Privacy Statement

Effective 2026-07-06 · Last updated 2026-10-31

Aitonomy B.V., is responsible for the personal data it collects when you visit joinaitonomy.ai, get in touch, or use the Aitonomy platform. This statement sets out what we collect, why, and the rights you have. Where we process personal data on behalf of a customer through the platform, we act as a processor, and that processing is governed by our Data Processing Agreement rather than this statement.

Who we are

The controller of your personal data is Aitonomy B.V., established in Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 42198573. You can reach us about privacy at mik@joinaitonomy.ai.

The personal data we collect

When you visit the website. Our own self-hosted, cookieless analytics (Umami) processes limited technical data such as your IP address, device and browser type, and the pages you view, only to produce aggregated, anonymous statistics; it does not store your IP address. We use this only in aggregate to secure and improve the site, on the basis of our legitimate interest in keeping the site secure and understanding how it is used; it is not used to identify you. Our use of cookies and similar technologies is described in our Cookie Policy.

When you contact us. If you fill in a form or email us, we collect the details you provide, such as your name, business email, company, role and message. Form submissions are handled by our own contact service and delivered to us by email through Scaleway Transactional Email (an EU provider), or, if it is unavailable, through our standby email provider listed in our Sub-processors list, so that we can respond to you.

When you use the Service. We process account data for the people a customer authorises to use the Service: their business email address, the team or teams they belong to and, where the customer uses it, a cost centre, to set up and administer their access. We do not hold passwords: users sign in through their own organisation's identity provider or with a single-use sign-in link. We also process sign-in events and usage metadata generated as the Service runs, with their time and technical details, to operate, secure and bill the service; for that processing we are the controller. The record of what agents did, including model and tool calls, belongs to the customer: we keep it on their behalf as a processor under our Data Processing Agreement, so that they can account for what ran. Separately, the data and content a customer connects to or processes through the Service, for example from their documents, records and business systems, is Customer Data. It may contain personal data, and we process it only as a processor on the customer's instructions under the Data Processing Agreement, not under this statement. We do not use Customer Data to train AI models.

When we work with you on an assignment. To carry out an assignment and to be able to show what was discussed and agreed, we record meeting notes and, where we have agreed it with the participants, recordings of meetings and the transcripts made from them. We say so before a meeting is recorded. We process these on the basis of our legitimate interest in performing the assignment and keeping a reliable record of it, we store them within the European Economic Area, and we transcribe them on our own infrastructure rather than with an external transcription service. We do not share them with anyone other than the people we engage for that assignment. Where the material concerns personal data that our customer controls, that processing is governed by our Data Processing Agreement instead of this statement.

Business contacts. In the course of our work we hold business contact details of prospects, customers and partners, such as name, role, company and business email, collected from you or from public professional sources.

Why we use it

We use personal data for the following purposes, each on the legal basis stated:

• Responding to enquiries and providing information. On the basis of steps taken at your request before entering into a contract or, where that does not apply, our legitimate interest in answering questions from people and organisations interested in our services.
• Providing and administering the platform and our services, and managing the customer relationship. On the basis of the performance of a contract where you are our contracting party. For the users and contacts of our customers, on the basis of our legitimate interest in providing and administering the service their organisation has contracted for.
• Performing and documenting an assignment. On the basis of our legitimate interest in carrying out the assignment and being able to show what was discussed and agreed, including through notes and, where agreed, recordings and transcripts.
• Keeping business contact details. On the basis of our legitimate interest in maintaining relationships with prospects, customers and partners.
• Securing and improving our website and services. On the basis of our legitimate interest in protecting our website and services against misuse and security incidents, and in understanding their use in aggregate so that we can improve them.
• Evaluating and improving the platform. On the basis of our legitimate interest in making the platform work well for our customers, we use the conversations on the platform and the inputs and outputs of agents to find and fix what goes wrong. Before we store them for this purpose, we remove personal data with automated filters, in line with good practice; no filter catches everything, and what remains stays protected. We keep them for the duration of the customer's contract and delete them within thirty days of its end. What we derive from them, such as categories and scores, is designed to contain no personal data, and we keep it without a time limit. We never use them to train AI models.
• Sending relevant updates about our services. On the basis of your consent or, for existing business contacts, our legitimate interest in informing them about services similar to those they have shown interest in. You can opt out at any time.
• Meeting legal obligations, such as statutory retention of financial records. On the basis of a legal obligation.

What we do not do

We do not sell personal data. We do not use it for advertising, and we do not track you across other websites or build a profile of you for marketing.

Who we share it with

We share personal data with service providers that process it on our behalf, such as our cloud hosting and email providers, under agreements that require them to protect it. The third parties that process data through the platform are set out in our Sub-processors list. We may also share personal data where the law or a competent authority requires it, and in connection with a reorganisation or sale of our business. We do not share personal data with third parties for their own marketing.

International transfers

We process the personal data covered by this statement within the European Economic Area (EEA). Where we do transfer such personal data outside the EEA, we rely on a valid transfer mechanism, such as an adequacy decision or the European Commission's standard contractual clauses, and update this statement. The processing of Customer Data through the platform, including any processing by a provider outside the EEA and the transfer mechanism that applies, is governed by our Data Processing Agreement and set out in our Sub-processors list, not by this statement.

How long we keep it

We keep personal data only as long as needed for the purpose for which we collected it, or as the law requires. Enquiry data is kept for the duration of the conversation and a reasonable period afterwards. Customer and account data is kept for the duration of the relationship and any statutory retention period that applies. A recording of a meeting is deleted once we no longer need it for the transcript and the notes. Notes and transcripts are part of our record of the assignment and are kept for as long as we need them for that purpose, and we delete them on request where no statutory retention period applies. For the platform, the retention periods in Schedule 1 to our Data Processing Agreement apply.

How we protect it

We apply appropriate technical and organisational measures to protect personal data against loss and unlawful processing. The measures that apply to the platform and our services are set out in Schedule 1 to our Data Processing Agreement.

Your rights

You have the right to access the personal data we hold about you, and to have it corrected or deleted. You may also object to or ask us to restrict certain processing, and ask for a copy of the data you provided in a portable form.

Where we process your personal data on the basis of your consent, you can withdraw that consent at any time, for example by emailing us or using the unsubscribe link in our messages. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

To exercise a right, email mik@joinaitonomy.ai. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.

Cookies

Our website uses cookies and similar technologies. How and why is set out in our Cookie Policy.

Changes to this statement

We may update this statement from time to time. The version published here is always the current one, and the date above shows when it last changed.

Contact

Questions about this statement or about how we handle personal data: mik@joinaitonomy.ai.

Aitonomy B.V. · KvK 42198573

Last updated 2026-10-08