Privacy Policy

1. Controller

2. Principles of Processing

We process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality pursuant to Art. 5 GDPR.

All personal data is processed exclusively within the European Economic Area (EEA). We do not use any third-party marketing, analytics, or advertising services. No personal data is transferred to countries outside the EEA.

3. Categories of Personal Data

We process the following categories of personal data:

• Account data — email address, hashed password
• Usage data — research questions submitted, reports generated
• Technical data — IP address, browser type, timestamps
• Payment data — transaction records (processed via Stripe; we do not store card details)

4. Legal Bases for Processing

Each processing activity is based on one of the following legal bases:

• Art. 6(1)(b) GDPR — performance of a contract (account creation, research execution)
• Art. 6(1)(f) GDPR — legitimate interests (IT security, error resolution, platform stability)
• Art. 6(1)(c) GDPR — compliance with legal obligations (tax, accounting)

We do not process personal data on the basis of consent for marketing or advertising purposes. We do not use cookies beyond what is technically necessary for session management.

5. How the Service Works — Data Flow

When you submit a research question, the following processing takes place. We describe this in detail so you can understand exactly where your data goes.

6. Recipients and Categories of Recipients

We disclose personal data only where necessary for the purposes described in this Privacy Policy:

• AKI.io GmbH — AI inference provider (processor, DPA in place)
• European Search Perspective GmbH (Staan) — search provider (derived queries only)
• Hetzner Online GmbH — infrastructure / hosting provider
• Mollie B.V. — payment processing (Amsterdam, Netherlands 🇳🇱)
• Tax advisers and accountants as required by law

All processors act only on our documented instructions and under appropriate contractual safeguards including data processing agreements.

7. Account Registration

For registration and authentication, we process your email address and a hashed password. Passwords are hashed with bcrypt and never stored in plaintext.

Dominant legal basis: Art. 6(1)(b) GDPR.

8. Billing and Payments

Payment processing is handled by Mollie B.V., an EU-native payment provider headquartered in Amsterdam, Netherlands. Mollie is regulated by De Nederlandsche Bank (DNB) and processes all payment data within the EU. We do not store credit card numbers or bank details on our servers.

Dominant legal basis: Art. 6(1)(b) GDPR; for statutory retention, Art. 6(1)(c) GDPR.

9. Technical Logs and Security

Technical logs (IP addresses, timestamps, request metadata) are processed solely to ensure platform security, stability, and error resolution. Logs are automatically deleted after 90 days.

Dominant legal basis: Art. 6(1)(f) GDPR.

10. No Analytics, No Advertising, No Cookies

We do not use any analytics tools (no Google Analytics, no Matomo), advertising services, tracking pixels, or third-party cookies. The only data stored in your browser is a session token (JWT) for authentication, held in localStorage.

11. AI Model Training

Your research questions, results, and reports are never used to train AI models — neither by us nor by our AI provider (AKI.io). AKI.io processes prompts exclusively in volatile memory and does not log, store, or analyse customer-provided content.

12. Data Retention

Personal data is deleted or anonymised once the processing purpose no longer applies:

• Account data — retained until account deletion
• Research reports — retained until you delete them or request erasure
• Technical logs — automatically deleted after 90 days
• Payment records — retained for 10 years per statutory tax obligations (§ 147 AO)

13. Your Rights

You have the following rights under the GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

To exercise any of these rights, contact us at privacy@ciata.io.

14. Supervisory Authority

15. Automated Decision-Making

No automated decision-making within the meaning of Art. 22 GDPR takes place. AI-generated research reports are informational outputs, not decisions that produce legal or similarly significant effects.

16. Amendments

This Privacy Policy may be updated from time to time. We will notify registered users of material changes by email. Changes are effective when posted on this page.