ItemBeamDashboard

Privacy Policy

Last updated: 17 August 2026

1. Data Controller

ItemBeam is operated by Adam Pavlat, a sole trader (OSVČ) registered in the Czech Republic:

As the Data Controller under the GDPR, Adam Pavlat determines the purposes and means of processing your personal data.

2. What data we collect

  • Account data - name and email address, collected when you register via Clerk (our authentication provider).
  • Billing data - payment method details, invoices, and subscription status, managed by Stripe. We never store raw card numbers on our servers.
  • Content data - projects, keywords, microsites, uploaded assets, and business descriptions you create inside ItemBeam.
  • Microsite analytics - anonymous page-view events on your published microsites (timestamp, referrer, approximate country derived from IP, device type). Raw IP addresses are not stored.
  • Technical logs - server logs including IP addresses and request metadata retained for up to 30 days for security and debugging purposes.

3. Legal basis and purpose

We process your data on the following legal bases:

  • Performance of a contract (Art. 6(1)(b) GDPR) - account data, content data, and billing data are processed to provide the ItemBeam service you subscribed to.
  • Legitimate interest (Art. 6(1)(f) GDPR) - technical logs and microsite analytics are processed to operate, secure, and improve the service. Our interest does not override your fundamental rights.
  • Legal obligation (Art. 6(1)(c) GDPR) - invoice and payment records are retained to comply with Czech accounting and tax law (typically 10 years).

4. AI content generation

When you generate microsites, the business descriptions, keywords, and uploaded asset content you provide are sent to AI model providers via OpenRouter. This data is processed solely to produce the generated output and is not used to train any AI models. We do not send your personal account data (name, email, billing details) to AI providers.

5. Third-party processors

We share data with the following sub-processors under data processing agreements (DPAs). Each processes data only as instructed by us:

  • Clerk - authentication and user management (US)
  • Stripe - payment processing (US / EU)
  • Amazon Web Services - hosting, database, file storage (EU West - Ireland, AWS region eu-west-1)
  • OpenRouter - AI model routing for content generation (US)
  • Resend - transactional email delivery (US)
  • LangSmith (LangChain) - AI request tracing for debugging (US)
  • DataForSEO - keyword research data (US)
  • Serper - web search results for AI research (US)

6. International data transfers

Several of our processors are based in the United States. Transfers of your personal data to the US are made under the EU Standard Contractual Clauses (SCCs) adopted by the European Commission, which provide appropriate safeguards for your data. Where an EU adequacy decision exists for a processor, we rely on that instead.

Your primary data (database, file storage) is hosted on AWS in the EU (Ireland) and does not leave the EU except where explicitly described above.

7. Data retention

We retain your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days. Exceptions:

  • Invoice and payment records are retained for the period required by Czech law (minimum 10 years).
  • Technical logs are deleted after 30 days.
  • Published microsites hosted on our CDN are deleted within 7 days of account deletion or cancellation.

8. Your rights (GDPR)

If you are in the EU/EEA you have the following rights regarding your personal data:

  • Access - obtain a copy of the data we hold about you.
  • Rectification - correct inaccurate or incomplete data.
  • Erasure - request deletion of your data where there is no overriding legal basis for retention.
  • Restriction - ask us to limit processing in certain circumstances.
  • Portability - receive your data in a structured, machine-readable format.
  • Objection - object to processing based on legitimate interest.
  • No automated decisions - we do not make solely automated decisions that have a legal or similarly significant effect on you.

To exercise any of these rights, email info+itembeam@theadamlabs.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Czech supervisory authority: Urad pro ochranu osobnich udaju (UOOU), Pplk. Sochora 27, 170 00 Prague 7.

9. Cookies

We use strictly necessary cookies only. Clerk sets a session cookie to keep you logged in. We do not use advertising, tracking, or analytics cookies. No third-party cookies are set on itembeam.com.

10. Changes to this policy

We may update this policy when the service changes. We will notify you by email for material changes at least 14 days in advance. The "last updated" date at the top always reflects the current version. Continued use of the service after the effective date constitutes acceptance of the updated policy.

11. Contact

Questions about this policy? Email info+itembeam@theadamlabs.com.