Privacy Policy

Updated October 13, 2026

This Privacy Policy applies to AKI.IO GmbH, the website https://aki.io, and all related services, including access to AI models hosted or operated by AKI.IO or third-party model providers (together the “Services”). AKI.IO GmbH acts as the controller within the meaning of Art. 4(7) GDPR in relation to its own processing of personal data. Where customers use the Services to process personal data they provide, AKI.IO acts as processor as described in Section 12 and processes such data solely on the customer’s documented instructions.

1. Controller

AKI.IO GmbH

Marienburger Str. 1

10405 Berlin, Germany

Email: privacy@aki.io

Data Protection Officer

AKI.IO GmbH is not required to appoint a data protection officer under applicable law. For all data protection enquiries, please contact privacy@aki.io.

2. Principles of Processing

We process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality pursuant to Art. 5 GDPR. Access to personal data is restricted to authorised personnel on a strict need-to-know basis and protected by appropriate technical and organisational measures.

Where possible, we process personal data within the European Economic Area (EEA). However, certain third-party services may involve transfers of personal data to countries outside the EEA, including the United States. This may include marketing and advertising services used only on the basis of your consent, as well as third-party identity providers where you voluntarily choose to sign in through Google or GitHub.

Where AKI.IO transfers personal data to a country outside the EEA, we rely on transfer mechanisms permitted under applicable data protection law, such as an adequacy decision or appropriate safeguards. Google and GitHub process personal data in connection with their identity services under their own responsibility. Further information is available in their respective privacy notices referenced in Section 6.

3. Categories of Personal Data

We process the following categories of personal data:

  • Identification data (name, username, title)
  • Contact and master data (email address, billing address, phone number)
  • Financial and payment data (registered address, bank details, VAT-ID)
  • Transaction data (payments)
  • Technical data (IP address, device and browser information)
  • Account and profile data (login credentials, support requests)
  • Authentication and security data (authentication status, two-factor authentication configuration data, and security-relevant authentication events)
  • Third-party identity-provider data, where you choose to sign in through Google or GitHub (provider-specific user identifier, email address, email-verification status, and profile information made available through the selected sign-in method, such as name, username, or profile image)
  • Content Data (e.g., prompts, document content, extracted text, model inputs and outputs, and embeddings, to the extent they contain or constitute personal data)
  • Usage data (interaction with website and services)
  • Customer Personal Data: personal data contained in prompts, documents, text, files, or other content submitted by or on behalf of a customer to the Services for processing by AKI.IO as a processor under the applicable Data Processing Agreement. Customer Personal Data does not include account, billing, usage, security, or other personal data processed by AKI.IO as an independent controller.

4. Legal Bases for Processing

Each processing activity is based on one dominant legal basis:

  • Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR: compliance with a legal obligation
  • Art. 6(1)(f) GDPR: legitimate interests
  • Art. 6(1)(a) GDPR: consent, where explicitly obtained

Our legitimate interests include ensuring IT security, preventing fraud and misuse, maintaining platform stability, and conducting proportionate B2B communication where lawful.

5. Recipients and Categories of Recipients

  • providers of data hosting, cloud infrastructure, and technical operations services, acting as service providers for AKI.IO’s own processing and, where they process Customer Personal Data in connection with the Services, as processors or sub-processors
  • providers of authentication, email, communication, and customer support services
  • Google and GitHub, where you actively choose to use their respective sign-in options
  • payment service providers and financial institutions involved in payment processing
  • tax advisers, accountants, auditors, and other professional advisers
  • providers of compliance, fraud prevention, sanctions screening, and security services
  • analytics and advertising providers, but only where the relevant processing is based on your consent
  • public authorities, courts, regulators, or other third parties where disclosure is required by law or necessary to establish, exercise, or defend legal claims

Where third-party service providers process personal data on our behalf, they act only on our documented instructions and under appropriate contractual safeguards, including data processing agreements where required by law.

b. Specific recipients and sub-processors

The current list of third-party processors and sub-processors used in connection with the Services, including their roles, processing purposes, categories of data, processing locations, retention and deletion conditions, information on use for training or product improvement, and information on international data transfers and applicable safeguards, is available in the separate document "AKI.IO Sub-processors and Service Providers" at https://aki.io/processors. The list forms part of the transparency information and may be updated when the relevant providers or processing activities change. Where a third-party processor or sub-processor processes Customer Personal Data on behalf of AKI.IO, the processing is carried out on documented instructions and subject to the applicable Data Processing Agreement.

