Privacy Policy
Last updated: 28 October 2026 · Ελληνικά
This is a translation. If the two versions differ, the Greek text prevails.
1. Who we are
PnyxMind belongs to CONNECT PHONE - ΤΗΛΕΠΙΚΟΙΝΩΝΙΕΣ Α.Ε. (CONNECTPHONE S.A.), Praxitelous 131, 185 32 Piraeus, Greece, VAT no. EL999544570, General Commercial Registry (GEMI) no. 009179401000. For any question about personal data, write to info@pnyxmind.com.
2. When we are the controller and when we are not
We are the controller for your account, billing, security, the contact form, and the cases you open as an individual. When an organisation invites you (a company, a hospital, a municipality), that organisation is the controller for the case data, and we process it only on its instructions. For that data, please contact the organisation first.
3. What data we collect, why, on what legal basis and for how long
| Data | Why | Legal basis (GDPR Article 6) | How long |
|---|---|---|---|
| Email, name, Google profile details (if you sign in with Google) | Account and sign-in | Contract (6(1)(b)) | While the account exists and 30 days after |
| Texts, votes, documents and photos you upload to a case | Running the deliberation and sealing the decision | Contract (6(1)(b)) | As set by the case organiser, from 30 days to 10 years |
| Billing details (through Stripe), receipts and invoices | Payments, Greek tax reporting (myDATA) | Legal obligation (6(1)(c)) | 5 years (tax law) |
| Name, email, organisation and message from the contact form | To reply to you | Pre-contractual steps (6(1)(b)) or legitimate interest (6(1)(f)) | 12 months from the last contact |
| The question you type in the «Ask the council» demo | So the models can answer live | Legitimate interest (6(1)(f)) | We do not store it; only the model providers see it (section 5) |
| IP address, device, logs, errors | Security, rate limits, preventing abuse | Legitimate interest (6(1)(f)) | Up to 90 days |
| Email for the newsletter | News and offers | Consent (6(1)(a)) | Until you withdraw it |
4. Sensitive data
Do not upload health data, political opinions, religious beliefs or other people's details without a reason. In the health rooms we accept only pseudonymised data, on the instructions of the organisation and under its own legal basis. The system automatically hides emails, phone numbers, Greek social security (AMKA) and tax (AFM) numbers and IBANs before texts reach the models, but this does not catch everything (names, for example).
5. Artificial intelligence
In every room, AI models from different companies take part, and every AI seat is marked as AI. Case texts are sent to the model providers only so that they can answer. We do not use them to train models. The business terms of Anthropic, OpenAI and Google do not allow them to train models on this data. Kimi and DeepSeek give no such guarantee, which is why the limits in section 7 apply. The final decision that concerns you always belongs to a person.
6. Who we share data with
We do not sell data. We share it only with partners who process it for us:
- Cloudflare: website, network, files, protection against attacks
- Hetzner (Germany): hosting of the application and the database
- Amazon Web Services (Frankfurt): safekeeping of encryption keys
- Google: sign-in with Google, company email
- Resend: sending email
- Stripe: payments
- Sentry: error logging
- Model providers: Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini), Moonshot AI (Kimi), DeepSeek
7. Transfers outside the EU
Some partners and model providers are in the United States. Transfers there rely on the EU-US Data Privacy Framework or on the EU standard contractual clauses.
Kimi (Moonshot AI) processes texts in Singapore and DeepSeek in China. The EU has no adequacy decision for these countries. Therefore:
- in hospitals and on national-security or defence topics they never take part; the database refuses it,
- in municipalities they are off, unless the municipality turns them on,
- for companies and individuals they take part only if the organiser chooses so; the organiser sees which models and which countries take part and can remove them,
- in the «Ask the council» demo on the home page, your question goes to Kimi and DeepSeek only if you tick the box for them. Do not write personal data there.
8. The decision record and erasure
Every decision is sealed in a record that does not change, so that it can be verified. The texts in the record are encrypted with a key that belongs only to that case. If you ask for erasure, we delete the personal details and destroy the key. What remains in the record is only encrypted text and fingerprints (hashes) that nobody can read, not even us.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Write to info@pnyxmind.com and we will answer within one month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr) or with the authority of the EU country where you live.
10. Security
Encryption in transit and at rest, strict separation of organisations inside the database, and sign-in without passwords (a one-time code by email, or Google).
11. Children
The service is not intended for people under 15 (Article 21 of Greek Law 4624/2019).
12. Cookies
We use only the cookies needed for sign-in and security. If we add statistics or advertising, we will ask for your consent first.
13. Changes
We announce material changes to this policy by email 30 days before they take effect.