Privacy Policy

1. Who is responsible

TONATOMETO s.r.o. is the controller for AMONS account, billing, support, security and direct business relationship data. When AMONS hosts booking, CRM or similar data for an AMONS business customer, that customer is normally the controller and TONATOMETO s.r.o. acts as processor under the DPA.

2. Data we process

We may process account identity and contact details, business profile data, billing and tax information, authentication and security data, support communications, product usage and technical logs, domains and configuration, and content supplied to AMONS. For customer businesses we may also process their end-customer names, contact details, bookings, service history, preferences and communications as instructed by that business.

3. Why we process it

We process data to perform the contract, authenticate users, deliver and secure the service, bill subscriptions, provide support, prevent abuse, comply with tax and legal obligations, improve reliability and communicate about the service. Where required, marketing communications are based on an appropriate lawful basis and include an opt-out.

4. Providers and recipients

We use service providers for hosting, delivery, AI and payments. Core providers currently include Railway (backend and database hosting), Vercel (frontend, CDN and domains), Resend (transactional email), OpenAI (AI-assisted features) and Stripe (payments, billing and tax). Some providers may act as independent controllers for their own regulated or payment activities.

5. International transfers

Providers may process data outside the EEA. Where GDPR requires it, we rely on an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and appropriate supplementary safeguards.

6. Retention

Account and contract records are retained for the relationship and as needed for legal, accounting, fraud-prevention and dispute obligations. Processor data is retained according to Customer instructions, product configuration and the DPA, subject to limited backup and legal retention periods. Security logs are retained only as reasonably necessary for security and operations.

7. Your rights

Depending on applicable law, individuals may have rights of access, correction, deletion, restriction, objection, portability and complaint to a supervisory authority. For data controlled by an AMONS business customer, requests should normally be directed to that business; we assist it as required by the DPA.

8. Security

We use access controls, encrypted transport, restricted production credentials, authentication tokens, tenant isolation, logging and operational monitoring. No system can guarantee absolute security.

9. Contact

Privacy requests can be sent to hello@amons.pro. We may need to verify identity before acting on a request.