Privacy Policy

Controller

The controller responsible for data processing on this trial service is:

Full contact details are in the Imprint. This policy covers the trial portal and the trial instances it creates. The marketing website has its own privacy policy.

What we collect, and why

Redeem form

To start a trial you redeem an access code and give an email address; name and company are optional. We use them to run the trial, to answer requests you send us from your trial page, and to recognise you if you lose your trial link and redeem the code again. Access codes are stored only as a hash.

Legal basis: Art. 6(1)(b) GDPR (performance of the trial you requested).

Your trial instance

Each trial is a private Atelier CMS instance on our own server. Everything you create in it (pages, media, settings, user accounts) is stored in that instance's database and files until the trial ends. Logging in sets a session cookie inside your instance; this portal itself sets no cookies.

Legal basis: Art. 6(1)(b) GDPR. You are responsible for the content you put into your instance; please do not upload personal data of third parties.

Rate limiting and server logs

Your IP address is recorded when you redeem a code, to limit brute-force attempts, and is deleted after 7 days. The reverse proxy in front of all services writes access logs (requested URL, time, status, browser) which are kept only as long as needed for operation and security.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, abuse-free service).

Requests from your trial page

If you ask for more time or a longer trial, we store your message and email address to reply to you.

Legal basis: Art. 6(1)(b) GDPR.

AI features (only with your separate opt-in)

Atelier can use an AI assistant. If you tick the AI opt-in when redeeming your code, AIncient Labs issues you a personal, spend-capped API key for our AI proxy (llm.aincient-labs.com, hosted in Frankfurt, Germany). Text and content you send to the assistant, including any personal data it contains, is forwarded by the proxy to our current AI model provider, Anthropic PBC, USA, which processes it as our processor under a data processing agreement with EU standard contractual clauses and does not use it to train models. We may change provider; this policy always names the current one.

The proxy stores usage records per key (model, token counts, cost, timestamps) so we can enforce the spending cap. It does not store the text of your prompts or the answers. Do not paste sensitive or third-party personal data into the assistant.

Legal basis: Art. 6(1)(a) GDPR (consent). The transfer outside the EU rests on Art. 46(2)(c) GDPR (standard contractual clauses). You can withdraw consent at any time by emailing shibinkidd@gmail.com; we then revoke your key. Without the opt-in, no data leaves the EU.

Contact after the trial (optional)

Only if you tick the separate marketing opt-in may we contact you about Atelier after your trial.

Legal basis: Art. 6(1)(a) GDPR (consent), revocable at any time by email.

Analytics, fonts and assets

This portal runs no analytics and loads no third-party resources: fonts, styles, scripts and images are served from this domain, so visiting it sends no data to external hosts.

Hosting

The portal, your trial instance and the AI proxy run on a virtual server located in Frankfurt, Germany, operated by a hosting provider acting as a processor on our behalf under Art. 28 GDPR. The provider processes the connection data needed to deliver and secure the service on our behalf, governed by a data processing agreement.

International data transfers

Hosting, trial instances, server logs and the AI proxy itself are located within the European Union. The only transfer to a third country is the text you send to the AI assistant, and only if you opted in to AI features, as described above.

Retention

• Your trial instance, its database and files are deleted when the trial ends after 7 days, or earlier on request.
• IP addresses used for rate limiting are deleted after 7 days.
• Your contact details and requests are kept for up to 24 months so we can answer follow-ups, or until you ask us to delete them.
• The AI key expires with the trial. Its usage records (no content) are kept for up to 24 months for cost accounting.

No transfer to third parties

We do not sell your data and do not share it with third parties for advertising. Data is disclosed only where legally required or to processors acting on our instructions (hosting, and the AI model provider if you opted in) as described above.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17) and restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw any consent you gave, with effect for the future (Art. 7(3)); and
• lodge a complaint with a supervisory authority (Art. 77) — in Hamburg, the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.

To exercise any of these, or to end a trial early, email the controller above. Ending the trial deletes your instance and all its content.

Changes to this policy

We may update this policy to reflect changes to the service or the law. The current version always lives at this URL; the date at the top shows when it last changed.

See also our Imprint.