Privacy policy
Legal
Controller
AtherosAI B.V., Vinkenburgstraat 2 A, 3512 AB Utrecht, Nederland. Privacy contact: info@atherosai.com.
Our role
For the website, account and billing data we are the controller. For the sustainability data our customers enter into we act as processor on their behalf, under a data processing agreement.
Data we process
Account data (name, work e-mail, password hash), organisation and billing data, data entered by customers (sustainability figures, evidence files, supplier answers), contact-form enquiries, and technical logs (IP address, request times) for security and availability.
Purposes and legal bases
Providing the service (contract), billing and tax obligations (legal obligation), security, abuse prevention and availability monitoring (legitimate interest), answering enquiries (legitimate interest / pre-contractual steps).
Sub-processors
Amazon Web Services (hosting and e-mail, EU – Frankfurt), Stripe (payments), Anthropic (AI features: the relevant text is sent only when a user uses an AI feature; it is not used for model training).
Retention
Customer data for the duration of the contract and up to 90 days after it ends; invoices for 7 years as required by law; security logs for up to 12 months.
Your rights
Access, rectification, erasure, restriction, portability and objection. Write to info@atherosai.com. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Transfers
Data is stored in the EU. Where a sub-processor processes data outside the EU, transfers rely on the EU Standard Contractual Clauses. Turkish customers: transfers abroad follow the KVKK rules on cross-border transfers.