CZ Test your AI
Inovai Platformrunning Testing, monitoring and evidence in one placeIt attacks your AI after every change and documents every finding. How the platform tests

AI security

AI inventoryEverywhere AI runs in your company, including the unapproved Chatbot and agent testingModel, widget code and data flow, before deployment and in operation Copilot auditPermissions and data leaks in Microsoft 365 Monitoring and evidenceA new run after every change, a report for the auditor OSINT investigationWhat an attacker finds about you and your people

AI integration

Digital colleagueA chatbot for your website and e-shop, and an in-house colleague on top of data and BI AI workflows and agentsConnections to ERP and CRM, agents that write and send Copilot StudioCustom agents in Microsoft 365 Local modelsData never leaves the company

Document extraction

Invoices and ordersExtraction and export to ERP without retyping Contracts, certificates and delivery notesData and deadlines, 10,000+ certificates at Favex Production ordersFrom email through the order to production documents Checks against rulesERP, standards and contracts, exceptions for approval

BI and data

Power BI and Qlik SenseReporting that management actually opens Data platformFabric, Databricks, data warehouses AI on top of reportsCopilot in Power BI and data agents Forecasts and recommendationsDemand forecasting, recommendations, anomalies

Workshops and analysis

Analysis and solution designWhere AI saves time and money, and how to build it AI for managementWhere AI makes sense and where it doesn’t Secure AI for ITAttacks, defence and evidence in practice AI literacy for teamsSafe use of AI, Article 4 of the AI Act
All areas

When you’re dealing with

We’re launching a chatbot or agentPre-deployment testing, retest and evidence for management We’re rolling out CopilotBefore Copilot finds what it shouldn’t We’re buying AI from a vendorTesting before you sign off acceptance We don’t know where AI is runningAn inventory of deployed and unapproved AI An audit or inspection is comingEvidence for the auditor, Czech National Bank or NÚKIB

Industries

Banks and insurersDORA and Czech National Bank supervision Public sectorChatbots for citizens, Copilot in public offices HealthcareSensitive data and the higher-obligations regime Energy and industryAgents on operational data

Partners

Chatbot vendorsSecurity testing under your brand Integrators and IT vendorsAI testing for your projects Law firmsTechnical partner for the AI Act

Evidence

Favex case studyAI we built: 10,000+ certificates in production Use casesEighteen situations, from chatbots to invoices Czech AI Security IndexHow easily models are bypassed in Czech, in progress

Company

TeamFour people, AI, data and security How we workConnect, attack, verify, document BlogFrom practice, no hype

Infrastructure

Coming soonGPU server in CzechiaLocal models, fine-tuning and attack testing without cloud APIs.What it will run

Inovai / Privacy policy

Privacy policy.

What we know about you, why and for how long.

Last updated: October 2026

1. Who processes the data

The controller of personal data is InovaiTechnology s.r.o., Company ID: 29643821, with its registered office at Nedachlebice 11, 687 12, registered in the Commercial Register kept by the Regional Court in Brno, file number C 152266. Contact: michael@inovai.cz.

We have not appointed a data protection officer, because our processing is not regular, large-scale or systematic within the meaning of Article 37 of the GDPR.

2. Email and enquiries

What data we process

  • Data you send us by email: name, email address, organisation and the content of the message, including attachments.
  • If you want us to test a chatbot or other AI, also its address and the contact details of its owner.

Purpose of processing

Handling your enquiry: reply, preparation of an offer and any follow-up communication about an engagement or long-term cooperation.

Sending you the results of the Czech AI Security Index if you request them by email. We use your address only for that purpose and delete it within 12 months at the latest.

Legal basis

Legitimate interest of the controller (Article 6(1)(f) GDPR), i.e. replying to an enquiry you sent us yourself. If we subsequently conclude a contract, the legal basis of performance of a contract (Article 6(1)(b) GDPR) follows.

Retention period

  • If no business relationship results from the enquiry, we will delete the data within 12 months of the last communication at the latest.
  • If a contract results from the enquiry, we keep the data for the duration of the contractual relationship and then for the period required by law, typically 10 years for accounting and tax documents.

Recipients of the data

We do not pass on data from email communication to third parties for their own purposes. Due to the nature of running a website, the following processors may handle it at a technical level:

  • Hosting provider, where the website and mailbox run, with a data centre in the EU.
  • Email provider for delivering and storing messages and for follow-up communication.

We do not send any data from email communication to third countries outside the EU/EEA.

3. Cookies and analytics

Details of the individual tools can be found on the Cookies page. In brief:

  • Technical (necessary): we store only your choice from the cookie bar (inovai_consent in localStorage). No consent required.
  • Google Analytics 4 and Microsoft Clarity: loaded only with consent. They help us understand traffic and behaviour; we do not use them for ad targeting.

You can change your consent at any time in the cookie settings.

4. Your rights

Under the GDPR, you have these rights:

  • Right of access: to know what we process about you.
  • Right to rectification of inaccurate data.
  • Right to erasure, i.e. the “right to be forgotten”.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest.
  • Right to withdraw consent, for analytics via the cookie settings.

Just write to michael@inovai.cz. We will reply without undue delay, within one month at the latest, as the GDPR requires.

If you believe we are processing your data in breach of the law, you can lodge a complaint with the Office for Personal Data Protection (the Czech data protection authority), uoou.gov.cz.

5. Changes to this document

We may update this policy, typically when a new tool is added or the legislation changes. The current version is always on this page, and the date of the last change is shown at the top.