6. Account Registration and Service Provision

For registration, authentication, and management of user and company accounts, we process identification, contact, account, and authentication data.

We offer users the optional ability to register for and sign in to AKI.IO through Google or GitHub (“Third-Party Identity Providers”). When you choose one of these sign-in methods, the relevant provider authenticates you directly. AKI.IO does not receive or store your password for your Google or GitHub account.

Information required for the provision of data

The provision of the data marked as mandatory during registration, account administration, ordering, billing, or use of the Services is necessary to conclude or perform the relevant contract, or to comply with statutory obligations. If you do not provide the required data, we may be unable to create or maintain your account, provide the requested Services, process payments, or comply with applicable legal obligations. Any optional data fields are identified as optional at the time of collection. Where processing is based on consent, providing the data is voluntary and consent may be withdrawn at any time with effect for the future.

Dominant legal basis: Art. 6(1)(b) GDPR.

7. Communication and Contractual Information

We process contact data exclusively to provide contractual information, service-related notices, billing communications, and other transactional emails necessary for the performance of the contract. No marketing or promotional emails are sent.

Dominant legal basis: Art. 6(1)(b) GDPR.

8. Billing and Payments

Payment, invoicing, and transaction data are processed to execute payments and comply with statutory accounting and tax obligations.

Dominant legal basis: Art. 6(1)(b) GDPR; for statutory retention, Art. 6(1)(c) GDPR.

9. Technical Logs, Security, and Error Analysis

Technical logs, security-relevant authentication events, and usage data are processed solely to ensure platform security, stability, authentication security, fraud prevention, and error resolution. Processing is limited to what is technically necessary.

OAuth authorization codes, OAuth access tokens, and refresh tokens are not included in application or security logs.

Dominant legal basis: Art. 6(1)(f) GDPR.

10. Legal Obligations and Compliance

We process personal data to comply with legal obligations, including tax law, accounting, anti-money laundering, sanctions, and regulatory requirements.

Dominant legal basis: Art. 6(1)(c) GDPR.

11. Fraud Prevention and Sanctions Screening

Identification and transaction data may be processed to prevent fraud and perform sanctions list checks.

Dominant legal basis: Art. 6(1)(f) GDPR (in combination with applicable EU sanctions law where relevant).

12. B2B AI Model Hosting and Processing on Behalf of Customers

When customers use our platform to process personal data via hosted AI models, AKI.IO acts as a processor within the meaning of Art. 28 GDPR. Processing is carried out solely on documented instructions of the customer. The Data Processing Agreement (DPA) is part of the contractual relationship between customer and AKI.IO and is made available during company registration and can be accessed at any time in the authenticated user backend.

Customer Personal Data processed directly by AKI.IO is processed only in volatile memory for the purpose of providing the requested service and is not logged, stored, or analyzed by AKI.IO. Usage data, which are not Customer Personal Data, such as request metadata, request ID, model endpoint, request status, timestamps, and token usage, which are necessary for billing and service maintenance purposes, is retained for 90 days.

Where Customer Personal Data is processed by third-party processors or sub-processors listed in Section 5.b, the applicable Trust Level, as specified in Section 13, determines the relevant processing conditions.

