages visited and the IP address and approximate location of a visit | Understand and improve product use | Consent |
| Server page-request records and the IP address you register or sign in from | Understand where visits come from and which lead to an account or a purchase | Legitimate interests in understanding how people find and use Flawian |
| Free-check answers and result: when you ask for the result, the answers you chose (not typed text such as a company name) and the result shown, with the IP address and the page, source or campaign of the most recent page opened from that IP address in the hour before, other than one opened from within our site; several people behind one IP address may appear as one | Understand which links bring people who finish the free check and how that compares with sign-ups and purchases from the same IP address | Legitimate interests in understanding and improving how people find and use Flawian |
| Free-check progress, only if you allow analytics: the free-check page, each question as you answer it with your answer, the time it took and how far you got, with the IP address and the source or campaign of the link you arrived through | Understand where people stop in the free check and how that compares with sign-ups and purchases from the same IP address | Consent |
| Visible time and scroll depth, if you allow analytics: for each page, how many seconds it was visible and the furthest quarter of it you scrolled to, added to the server page-request record of your IP address; several people behind one IP address may appear as one | Understand whether visitors leave a page at once or after reading it, and how that compares with sign-ups and purchases from the same IP address | Consent |
| Visible time, scroll depth and the pages opened next, without consent, when our IP-address database places your connection outside the European Economic Area, or in France, the Netherlands, Spain, Italy or Liechtenstein, and you are not signed in, unless you have refused analytics: the visible seconds and furthest scroll quarter of each page, added to the server page-request record of your IP address, and each page you open next inside our site, recorded as a server page-request record like a page load, with the IP address, approximate location and network of the connection; several people behind one IP address may appear as one | Understand whether visitors leave a page at once or after reading it, which pages they go on to, and how that compares with sign-ups and purchases from the same IP address | Legitimate interests in understanding and improving how people find and use Flawian; refusing analytics in Cookie Settings stops it |
| Advertising click and cookie identifiers, page address without account query parameters, and completed purchase transaction reference, amount and currency | Measure Google Ads visits and paid purchases | Separate optional advertising-measurement consent |
| Email, company profile and use of Flawian | Send and tailor marketing or product messages | Separate consent |
| Support and privacy correspondence | Answer requests, resolve issues and establish legal claims | Contract; legal obligation; legitimate interests in establishing and defending legal claims |
3. Whether you must provide data
Providing account and service data is necessary to deliver the requested features. If it is not provided, the relevant account or feature cannot operate. Marketing is optional and refusal does not affect the service.
4. Automated decisions
Flawian does not use automated processing to make legal or similarly significant decisions about individuals.
5. Recipients and providers
| Recipient | Role and purpose | Main location/status |
|---|---|---|
| Hetzner | Hosting and database infrastructure | EU |
| Paddle | Independent merchant of record for paid orders; payment, tax, invoice, billing and refund administration | International; Paddle's own notice applies |
| Google account sign-in, if you choose it | International; safeguards apply | |
| Google Ads | Advertising visit and purchase measurement, only if you allow it in Cookie Settings | International; safeguards apply; Google's privacy notice applies |
| Google reCAPTCHA | Bot and abuse prevention on registration, password-reset and free-check forms | International; safeguards apply |
| Migadu | Sending account, security and purchase e-mail; receiving and storing e-mail you send to our flawian.com addresses | Switzerland (EU adequacy decision) |
| Providers of AI language models | Tools Mirabilia uses to check the evaluation and develop its rules | United States; safeguards apply |
| Your connected assistant and its provider | Receive the account data you ask the assistant to read | Provider chosen by you; its terms apply; processing may be outside the EU/EEA |
| Your assistant and its provider when you use the free check | Handle your chat and receive the preview returned to it | Provider chosen by you; its terms apply; processing may be outside the EU/EEA |
We may also disclose personal data to professional advisers, authorities or counterparties where required by law, to establish legal claims, or in a corporate transaction.
6. International transfers
Google may process sign-in, reCAPTCHA and consented advertising-measurement data, Paddle may process billing data, and the providers of AI language models may process data used to develop our rules, outside the EU/EEA, including in the United States. We rely on an adequacy decision where available, including a valid EU-US Data Privacy Framework certification, or the European Commission's Standard Contractual Clauses with supplementary safeguards as required. Contact us for information about the relevant safeguard.
If you connect an assistant, Flawian returns the requested account data to that assistant on your instruction. Its provider handles those data under its own terms and may process them outside the EU/EEA. Disconnecting stops further reads and saves; it cannot recall data already returned.
If you use the free check inside your assistant, Flawian receives only the answer options your assistant sends and returns the preview, and, if you choose to continue, a one-time link, to that assistant. Its provider handles the chat, including anything you type there, and the returned preview and link under its own terms, including any processing outside the EU/EEA. The free check does not make separate calls to an AI model to evaluate your answers.
