Privacy policy

What we collect, and where

There are three forms on the site, and only what you enter is processed:

• Contact form — name, work email, organisation, area of interest, message.
• Cheat-sheet form — name, work email, organisation (optional) and your consent.
• Order form — name, work email, organisation, role, a description of the system, an optional repository address and notes.
• Form submissions are also written to our own database (Google Cloud Firestore, EU — Frankfurt) so that we can follow up on requests. The repository address from the order form is not written to the database.
• Our own page counting (no consent required): on each page view we record the page path, the domain you came from, campaign tags (utm) if present, browser language and device class (mobile / tablet / desktop). No cookie, session identifier, IP address or anything else that identifies you is recorded; two visits cannot be linked.
• Google Analytics (only with your consent): if you accept, a measurement cookie is set in your browser and information about your visit — page path, referring site, approximate location (country/city level), device and browser — is sent to Google. If you decline, no cookie is set; only a cookieless, identity-free signal reaches Google and your visit is not tracked individually. You can withdraw consent at any time through the “Cookie choice” link at the bottom of the page.
• Our hosting provider (Google Firebase) keeps IP addresses and browser details in server logs for a short period, for security and debugging.

Cookies

The site needs no cookie to work. The only cookie is the measurement cookie Google Analytics sets if you accept it. A banner appears on your first visit and offers accept and decline on the same screen with the same weight; until you choose, no analytics cookie is set. We use no advertising cookies, tracking pixels or social media cookies.

You can change your choice through the “Cookie choice” link at the bottom of every page. Declining closes off no part of the site.

What we use it for, and the legal basis

• Answering your request and producing and delivering an ordered pack — performance of a contract (GDPR art. 6(1)(b)).
• Sending occasional audit-related writing to those who requested the cheat sheet — your consent (art. 6(1)(a)), withdrawable through the link in every email or by writing to us.
• Keeping the site secure and preventing abuse, and understanding which pages are read through identity-free page counting so we can improve the site — legitimate interest (art. 6(1)(f)).
• Measuring visits with Google Analytics — your consent (art. 6(1)(a); ePrivacy Directive art. 5(3)). If you do not consent, no analytics cookie is set and the site works exactly as before; withdrawing consent is as easy as giving it.
• Accounting and tax records — legal obligation (art. 6(1)(c)).

What happens to your data in an ordered pack

For the Single System File, the repository you provide is cloned into a temporary environment, scanned, and deleted when the scan ends. Only file paths and identifier names (functions, tables, libraries) are recorded from the code; source code is not retained. Your system description and the context derived from the scan are sent to model providers (Google Gemini, OpenAI) to produce the assessment. Deliverables are kept for 90 days and deleted earlier on request.

Sub-processors

Your data is shared only with the following providers, only for the stated purpose. It is not shared with advertising networks and not sold.

• Web3Forms — form delivery (forms reach our inbox through this service).
• Google Firebase — site hosting and server logs; Cloud Firestore (EU, Frankfurt) — form records and identity-free page counting.
• Google Analytics — visit measurement, only if you consent. Advertising signals are switched off: the data is not used for ad personalisation and is not shared with advertising networks.
• Stripe — order payments; card details stay with Stripe and never reach us.
• Google (Gemini) and OpenAI — production of ordered assessments.
• Our email provider — correspondence.

Retention

• Form correspondence and form records in our database: 24 months from last contact.
• Identity-free page counts: contain no personal data; kept as aggregate statistics.
• Google Analytics data: at most 14 months at Google; the cookie itself lasts at most 2 years in your browser and is not set once you withdraw consent.
• The record of your cookie choice: stored in your own browser (“granted” / “denied”), never sent to us, and kept until you clear it.
• Order deliverables: 90 days from delivery.
• Invoices and accounting records: 7 years, as Dutch tax law requires.
• Server logs: at most 30 days.

Your rights

Under GDPR articles 15–22 you may access, rectify, erase, restrict, port and object to the processing of your data, and withdraw consent at any time where processing rests on it. Write to info@atherosai.com; we answer within one month. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the authority in your own member state.

Transfers

Some sub-processors may process data outside the EU (United States), including Google Analytics data. Such transfers rely on the European Commission's standard contractual clauses or on the adequacy decision for the EU–US Data Privacy Framework.

Changes

When this policy changes, the effective date is updated. A material change is also announced to the email address you left with us.