Privacy policy

What we collect, and where

There are three forms on the site, and only what you enter is processed:

• Contact form — name, work email, organisation, area of interest, message.
• Cheat-sheet form — name, work email, organisation (optional) and your consent.
• Order form — name, work email, organisation, role, a description of the system, an optional repository address and notes.
• Our hosting provider (Google Firebase) keeps IP addresses and browser details in server logs for a short period, for security and debugging.

What we use it for, and the legal basis

• Answering your request and producing and delivering an ordered pack — performance of a contract (GDPR art. 6(1)(b)).
• Sending occasional audit-related writing to those who requested the cheat sheet — your consent (art. 6(1)(a)), withdrawable through the link in every email or by writing to us.
• Keeping the site secure and preventing abuse — legitimate interest (art. 6(1)(f)).
• Accounting and tax records — legal obligation (art. 6(1)(c)).

What happens to your data in an ordered pack

For the Single System File, the repository you provide is cloned into a temporary environment, scanned, and deleted when the scan ends. Only file paths and identifier names (functions, tables, libraries) are recorded from the code; source code is not retained. Your system description and the context derived from the scan are sent to model providers (Google Gemini, OpenAI) to produce the assessment. Deliverables are kept for 90 days and deleted earlier on request.

Sub-processors

Your data is shared only with the following providers, only for the stated purpose. It is not shared with advertising networks and not sold.

• Web3Forms — form delivery (forms reach our inbox through this service).
• Google Firebase — site hosting and server logs.
• Stripe — order payments; card details stay with Stripe and never reach us.
• Google (Gemini) and OpenAI — production of ordered assessments.
• Our email provider — correspondence.

Retention

• Form correspondence: 24 months from last contact.
• Order deliverables: 90 days from delivery.
• Invoices and accounting records: 7 years, as Dutch tax law requires.
• Server logs: at most 30 days.

Your rights

Under GDPR articles 15–22 you may access, rectify, erase, restrict, port and object to the processing of your data, and withdraw consent at any time where processing rests on it. Write to info@atherosai.com; we answer within one month. You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the authority in your own member state.

Transfers

Some sub-processors may process data outside the EU (United States). Such transfers rely on the European Commission's standard contractual clauses or an adequacy decision.

Changes

When this policy changes, the effective date is updated. A material change is also announced to the email address you left with us.