7. Retention
We retain data for the periods below, then delete or anonymize it unless a legal hold requires longer retention:
| Record | Retention |
|---|---|
| Account identifiers and credentials | While the account is active; removed when the verified account-deletion workflow completes, except narrowly retained evidence below |
| Copies used to develop the rules | Up to 12 months |
| Company profile, wizard answers, evaluation results and review notes | While needed to provide the active business account; after account deletion, deleted, anonymized, unlinked or retained under the relevant organization's authority according to the record's purpose and legal obligations |
| Connection and call records of a connected assistant | Connection records are deleted with the account. Call records are eligible for deletion after 90 days under the default setting and are removed by a daily cleanup, or with the account. Grant and revocation events remain security evidence in the audit log under its existing retention rules. |
| Free-check preview and conversation counter | Preview results are cached in server memory for up to 15 minutes. The raw conversation identifier is not persisted; a hash combining its identifier (or the check key Flawian issued) and platform is held with a counter in server memory until the process restarts. Issued check keys and their counters are held in server memory until the first request after the UTC day changes, or until the process restarts. These counters and keys are not stored in the database. |
| Answers your connected assistant saved to your company profile | As company profile and wizard answers: they are part of your company profile |
| One-time continuation code and answer options | The link can be used once within 24 hours. The stored answer options, platform and code hash are deleted by the cleanup for used or expired records. Cleanup runs hourly after its startup delay; use or expiry makes the link unusable immediately, but does not erase the record immediately. |
| First-party analytics events | Up to 180 days; the IP address and approximate location of a visit up to 30 days |
| Server page-request records and the IP address linked to your account | Up to 30 days; IP addresses an administrator hides from the visit list, until removed |
| Free-check answers, result and progress | Up to 30 days |
| Visible time and scroll depth | Up to 30 days, with the server page-request record they belong to; pages opened next are server page-request records |
| Feedback | While useful for documented product improvement or until a successful objection, then deleted or anonymized |
| Saved free-check result not converted into an account | Up to 365 days after the request |
| Marketing-consent and withdrawal evidence | At least 4 years after withdrawal, or longer if needed for a live claim |
| Minimal contract, acceptance, security and legal-claim evidence | Up to 5 years after the relationship or relevant event |
| Accounting and transaction records | 10 years where Slovak accounting law requires it |
| Backups | Rolling maximum of 1 year; deletion takes effect as backups expire unless restoration is required earlier |
8. Cookies and similar technologies
Flawian uses strictly necessary technologies without consent where permitted. They support authentication, security, load management, consent choices and core service operation. Blocking them may prevent the service from working. Paddle's checkout script loads when you open a checkout or follow a Paddle payment link, to run the checkout.
First-party analytics events are recorded only after your consent; the visible-time measurement described further below has its own rule. They measure visits, account-linked product events and how far you get in the free check. For this, your browser keeps a random identifier and details of how your visit started, such as the source and campaign, until you withdraw consent or clear your browser data, and session entries until you close the browser tab. They are not shared with third parties. Cookie Settings let you reject optional technologies and later change your choice.
Visible time and scroll depth: if you allow analytics, or if the rule below applies, your browser reports, when you leave a page or switch away from it, how many seconds the page was visible and the furthest quarter of it you scrolled to. The report carries the page, these two numbers and whether you allowed analytics. It writes nothing in your browser and adds no identifier. The rule: when our IP-address database places your connection outside the European Economic Area, or in France, the Netherlands, Spain, Italy or Liechtenstein, and you are not signed in, the report and the pages you open next inside our site are recorded without consent, on the basis of our legitimate interests described above, until you refuse analytics in Cookie Settings. To learn whether the rule applies, a browser that has made no cookie choice asks our server once per page load whether the connection's placement allows it; that request is sent without cookies and the server stores nothing. If you are signed in, the server leaves your report out when it arrives. No report is recorded without consent when your connection is placed elsewhere in the European Economic Area, Slovakia included, or cannot be placed, when you are signed in, or after you refuse analytics.
Advertising-measurement addition: 16 October 2026. Earlier analytics consent does not enable this separate optional choice in Cookie Settings. If you allow it, Google Ads can use measurement cookies and receive advertising click identifiers and the reference, amount and currency of a completed purchase. We do not send your name, email, card details or business-profile answers in these purchase events. Advertising personalisation is disabled. You can withdraw this choice in Cookie Settings; this stops further purchase events from this browser. Google's privacy notice is available at https://policies.google.com/privacy.
Flawian does not currently treat a browser Do Not Track setting as a separate consent instruction.
9. Emails
Service emails necessary for the account, security or purchase do not require a marketing subscription. This includes a single reminder about an action you started yourself, such as confirming your email address or returning to a result you asked us to save, even before you have an account. If you are on a paid plan, a weekly check-in about your own plan is part of the service; you can turn it off at any time with one click or in Settings.
10. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.
You may object at any time to processing based on legitimate interests, including the use of your data to develop our rules. Send the objection to support@flawian.com. To stop the measurement of visible time, scroll depth and pages opened next described in section 8, refuse analytics in Cookie Settings; no request is needed.
You may lodge a complaint with a supervisory authority, in particular in the EU/EEA country where you live or work or where the alleged infringement took place.