13. Trust Levels for AI model processing

AKI.IO classifies AI models and inference endpoints according to policy-based Trust Levels that define minimum requirements for data residency, provider jurisdiction and ownership, zero data retention, model training, data processing agreements, international transfers, and, where applicable, § 203 StGB readiness. A higher Trust Level means stricter controls. AKI.IO displays and routes requests only to models and endpoints that meet or exceed the Trust Level selected or required for the relevant use case.

The Trust Levels are defined in 4.2 of the Data Processing Agreement (DPA).

The applicable Trust Level depends on the model or endpoint selected and the customer’s configuration. The relevant processing location, provider role, retention and training controls, transfer safeguards, and other provider-specific details are made available in the applicable DPA, sub-processor documentation, and service configuration. Where AKI.IO processes the data itself, the applicable AKI.IO controls apply. Where a third-party model provider is used, that provider processes Customer Content as AKI.IO’s sub-processor under the applicable contractual and technical safeguards and only at the Trust Level permitted for the relevant request.

Customer responsibility for Trust Level selection.

Customers are responsible for selecting a Trust Level that is appropriate for the nature and sensitivity of the data submitted to the relevant AI model or inference endpoint. Unless expressly approved otherwise in the applicable service configuration or Data Processing Agreement, customers must not submit special categories of personal data within the meaning of Article 9 GDPR, data protected by professional secrecy obligations, or other highly confidential or particularly sensitive information to AI models or endpoints classified as TL0 or TL1. Personal data may be submitted to TL0 or TL1 endpoints only where the customer has assessed and accepted the applicable processing conditions, including the processing location, international transfers, retention, security, and any provider-specific policies concerning data use. Where the customer requires stricter controls, including defined transfer safeguards, no model training, or zero data retention, the customer must select at least TL2 or a higher applicable Trust Level.

14. Website Analytics (Matomo)

We use the web analytics tool Matomo, hosted on our own servers within the EEA, to analyze website usage.

Dominant legal basis: Art. 6(1)(f) GDPR.

No data is transferred to third countries. You may object to this processing at any time via the opt-out mechanism.

Cookie and consent management

Non-essential cookies, pixels, tags, and similar technologies are blocked before consent is given. Consent is recorded by Cookie Settings and can be withdrawn or changed at any time via the button "Cookie Settings" on the website.

15. Online Advertising, Conversion Tracking, Remarketing (Google Ads and LinkedIn Ads)

Providers

Google Ads: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

LinkedIn Ads: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

How the services work

If you give your consent, we may use the Google tag and Google Ads conversion tracking features as well as the LinkedIn Insight Tag on our website. These technologies allow us to determine whether users reached our website via an advertisement, whether defined conversion events occurred, and whether website visitors can be grouped into audiences for remarketing purposes.

Depending on the configuration, the providers may process in particular the following categories of data:

  • IP address
  • browser and device information
  • timestamp
  • page views and referrer URL
  • event data and conversion data
  • cookie identifiers, advertising identifiers, or similar online identifiers
  • information about prior ad interactions
  • Purposes of processing
  • We process this data for the following purposes:
  • measuring and evaluating advertising performance
  • attribution of conversions to advertising campaigns
  • building remarketing audiences
  • displaying interest-based advertising on Google and LinkedIn platforms
  • improving the efficiency of our marketing activities

Legal basis

The use of these technologies on our website takes place solely on the basis of your consent pursuant to Art. 6(1)(a) GDPR and, where applicable, Section 25 TDDDG. You may withdraw your consent at any time with effect for the future via our cookie settings.

Data sharing and independent responsibility of the providers

When these services are activated, personal data may be transmitted to Google and LinkedIn or collected by them directly via the respective tags. Further processing by the providers is carried out under their own responsibility in accordance with their privacy notices. This may include processing for conversion measurement, audience creation, attribution, fraud prevention, and security.

International data transfers

Use of Google Ads and LinkedIn Ads may involve transfers of personal data to recipients outside the EEA, in particular to the United States. According to the providers, such transfers are based on mechanisms recognized under applicable data protection law, such as participation in the EU-U.S. Data Privacy Framework and/or the use of standard contractual clauses, where applicable.

Storage period

We do not determine all storage periods applied by Google or LinkedIn. Storage and further processing by these providers are governed by their respective privacy policies and product settings.

For Google Ads remarketing, membership in a website visitor audience is generally set for 30 days by default and may be configured for up to 540 days. Certain Google advertising technologies are subject to separate retention periods. In the EEA, Switzerland and the United Kingdom, the Google IDE and id advertising cookies generally remain for 13 months, while _gcl_ cookies used for advertising and conversion measurement generally remain for 90 days.

For the LinkedIn Insight Tag, LinkedIn states that information directly identifying a member is removed from the collected data within 7 days and that the remaining pseudonymized data is deleted within 180 days. For website retargeting audiences, the selected audience membership period may range from 30 to 180 days.

Consent records maintained by us are stored for as long as the relevant consent remains valid and for a further three years for evidentiary purposes.

Further information about the data processing practices of these providers can be found in their respective privacy policies:

Google: https://policies.google.com/privacy

LinkedIn: https://www.linkedin.com/legal/privacy-policy

16. Communication Requests

Personal data transmitted via email, phone, or contact forms is processed solely to handle inquiries.

Dominant legal basis: Art. 6(1)(b) GDPR or, where no contractual relationship exists, Art. 6(1)(f) GDPR.

17. Social media platforms

The social media platforms operated by AKI.IO are:

When you visit or interact with our social media profiles, personal data may be processed both by AKI.IO and by the respective platform provider. This may include your profile information, username, comments, reactions, messages, and other information that you provide or make available through the platform.

AKI.IO processes such data for the purpose of operating its social media presence, communicating with users, responding to inquiries, and providing information about AKI.IO and its services.

The dominant legal basis for this processing is Art. 6(1)(f) GDPR, based on our legitimate interest in corporate communication, public relations, and communication with customers, partners, and interested parties. Where communication relates to an existing or prospective contractual relationship, Art. 6(1)(b) GDPR may apply.

a. LinkedIn

The provider responsible for LinkedIn users in the European Economic Area is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

For the processing of personal data of members in the European Economic Area or Switzerland for the purpose of generating LinkedIn Page Insights, AKI.IO and LinkedIn Ireland Unlimited Company act as joint controllers pursuant to Art. 26 GDPR.

The applicable arrangement is LinkedIn's Page Insights Joint Controller Addendum: LinkedIn Page Insights Joint Controller Addendum

Under this arrangement, LinkedIn is responsible in particular for the processing required to generate Page Insights, for providing information to data subjects, for handling data-subject requests relating to Page Insights, and for implementing appropriate security measures. AKI.IO is responsible for complying with the GDPR obligations arising from its own use of Page Insights.

The Page Insights made available to AKI.IO consist of aggregated information. According to LinkedIn's Joint Controller Addendum, LinkedIn does not provide AKI.IO with identifiable personal data of individual members through Page Insights.

Data subjects may exercise their GDPR rights against either joint controller. LinkedIn states that requests relating to Page Insights can be submitted through LinkedIn account settings or directly to LinkedIn. Requests received by AKI.IO concerning Page Insights will be handled in accordance with the Joint Controller Addendum.

For processing carried out by LinkedIn in connection with the general operation of the LinkedIn platform outside the scope of Page Insights, LinkedIn acts as an independent controller. AKI.IO acts as an independent controller for personal data that it itself processes in connection with communications and interactions through its LinkedIn page.

Further information on LinkedIn's processing of personal data is available in the LinkedIn Privacy Policy: LinkedIn Privacy Policy

b. Bluesky

Bluesky is operated by Bluesky Social, PBC.

Bluesky's published privacy documentation does not provide for an Art. 26 GDPR joint-controller arrangement applicable to organizations operating profiles on Bluesky. Bluesky states that it acts as the controller for personal data processed in connection with its services.

