Privacy policy for the Atomixi service (app.atomixi.com)

This English version is provided for convenience. The German version is binding.

1. Controller

Monib Asad Masud, c/o maexware solutions GmbH, z. Hd. Monib Asad Masud, Freiburger Straße 9, 79312 Emmendingen, Germany, email info@atomixi.com.

2. In short

Atomixi stores what your AI programs explicitly send to it and gives it back to you and to those programs. Everything is kept on our server in Germany. We do not read chat histories, we do not sell data, and we do not train AI models on your content.

3. Hosting

The service runs on a server of netcup GmbH, Karlsruhe, in a data centre in Germany. netcup processes the data on our behalf (Art. 28 GDPR). Connections are encrypted with TLS.

4. Your account

When you create an account we store your email address, a name if you give one, when the account was created and whether your address is confirmed. We store your password only as an Argon2 hash, which we cannot read. We send a confirmation link valid for 24 hours; you can sign in once you have used it. An account not confirmed within 7 days is deleted. A link to set a new password is valid for one hour. When your password changes we notify your address. After you sign in we set one cookie, __Host-atomixi_session, which keeps you signed in for at most seven days. The service sets no other cookie. The cookie is strictly necessary (§ 25(2) no. 2 TDDDG). Legal basis: Art. 6(1)(b) GDPR (user agreement).

5. Your content

Your content is the spaces, entries, relations, memories and rules that you or your connected programs create. We store it so that you and your programs can retrieve it. For each text our server computes a vector used for search by meaning; the model runs on our own server and your texts go to no one for this. For each relation we count how often and when it was last used, so that what is used often is found more easily. Search queries are used for the search only and are not stored. Atomixi refuses texts that look like a password, an access key, a private key, a card number or an ID number; this filter does not catch everything, so please do not store such data. We do not look at your content unless you ask us to or the law requires it. Legal basis: Art. 6(1)(b) GDPR.

6. Connected programs and keys

You can connect programs such as Claude, ChatGPT, Cursor or your own scripts, by OAuth sign-in or with an API key. We store the program's name and address, the rights and spaces you gave it, and when. Access keys are stored only as hashes; an API key is shown once when it is created. A program sees only the spaces you select, and you can disconnect any program or key at any time. What a connected program does with content it retrieves is up to its provider and governed by that provider's privacy policy, for example Anthropic's or OpenAI's. If a program signs in with its own metadata address, our server fetches that address to check the program's name and redirect address; no data about you is sent. Legal basis: Art. 6(1)(b) GDPR.

7. Protection against abuse

To limit sign-in attempts, registrations and other requests we process your IP address in memory. It counts only within windows of at most 60 minutes, is never written to disk and is gone after a restart of the service. For refused requests, failed program sign-ins and granted consents the server writes a line with IP address, account identifier and time to its log; no content is logged. Logs are deleted after 14 days at the latest. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure service.

8. Emails

We only send emails that belong to your account: confirmation, new password, notice of a changed password, and with paid plans order confirmation, invoice and cancellation confirmation. We send no advertising. The mail server on our own server delivers these emails directly to the mail server of your mailbox; we use no third-party sending service for them.

9. Payment

Paid plans are handled by Stripe. Customers in the EU and business customers pay us; Stripe Payments Europe, Ltd., Dublin, Ireland, is then our payment provider. Consumers outside the EU buy through Stripe Managed Payments; Link, LLC, USA is then your seller and responsible for the payment. In both cases you enter your payment details only with Stripe. We receive the plan, the amount, the period and an identifier, never a card number. Stripe may transfer data to the USA on the basis of the European Commission's standard contractual clauses (https://stripe.com/privacy). We keep order records (account identifier, plan, price, time, the version of the terms and withdrawal notice shown) as long as commercial and tax law requires (§ 147 AO, § 257 HGB). Legal basis: Art. 6(1)(b) and (c) GDPR.

10. How long we keep data

Your account and content are kept until you delete them. You delete single memories yourself or through your program (forget), and the whole account in the account settings with your password; we then remove at once all keys, spaces, content, links, programs and consents. When a paid plan ends, your account moves to the free plan; we delete nothing. We back up the service daily. Backups stay on the server for seven days. Encrypted copies are kept on our own storage media in Germany so that we can restore the service after a failure; they are deleted after 90 days and used for nothing else. Until then, something you deleted may still be in a backup.

11. If you store data about other people

If you, as a business, store personal data of other people in Atomixi, you are responsible for it and we process it on your behalf. We conclude a data processing agreement with you for this: atomixi.com/en/dpa/.

12. Recipients

Your data is received only by netcup as host, Stripe for paid plans, and the programs you connect yourself. We do not sell data or pass it on for advertising.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Most of this you can do yourself: export all content as one file, delete single items or the whole account. For anything else write to info@atomixi.com. You may lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

14. No automated decisions

We make no decisions about you based solely on automated processing (Art. 22 GDPR). Limiting sign-in attempts delays requests; it locks no account.

Version: 20 October 2026