Privacy Policy

Atech ApS (CVR 46391942, Lille Strandstræde 6A, st. th., 1254 København K, Denmark) is the data controller for the personal data described here. Questions or requests: [email protected].

• Your account: email, name and, with Google or GitHub sign-in, your profile name, picture and username there. Profile details you add (bio, location, links) are yours to fill in. Used to log you in and keep your projects. If you share a project publicly, your display name and picture are shown with it. Legal basis: our contract with you.
• Your projects: what you type into the editor, the chat with the assistant and the code generated from it. Sent to our AI provider to choose modules and write code. If you give WiFi network names and passwords for your device, they are stored with your account and put into your device’s code, so they also pass through the AI provider. For projects with a voice assistant, the project’s name and description go to our voice provider, and what you say to the device is processed there to answer you. Legal basis: our contract with you.
• Orders: name, email, phone, delivery address, what you bought, for a company order the company name, billing address and VAT number (which Stripe checks against the EU’s VAT register), and your answer to “where did you hear about us?” if you give one. Card details go straight to Stripe; we never see them. Legal basis: our contract with you, and the Danish Bookkeeping Act for keeping records. We also count each paid order in our analytics (amount, currency, country, what was bought), whether or not you accepted cookies. This uses no cookies and no name or email. Legal basis: our legitimate interest in knowing which products and pages lead to sales.
• Newsletter: your email, if you sign up. We only email when new modules land, plus a welcome email. Legal basis: your consent. Every email has an unsubscribe link.
• Emails to us: whatever you write, to answer you.
• Prices in your currency: we look up your country from your IP address to show prices in your currency. Cloudflare, which delivers our website, tells us the country; we do not store it. Legal basis: our legitimate interest in showing correct prices.
• Project view counts: to count one view per visitor per day, we store your account ID if you are logged in, otherwise a scrambled code made from your IP address that changes every day and cannot be turned back into the address. Legal basis: our legitimate interest in showing view counts.
• Server logs: our servers log requests, errors and parts of prompts to keep the service running and fix problems. Legal basis: our legitimate interest in a working, secure service.
• Waitlist: if you join the waitlist, your email, your referral code and who referred you. Used to tell you when you can order. Legal basis: your consent.
• Analytics, only if you click “Accept”: pages you visit, the site you came from, your rough location from your IP address, device and browser, and shop steps (added to cart, started checkout, ordered). If you are logged in, this is linked to your account ID and email. No session recordings and no click tracking. Legal basis: your consent.
• Ads, only if you click “Accept”: the Google Ads tag measures whether our ads lead to orders. Until you accept, it runs without ad cookies (Google Consent Mode). Legal basis: your consent.

These services process data for us, only on our instructions and under a data processing agreement with each:

• Supabase: accounts, sign-in and the database with your projects
• Railway: hosting of the website and our servers, including server logs
• Anthropic: the AI that generates builds and code from your prompts
• ElevenLabs: voice assistants on devices that have one
• Stripe: payments and order details
• Brevo: the newsletter list
• Google: emails we send, Google sign-in and the Google Ads tag
• Cloudflare: delivers the website and protects it from attacks
• PostHog: analytics, stored in the EU

If you sign in with Google or GitHub, they handle that sign-in under their own privacy policies.

Supabase, Railway, Anthropic, ElevenLabs, Stripe, Google and Cloudflare are US companies, so your data may be processed in the United States. Those transfers rely on the EU-US Data Privacy Framework where the company is certified, and otherwise on the EU Standard Contractual Clauses in its data processing agreement. PostHog and Brevo keep data in the EU.

• Account and projects: until you delete your account. Deleting it removes your login straight away and hides your projects; signing up again with the same email brings them back. To have your projects and all other data erased for good, email us and we do it within one month.
• Orders: 5 years from the end of the financial year, as Danish bookkeeping law requires.
• Newsletter: until you unsubscribe.
• Waitlist: until you ask us to remove you.
• Server logs: deleted automatically by our hosting provider, at the latest after 90 days.
• Analytics: up to 2 years.
• Project view counts, usage records (which builds ran, AI usage) and failed-build reports: as long as the project exists, or until you ask us to erase them.
• Emails to us: as long as needed to help you, then deleted.

Without your consent we only store what the site needs to work. Analytics and ad cookies are set only after you click “Accept” in the cookie banner. You can change your choice at any time under “Cookie settings” at the bottom of every page; clearing your browser’s site data also resets it.

Always on (stored in your browser, never sent to anyone else):

• supabase_auth, auth_user: keep you signed in, until you log out.
• atech.cart.v1, atech.cart.build.v1: what is in your cart, until you empty it.
• theme, editor-prefs, atech_chat_width, atech_build_guide_*, project-*: your settings and open projects, until you clear site data.
• cookies-accepted: your answer to the cookie banner, until you change it.
• atech_kit_ordered:*, atech_checkout_project: that you ordered a kit for a project, so we don’t offer it again and can bring you back to it after paying.
• atech_age_blocked: that someone under 13 tried to sign up, so the age question can’t simply be answered again. Until you close the browser.
• login_redirect, waitlist_email, atech_via: where to send you after logging in, the email you used for the waitlist, and which link brought you to the editor (that one only until you close the tab).

Only after “Accept”:

• ph_*_posthog (PostHog, analytics): a cookie and local storage with a random visitor ID, 90 days.
• _gcl_au and other _gcl_* cookies (Google Ads): link an ad click to an order, up to 90 days. Before you accept, the tag still loads but sets no ad cookies (Google Consent Mode).
• exp-headline: which of two front-page headlines you see, so it stays the same between visits. Until you clear site data or decline.

Under the GDPR you can ask us to:

• see the data we hold about you, and get a copy;
• correct it;
• delete it;
• limit how we use it, or object to it;
• send it to you or another service in a common format;
• withdraw a consent you gave, at any time.

Email [email protected]; we answer within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.

To create an account you need to give an email address and your month and year of birth; to order, a name, email and delivery address. Without them we cannot give you an account or deliver your order. Everything else is optional. We do not make decisions about you by automated means alone, and we do not build profiles of you beyond the analytics described above.

Accounts are for people aged 13 and over. When you sign up we ask for your month and year of birth; we keep only whether you are 13 or older, never the date. If you are under 13, no account is made (or, for Google and GitHub sign-in, the account is closed). Atech kits are for ages 14 and up and are not toys; younger children should not use them.

If we change this policy, we update the date at the top. If a change matters to you, we tell you by email.