Legal
Privacy Policy
Effective 28 October 2026
Effective 28 October 2026.
Version 5d0654f1, effective 28 October 2026
This policy explains how Fortbit d.o.o. ("AIgenica", "we", "us") handles personal data when you visit our website, contact us, talk to our AI agent, book a call, or sign in to our client portal. How we handle data inside the automations we build for clients is covered by our Data Processing Agreement.
1. Who is responsible
The controller of the personal data described here is:
Fortbit d.o.o. (trading as AIgenica) Gradiščak 31A, 40313 Gradiščak, Croatia OIB 84211962389 · VAT ID HR84211962389 Email: Website: https://aigenica.com
We are not required to appoint a Data Protection Officer. Write to for anything related to your data and you will reach a person who can act on it.
2. What we collect and why
Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
You send the contact form or a call-to-action form | name, work email, company, phone (optional), your message, the page you sent it from, language | Reply to your enquiry and prepare a proposal | Steps at your request before a contract, Art. 6(1)(b); legitimate interest in answering business enquiries, Art. 6(1)(f) |
You talk to our AI agent | what you write in the conversation (your business, processes and tools), plus your name, email and company if you give them; the conversation and a summary are stored in our CRM | Understand your needs, answer your questions and prepare a proposal | Art. 6(1)(b) and 6(1)(f) |
You book a discovery call | name, email, the time you chose, anything you write in the booking form | Hold the call | Art. 6(1)(b) |
We work together | contact details of your team, project communication, invoices | Deliver the services, invoice, keep records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
You sign in to the client portal | account data (name, email, sign-in records, security settings) | Give you secure access | Contract, Art. 6(1)(b) |
You browse the website | IP address, browser and device data, pages requested, timestamps (server and security logs) | Run, secure and fix the website | Legitimate interest, Art. 6(1)(f) |
You allow optional cookies | as described in the Cookie Policy | Analytics or marketing, only with consent | Consent, Art. 6(1)(a) |
We do not sell personal data, we do not buy contact lists, and we do not make decisions about you that have legal or similarly significant effects by automated means.
Please do not send us special categories of data (for example health information) through the website forms. If a project needs such data, we agree how it is handled in writing first.
3. Cookies
Necessary cookies keep the website working and remember your choices. Everything else runs only after you agree, and you can change your mind at any time with "Cookie settings" in the footer. Details are in the Cookie Policy.
4. Who receives your data
We use a small number of service providers to run the website and our business. Processors act only on our instructions under a written agreement.
| Provider | Role | Purpose | Data | Location |
|---|---|---|---|---|
| Calendly | Processor | Scheduling discovery calls booked from the website. | contact | US |
| Cloudflare | Processor | CDN, DNS, DDoS protection and edge caching. | technical | US |
| PostHog | Processor | Product analytics and session data, only where analytics consent is given. | usage, technical | US |
| Railway | Processor | Application and database hosting. | account, content, technical | US |
| Resend | Processor | Transactional email delivery. | contact, account | US |
| Sentry | Processor | Error monitoring and performance tracing. | account, technical, usage | US |
| SuperCognit | Sub-processor | Platform on which we build and run client AI agents: knowledge bases, conversations, channels (website, WhatsApp, Telegram), tools and inbox. | contact, content, support, usage | PT |
If you book a call, the booking tool's provider receives the details you enter there. We may disclose data where the law requires it or to establish, exercise or defend legal claims.
5. Transfers outside the EEA
Where a provider processes data outside the European Economic Area, the transfer relies on a safeguard under Chapter V GDPR, listed below. You can ask us for a copy at .
| Provider | Location | Transfer basis | Safeguards |
|---|---|---|---|
| Calendly | US | EU–US Data Privacy Framework | Fallback: Standard Contractual Clauses |
| Cloudflare | US | Standard Contractual Clauses | — |
| PostHog | US | Standard Contractual Clauses | — |
| Railway | US | Standard Contractual Clauses | — |
| Resend | US | Standard Contractual Clauses | — |
| Sentry | US | Standard Contractual Clauses | — |
| SuperCognit | PT | No transfer | EU company. Its own AI model sub-processors are listed on its Trust Center. |
6. How long we keep data
Data | Retention |
|---|---|
Enquiries and agent conversations that do not lead to a project | 24 months after our last contact, then deleted |
Client and project records | For the duration of the contract and up to 5 years after it ends, for claims |
Invoices and accounting records | 11 years, as Croatian accounting law requires |
Client portal accounts | Until the account is deleted, then up to 30 days in backups |
Server and security logs | Up to 90 days |
Consent records | Up to 36 months |
7. Your rights
You can ask us for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest, including any direct marketing (we will then stop). Where we rely on consent you can withdraw it at any time. Write to ; we answer within one month.
You may also complain to a supervisory authority. In Croatia this is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. You can also contact the authority where you live or work.
8. Security
We use encryption in transit, access control with least privilege, two-factor authentication for administrative access, and logging. Client automations run in separate workspaces per client.
9. Changes
When we change this policy we update the effective date above, and for significant changes we tell you on the website or by email.