apoc
contact us →
// legal

Privacy Policy

Last updated: July 14, 2026

1. Who is responsible for your data

The controller of your personal data is MITON AI Spice s.r.o., with its registered office at Křižíkova 148/34, Karlín, 186 00 Praha 8, Czech Republic, Company ID (IČO): 295 29 786, VAT ID (DIČ): CZ29529786 ("we" or "us"). We operate Apoc, an AI-powered DevOps agent that works through Slack (the "Service").

This Privacy Policy explains what personal data we process when you use the Service or visit getapoc.ai, why we process it, and what rights you have under the General Data Protection Regulation (GDPR). You can reach us at support@getapoc.ai.

2. What data we collect

  • Account and registration data. Your name, work email address, company name, password credentials, and the configuration you provide (AWS account ID, AWS region, GitHub repository).
  • Slack data. Slack workspace ID, Slack user IDs, and the content of messages in threads where the Apoc agent is mentioned or invited. We do not read other channels.
  • Infrastructure data. Configuration and metadata of your AWS resources and Kubernetes clusters, read through the read-only cross-account role you create, and the content of repositories you connect.
  • Service records. Conversation history with the agent, proposed changes and pull requests, approval decisions, and operational and audit logs.
  • Website data. Information you submit through the contact form, and technical data processed by Google reCAPTCHA to protect the form from abuse.

We do not knowingly collect any special categories of personal data.

3. Why we process it and on what legal basis

  • Providing the Service (operating the agent, responding in Slack, reading your infrastructure, opening pull requests, billing): performance of a contract, Art. 6(1)(b) GDPR.
  • Security and reliability (logs, audit trails, abuse prevention): our legitimate interest in keeping the Service secure, Art. 6(1)(f) GDPR.
  • Answering enquiries submitted through the contact form: steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR.
  • Service communications (product and security notices, administrative messages): performance of a contract and our legitimate interest.
  • Legal obligations (accounting and tax records): Art. 6(1)(c) GDPR.

We do not use your data for advertising and we do not sell it.

4. AI processing

To generate responses and proposed changes, relevant parts of your conversations and infrastructure context are processed by third-party AI providers (currently Anthropic). Data is sent in isolated API requests and is not shared with other customers. We only use providers that do not train their models on your data, and we will never train our own or anyone else's models on your data.

5. Who we share data with

We share data only with processors we need to run the Service:

  • Amazon Web Services (hosting and infrastructure, United States)
  • AI providers (currently Anthropic; AI processing, United States)
  • Slack (messaging platform the Service operates through)
  • GitHub (repositories and pull requests you connect)
  • WorkOS (sign-in and password authentication, United States)
  • Google (reCAPTCHA on the contact form)

These providers process data on our behalf and under our instructions. We may also disclose data where required by law, to protect our rights or the rights of others, or in connection with a corporate transaction, subject to appropriate confidentiality protections.

6. International transfers

Some of our processors are located in the United States. Where personal data is transferred outside the European Economic Area, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on Standard Contractual Clauses, together with additional safeguards where appropriate.

7. How long we keep data

We keep your data for as long as your account is active and as long as needed to provide the Service. When your account is closed, or when we receive a verified deletion request, we delete your data from our production systems within 30 days; encrypted backups are overwritten on their normal rotation. We keep data we are legally required to retain (such as invoicing records) for the statutory retention periods.

8. How we protect data

  • Encryption in transit and at rest.
  • Access controls based on least privilege.
  • A privilege model in which the agent never holds writable credentials to your AWS account; changes are applied only in your own account from pull requests you approve.
  • Audit logging and monitoring.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to processing based on our legitimate interests;
  • receive your data in a portable, machine-readable format;
  • withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email support@getapoc.ai. We will respond within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz) or the authority in your EU member state.

You can revoke the agent's access at any time: uninstall the Apoc app in Slack's App Management, delete the cross-account IAM role, or disconnect your repository. Revoking access stops new data collection immediately; previously stored data is deleted as described in section 7.

10. Children

The Service is not intended for children and we do not knowingly collect personal data from anyone under the age of 18 (or the age of majority in their jurisdiction, if higher). If we learn we have collected such data, we will delete it promptly. Contact support@getapoc.ai if you believe a child has provided personal data.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or Slack message. The date above shows the latest revision.

12. Contact

Questions about this policy or our data practices can be sent to support@getapoc.ai or by post to:

MITON AI Spice s.r.o.
Křižíkova 148/34, Karlín
186 00 Praha 8
Czech Republic