---
title: "Privacy Policy"
date: 2026-11-05
language: en
canonical: https://atelier201.com/privacy-policy
source: Atelier201 legal
---
# Privacy Policy

**Last updated:** November 5, 2026

Atelier201 is operated by Guillaume Duvernay, Unternehmensberatung für digitale Transformation, Richard-Sorge-Straße, 10249 Berlin, Germany ("we", "us"). We are the controller of the personal data described here. Questions and requests: hi@atelier201.com.

This policy covers the website atelier201.com, the dashboard, the API, the MCP server and the CLI ("the Services"). The websites our customers publish with Atelier201 are theirs: each customer is the controller of the personal data their own site collects from its visitors, and we process it on their behalf only to host the site and measure its audience, under the [data processing agreement](/terms-and-conditions#annex-data-processing-agreement) in our terms. Services a customer adds to their site (forms, booking, chat, analytics, videos, maps) receive visitors' data directly from the visitor's browser, under that customer's responsibility and the service's own terms. If you visited such a site, contact its owner first; we will pass on any request we receive.

## What we process, and why

| Data | Why | Legal basis (GDPR) |
| :--- | :--- | :--- |
| Account: email address, name, password hash, sign-in sessions | To create your account and keep it secure | Contract (Art. 6(1)(b)) |
| Workspace and site content: texts, files, images, site history, domains you connect | To store, build, preview and publish your sites | Contract |
| Billing: plan, Stripe customer and subscription identifiers, invoices | To charge for paid plans and keep accounting records | Contract and legal obligation (Art. 6(1)(c)) |
| Messages to the assistant and its answers | To run the assistant you asked for; traces are kept 7 days to investigate failures | Contract |
| Technical logs: IP address, browser, request times, errors | To operate, secure and debug the Services | Legitimate interest (Art. 6(1)(f)) |
| Audience measurement without cookies: page, referring site, country and city from the IP address, browser family, language, a daily hash of IP address and browser (key deleted after 48 hours) | To count visits and know which channels bring people | Legitimate interest (Art. 6(1)(f)) |
| Analytics cookie `duv_id` (returning visits, first page that brought you) | To attribute sign-ups to the channel they came from | Consent (Art. 6(1)(a)), only if you accept analytics |
| Dashboard usage when signed in: pages, actions, and session recordings of the screens you use, including what you type and the content you work on (passwords are masked; API key pages are not recorded; kept 30 days) | To understand how the product is used and fix problems | Legitimate interest (Art. 6(1)(f)); you can object at any time |
| The code of a site's builds: its scripts, forms, embeds and redirects, and the name of the site | Automated checks that detect abuse of the hosting (phishing, malware) before a version goes public. What a person needs to judge is kept only when a check raises a doubt, until the site is deleted | Legitimate interest (Art. 6(1)(f)) |
| Contact form: name, email, message | To answer you | Legitimate interest |

We do not sell personal data, and we do not use your content to train AI models.

## Who processes data for us

| Provider | What it does | Where |
| :--- | :--- | :--- |
| Cloudflare, Inc. | Hosting of the Services and of published sites, database, file storage, email delivery, security | Global network; data at rest in Cloudflare's infrastructure |
| TypeSafe AI, Inc., through Cloudflare | The AI model behind the automated checks of a site's code | United States |
| Stripe Payments Europe, Ltd. | Payments and invoices | EU, with transfers under Stripe's safeguards |
| OpenRouter, Inc. and the model provider it routes to | Answers of the assistant, only when you use it | United States |
| Slack and our n8n instance | Delivery of contact-form messages and error alerts to us | United States and EU |

Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, as offered by each provider.

## How long we keep data

- Account and workspace data: as long as the account exists. When you delete a site, its files, history and addresses are removed; when you delete your account, its workspaces and sites are removed with it, except what we must keep by law.
- Billing records: 10 years, as German tax law requires.
- Assistant traces: 7 days.
- A site an AI agent prepared before you signed up: deleted 7 days after it was prepared if nobody claims it.
- Technical logs: up to 30 days.

## Your rights

You can ask for access to your data, its correction, its deletion, the restriction of its processing, a copy in a portable format, and object to processing based on legitimate interest. You can withdraw an analytics consent at any time from the cookie settings, and object to the measurement of your signed-in usage or to session recording by writing to us. Write to hi@atelier201.com; we answer within one month. You may also complain to a supervisory authority, for example the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

## Security

Data travels over HTTPS. Each site is built in an isolated container with no network access, passwords are stored as hashes, and API keys are stored as keyed hashes. Access to production systems is limited to the operator.

## Changes

We will update this page when what we process changes, and change the date at the top. Significant changes are announced by email to account holders.