Accordingly, AKI.IO and Bluesky act as independent controllers for their respective processing activities. AKI.IO is responsible for personal data that it processes in connection with operating the AKI.IO profile and communicating or interacting with users. Bluesky is independently responsible for processing carried out for the operation, security, analytics, and functionality of the Bluesky platform.

Requests concerning processing by Bluesky may be addressed to support@bsky.app. Bluesky has also appointed a Data Protection Officer at dpo@ametrosgroup.com and an EU Data Protection Representative at gdpr@ametrosgroup.com.

Further information on Bluesky's processing of personal data and the exercise of data-subject rights is available in the Bluesky Privacy Policy: Bluesky Privacy Policy

Dominant legal basis: Art. 6(1)(f) GDPR.

18. Data Retention

Storage periods by processing activity

The following periods or criteria apply: account and authentication data: for the duration of the contractual relationship and, following termination, 90 days, except where specific data must be retained for longer due to statutory retention obligations; billing and accounting data: 10 years; technical metadata, including token counts and API key IDs: 90 days, except for billing-relevant metadata, which is retained for 10 years; security logs: 90 days as a standard retention period and, in the event of a security incident, for longer where necessary for investigation purposes; web server access logs: a maximum of 14 days; support data: 12 months while active and a further 24 months in archived form, after which it is deleted; consent records: for as long as the consent remains valid and for a further 3 years for evidentiary purposes; claims-related data: until the relevant claim is finally resolved or the applicable limitation period has expired, subject to any longer statutory retention obligation. Backups are deleted or overwritten after 30, 60 or 90 days, depending on the applicable backup class. Data held by third-party providers is retained in accordance with the periods stated in their applicable privacy notices and contractual arrangements and is subject to the contractual deletion obligations applicable to processors.

Third-party identity-provider identifiers and two-factor authentication configuration data are retained for as long as they are necessary to maintain the relevant user account, provide the selected authentication method, or protect the account against unauthorised access.

Revoking AKI.IO’s authorization in Google or GitHub does not by itself delete an AKI.IO account. Requests for account deletion may be submitted to support@aki.io.

19. Rights of Data Subjects

You have the following rights under the GDPR:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

Exercise of rights and response time

Requests concerning data subject rights may be submitted to privacy@aki.io. We generally respond within one month of receiving the request. This period may be extended by up to two further months where necessary due to the complexity or number of requests; we will inform you of any such extension and the reasons for it. We may request information necessary to confirm your identity where there are reasonable doubts about the identity of the requester.

20. Supervisory Authority

Berlin Commissioner for Data Protection and Freedom of Information.

Friedrichstrasse 219

10969 Berlin, Germany

Phone: 030 13889-0

Fax: 030 2155050

Email: mailbox@datenschutz-berlin.de

https://www.datenschutz-berlin.de/

21. Automated Decision-Making and Profiling

We do not use personal data for profiling that produces legal or similarly significant effects.

22. Cookies

We use necessary technologies required for the operation, security, account authentication, two-factor authentication, and basic functionality of our website and Services (essential cookies and similar technologies). These may include session identifiers and security-related values required to protect authentication flows against misuse.

Google and GitHub sign-in scripts are not loaded merely because you visit the website or the sign-in page. They are loaded only after you actively select the relevant Google or GitHub sign-in option. The subsequent authentication process takes place with the selected provider under its own responsibility.

In addition, we use optional analytics and advertising technologies only if you have given your consent (non-essential cookies). Optional technologies may include tools for website analytics, conversion measurement, and remarketing. These technologies may store information on your device or access information already stored on your device, for example through cookies, pixels, tags, or similar technologies.

You can give, refuse, or withdraw your consent at any time via our cookie settings. Refusing or withdrawing consent does not affect the lawfulness of processing carried out before withdrawal and does not impair the availability of the website’s essential functions.

23. Amendments

This Privacy Policy may be updated from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.