Privacy Policy

Last Updated: June 26, 2026

This Privacy Policy applies to AKI.IO GmbH, the website https://aki.io, and all related services, including the AI model hosting platform (together the “Services”). AKI.IO GmbH acts as the controller within the meaning of Art. 4(7) GDPR. Where customers use the platform to process personal data on their own behalf, AKI.IO acts as processor as described in Section 12.

1. Controller

AKI.IO GmbH
Marienburger Str. 1
10405 Berlin, Germany
Email: privacy@aki.io

2. Principles of Processing

We process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality pursuant to Art. 5 GDPR. Access to personal data is restricted to authorised personnel on a strict need-to-know basis and protected by appropriate technical and organisational measures in line with ISO/IEC 27001.

Where possible, we process personal data within the European Economic Area (EEA). However, certain third-party services may involve transfers of personal data to countries outside the EEA, including the United States. This may include marketing and advertising services used only on the basis of your consent, as well as third-party identity providers where you voluntarily choose to sign in through Google or GitHub.

Where AKI.IO transfers personal data to a country outside the EEA, we rely on transfer mechanisms permitted under applicable data protection law, such as an adequacy decision or appropriate safeguards. Google and GitHub process personal data in connection with their identity services under their own responsibility. Further information is available in their respective privacy notices referenced in Section 6.

3. Categories of Personal Data

We process the following categories of personal data:

• Identification data (name, username, title)
• Contact and master data (email address, billing address, phone number)
• Financial and payment data (registered address, bank details, VAT-ID)
• Transaction data (payments)
• Technical data (IP address, device and browser information)
• Account and profile data (login credentials, support requests)
• Authentication and security data (authentication status, two-factor authentication configuration data, and security-relevant authentication events)
• Third-party identity-provider data, where you choose to sign in through Google or GitHub (provider-specific user identifier, email address, email-verification status, and profile information made available through the selected sign-in method, such as name, username, or profile image)
• Usage data (interaction with website and services)

4. Legal Bases for Processing

Each processing activity is based on one dominant legal basis:

• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR: compliance with a legal obligation
• Art. 6(1)(f) GDPR: legitimate interests
• Art. 6(1)(a) GDPR: consent, where explicitly obtained

Our legitimate interests include ensuring IT security, preventing fraud and misuse, maintaining platform stability, and conducting proportionate B2B communication where lawful.

5. Recipients and Categories of Recipients

We disclose personal data only where necessary for the purposes described in this Privacy Policy and only to the extent permitted by applicable law. Depending on the relevant processing activity, personal data may be disclosed to the following categories of recipients:

• providers of hosting, infrastructure, and technical operations services
• providers of authentication, email, communication, and customer support services
• Google and GitHub, where you actively choose to use their respective sign-in options
• payment service providers and financial institutions involved in payment processing
• tax advisers, accountants, auditors, and other professional advisers
• providers of compliance, fraud prevention, sanctions screening, and security services
• analytics and advertising providers, but only where the relevant processing is based on your consent
• public authorities, courts, regulators, or other third parties where disclosure is required by law or necessary to establish, exercise, or defend legal claims

Where third-party service providers process personal data on our behalf, they act only on our documented instructions and under appropriate contractual safeguards, including data processing agreements where required by law.

Google and GitHub provide their identity services under their own responsibility and are not engaged by AKI.IO as processors for their independent processing in connection with those services.

6. Account Registration and Service Provision

For registration, authentication, and management of user and company accounts, we process identification, contact, account, and authentication data.

We offer users the optional ability to register for and sign in to AKI.IO through Google or GitHub (“Third-Party Identity Providers”). When you choose one of these sign-in methods, the relevant provider authenticates you directly. AKI.IO does not receive or store your password for your Google or GitHub account.

Dominant legal basis: Art. 6(1)(b) GDPR.

7. Communication and Contractual Information

We process contact data to provide contractual information, service-related notices, billing communications, support-related communication, and other transactional messages necessary for the performance of the contract.

Marketing or promotional emails are sent only where you have expressly consented to receive them or where otherwise permitted under applicable law. You may withdraw your consent at any time with effect for the future.

Dominant legal basis: Art. 6(1)(b) GDPR for contractual and service-related communications; Art. 6(1)(a) GDPR for marketing communications based on consent.

8. Billing and Payments

Payment, invoicing, and transaction data are processed to execute payments and comply with statutory accounting and tax obligations.

Dominant legal basis: Art. 6(1)(b) GDPR; for statutory retention, Art. 6(1)(c) GDPR.

9. Technical Logs, Security, and Error Analysis

Technical logs, security-relevant authentication events, and usage data are processed solely to ensure platform security, stability, authentication security, fraud prevention, and error resolution. Processing is limited to what is technically necessary.

OAuth authorization codes, OAuth access tokens, and refresh tokens are not included in application or security logs.

Dominant legal basis: Art. 6(1)(f) GDPR.

10. Legal Obligations and Compliance

We process personal data to comply with legal obligations, including tax law, accounting, anti-money laundering, sanctions, and regulatory requirements.

Dominant legal basis: Art. 6(1)(c) GDPR.

11. Fraud Prevention and Sanctions Screening

Identification and transaction data may be processed to prevent fraud and perform sanctions list checks.

Dominant legal basis: Art. 6(1)(f) GDPR (in combination with applicable EU sanctions law where relevant).

12. B2B AI Model Hosting and Processing on Behalf of Customers

When customers use our platform to process personal data via hosted AI models, AKI.IO acts as a processor within the meaning of Art. 28 GDPR. Processing is carried out solely on documented instructions of the customer.

Customer-provided content, including prompts, inputs, and generated outputs, is not logged, stored, or analysed by AKI.IO. Processing occurs exclusively in volatile memory for the purpose of providing the requested service.

A Data Processing Agreement (DPA) is made available during company registration and can be accessed at any time in the authenticated user backend.

13. Website Analytics (Matomo)

We use the web analytics tool Matomo, hosted on our own servers within the EEA, to analyse website usage.

Dominant legal basis: Art. 6(1)(f) GDPR.

No data is transferred to third countries. You may object to this processing at any time via this opt-out mechanism: