Privacy Policy

Last Updated: March 16, 2026

This Privacy Policy applies to AKI.IO GmbH, the website https://aki.io, and all related services, including the AI model hosting platform (together the “Services”). AKI.IO GmbH acts as the controller within the meaning of Art. 4(7) GDPR. Where customers use the platform to process personal data on their own behalf, AKI.IO acts as processor as described in Section 12.

1. Controller

AKI.IO GmbH
Marienburger Str. 1
10405 Berlin, Germany
Email: privacy@aki.io

2. Principles of Processing

We process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality pursuant to Art. 5 GDPR. Access to personal data is restricted to authorised personnel on a strict need-to-know basis and protected by appropriate technical and organisational measures in line with ISO/IEC 27001.

Where possible, we process personal data within the European Economic Area (EEA). However, certain third-party marketing and advertising services that we use only on the basis of your consent may involve transfers of personal data to countries outside the EEA, including the United States. In such cases, we rely on the transfer mechanisms provided by applicable data protection law, such as an adequacy decision or other appropriate safeguards implemented by the relevant provider.

3. Categories of Personal Data

We process the following categories of personal data:

• Identification data (name, username, title)
• Contact and master data (email address, billing address, phone number)
• Financial and payment data (registered address, bank details, VAT-ID)
• Transaction data (payments)
• Technical data (IP address, device and browser information)
• Account and profile data (login credentials, support requests)
• Usage data (interaction with website and services)

4. Legal Bases for Processing

Each processing activity is based on one dominant legal basis:

• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR: compliance with a legal obligation
• Art. 6(1)(f) GDPR: legitimate interests
• Art. 6(1)(a) GDPR: consent, where explicitly obtained

Our legitimate interests include ensuring IT security, preventing fraud and misuse, maintaining platform stability, and conducting proportionate B2B communication where lawful.

5. Recipients and Categories of Recipients

We disclose personal data only where necessary for the purposes described in this Privacy Policy and only to the extent permitted by applicable law. Depending on the relevant processing activity, personal data may be disclosed to the following categories of recipients:

• providers of hosting, infrastructure, and technical operations services
• providers of authentication, email, communication, and customer support services
• payment service providers and financial institutions involved in payment processing
• tax advisers, accountants, auditors, and other professional advisers
• providers of compliance, fraud prevention, sanctions screening, and security services
• analytics and advertising providers, but only where the relevant processing is based on your consent
• public authorities, courts, regulators, or other third parties where disclosure is required by law or necessary to establish, exercise, or defend legal claims

Where third-party service providers process personal data on our behalf, they act only on our documented instructions and under appropriate contractual safeguards, including data processing agreements where required by law.

6. Account Registration and Service Provision

For registration, authentication, and management of user and company accounts, we process identification, contact, and login data.

Dominant legal basis: Art. 6(1)(b) GDPR.

7. Communication and Contractual Information

We process contact data to provide contractual information, service-related notices, billing communications, support-related communication, and other transactional messages necessary for the performance of the contract.

Marketing or promotional emails are sent only where you have expressly consented to receive them or where otherwise permitted under applicable law. You may withdraw your consent at any time with effect for the future.

Dominant legal basis: Art. 6(1)(b) GDPR for contractual and service-related communications; Art. 6(1)(a) GDPR for marketing communications based on consent.

8. Billing and Payments

Payment, invoicing, and transaction data are processed to execute payments and comply with statutory accounting and tax obligations.

Dominant legal basis: Art. 6(1)(b) GDPR; for statutory retention, Art. 6(1)(c) GDPR.

9. Technical Logs, Security, and Error Analysis

Technical logs and usage data are processed solely to ensure platform security, stability, and error resolution. Processing is limited to what is technically necessary.

Dominant legal basis: Art. 6(1)(f) GDPR.

10. Legal Obligations and Compliance

We process personal data to comply with legal obligations, including tax law, accounting, anti-money laundering, sanctions, and regulatory requirements.

Dominant legal basis: Art. 6(1)(c) GDPR.

11. Fraud Prevention and Sanctions Screening

Identification and transaction data may be processed to prevent fraud and perform sanctions list checks.

Dominant legal basis: Art. 6(1)(f) GDPR (in combination with applicable EU sanctions law where relevant).

12. B2B AI Model Hosting and Processing on Behalf of Customers

When customers use our platform to process personal data via hosted AI models, AKI.IO acts as a processor within the meaning of Art. 28 GDPR. Processing is carried out solely on documented instructions of the customer.

Customer-provided content, including prompts, inputs, and generated outputs, is not logged, stored, or analysed by AKI.IO. Processing occurs exclusively in volatile memory for the purpose of providing the requested service.

A Data Processing Agreement (DPA) is made available during company registration and can be accessed at any time in the authenticated user backend.

13. Website Analytics (Matomo)

We use the web analytics tool Matomo, hosted on our own servers within the EEA, to analyse website usage.

Dominant legal basis: Art. 6(1)(f) GDPR.

No data is transferred to third countries. You may object to this processing at any time via this opt-out mechanism: