Version 1.1 · Published 22 October 2026 · English
Operator, purposes and rights
Trimix Tech d.o.o., Lucija, Šolska ulica 2, 6320 Portorož - Portorose, Slovenia (registration 9305661000, VAT SI83980172), is controller for its own account, support, security and business administration. Contact info@trimix.si for privacy and support@trimix.si for service requests. Uploaded customer documents are processed through the controller/processor chain in the DPA; the competent Customer/controller decides their purposes.
Own-purpose records include names/business contacts, account and role/company associations, invoice/payment references, support/rights correspondence and necessary security records. They come from you, an authorised employer/inviter or service interactions. Indirect collection is subject to required source information/notices or a lawful exception. Account administration, support and security rely on necessary, balanced legitimate interests; contract necessity applies where the individual is personally a party. Legal obligations govern required invoicing and rights handling. Optional marketing requires its own lawful choice and is not a subscription condition. Without necessary account details, access may not be possible.
Necessary recipients include authorised staff, the hosting/AI/support providers described in the DPA and, for their lawful functions, banks, advisers and authorities. Primary Flow storage is Frankfurt; Global AI processing is not EU-only. Relevant applicable international-transfer safeguards and supplier particulars are supplied through the DPA process, without publishing private contracts or keys.
Request access, correction, erasure, restriction, portability or objection, and withdraw consent without affecting prior lawful processing, subject to applicable conditions. Identity/authority checks are proportionate. Respond without undue delay, normally within one month; explain lawful extensions up to two further months in that first month. Customer-document requests go promptly to the competent controller. You may complain directly to Slovenia's Information Commissioner (https://www.ip-rs.si/en/) or another competent authority.
Storage and support
Policy periods: documents and linked history 24 months from processing; technical logs 90 days; support tickets and content-access permissions 12 months after closure; duplicate support emails/attachments 90 days after ticket registration, once necessary transfer to Help Desk is checked. Accounts remain while needed for access/closure; contracts, invoices and rights/incident records are retained only for their applicable legal/accountability period or a justified limited claim/hold, reviewed when that purpose ends.
The Terms/DPA define advance notices, full return, exit deletion and up to 60-day residual backups; mandatory rights/holds prevail. Erasure/restriction must also be respected after restoration. These are retention rules; automated purge and full recovery verification are not yet completed. Requests are handled through support with scope and outcome recorded. Do not send financial originals as ordinary email attachments; use authorised secure delivery. Support content permission is case-specific, at most seven calendar days without explicit renewal, and ends when its task ends.
Cookies and browser storage
The application uses necessary session/security storage for sign-in and requested functions; no advertising or behavioural analytics are authorised. Necessary APEX session storage follows sign-in, logout and timeout. Browser controls can remove/block site data, which may prevent sign-in; doing so does not cancel a subscription or erase server-held documents. Optional tracking requires a separate prior choice and accessible withdrawal before activation. Reading or accepting service terms is not optional-cookie consent. This notice covers Flow, not all Trimix website surfaces.
AI and human control
OpenAI API assists document separation/extraction and product explanations. Recognition may send necessary PDF/image originals or fragments and instructions; retries can repeat transmission. The assistant uses your question, approved guidance and limited permitted server context. Do not paste documents, personal/bank details or credentials into questions. A store=false flag on direct recognition does not establish zero provider retention or identical settings for the APEX assistant. Current provider controls disable training sharing; Global/Standard retention and separate local logs still apply. No EU-only AI or Zero Data Retention claim is made.
Customer content is not used for model training or cross-customer analytics under the service policy. AI can omit, misread, misclassify or explain incorrectly. Check originals, Organization, lines, values and tax treatment before individual approval/accounting use; validation is not proof of correctness. The intended workflow does not make autonomous decisions about people's legal or similarly significant outcomes. AI provides no professional accounting/tax advice or error-free guarantee. Dated updates inform users and do not replace required instructions, acceptance or consent.