Dette dokument findes på fransk og engelsk. Du ser den engelske version; den franske version er den juridiske reference.
Last updated: September 6, 2026
This Privacy Policy (the "Policy") describes how Atako, a commercial brand of AIYBIZ, SAS, collects, uses, and protects the personal data of users of its artificial intelligence agent platform (the "Service").
Atako places particular importance on the protection of personal data and is committed to complying with applicable regulations, in particular the General Data Protection Regulation (GDPR) (EU) 2016/679 and French data protection law ("Loi Informatique et Libertés").
Use of the platform constitutes acceptance of this Policy.
AIYBIZ, SAS, operating the platform under the Atako brand 47 rue Vivienne, 75002 Paris, France SIREN: 105 452 585 Email: privacy@atako.ai
Payments are processed by Stripe. Atako does not store full credit card details. We retain transaction identifiers, payment history, and Stripe account identifiers necessary for billing.
When a user connects a third-party tool to the platform (e.g. GitHub, Slack, Google Workspace, HubSpot, etc.), they explicitly authorise, tool by tool, a specific set of permissions ("scopes"), displayed before the connection is made. Atako agents only process data corresponding to the scopes granted (emails, files, calendars, tasks, etc.). Atako acts as a processor within the meaning of the GDPR for this data. The privacy policies of third-party publishers apply to their own processing activities.
Integrations with Google services are subject to the specific provisions of Article 12 (Google API Services User Data Policy).
| Purpose | Legal basis |
|---|---|
| Creating and managing the user account | Performance of the contract |
| Providing the AI agent service and authorised integrations | Performance of the contract |
| Managing payments and billing | Performance of the contract / legal obligation (accounting) |
| Platform security, fraud prevention, logging | Legitimate interest |
| Service improvement and customer support | Legitimate interest |
| Non-essential audience measurement and analytics | Consent (cookie banner) |
| Compliance with legal obligations and responses to authorities | Legal obligation |
Atako relies on the following providers to operate the Service:
| Provider | Role |
|---|---|
| Google Cloud Platform (Google Ireland Limited) | Infrastructure hosting (europe-west1 region, Belgium) |
| Supabase (Supabase Inc.) | Database and authentication |
| Resend | Sending transactional emails |
| Twilio | Sending verification SMS |
| Stripe | Payment processing (no credit card data stored by Atako) |
| Intercom | Customer support and messaging |
| OpenRouter and AI model providers | Running AI agent requests (except under the BYOK option, see below) |
| Google Analytics | Audience measurement, subject to user consent |
BYOK ("Bring Your Own Key") option: a Client may choose to connect their own account with an AI model provider. In that case, data sent to the model is processed directly under the terms and privacy policy of the provider chosen by the Client.
Each AI agent runs in its own isolated virtual machine.
Data may also be shared with the publishers of third-party tools connected by the user (according to the permissions granted) and with public authorities where required by law.
All providers are selected for their GDPR compliance guarantees.
The platform's primary hosting is provided by Google Cloud in the europe-west1 region (Belgium, European Union). Some sub-processors listed in Article 5 (in particular Supabase Inc., Twilio, Intercom, and certain AI model providers) are established outside the European Union, notably in the United States.
Where such a transfer occurs, Atako ensures it is governed by appropriate safeguards, in particular the standard contractual clauses adopted by the European Commission, or any applicable adequacy decision.
| Data category | Retention period |
|---|---|
| User account | For the entire duration of the contractual relationship, then 3 years after its end |
| Conversations and interactions with agents | Until deleted by the user or until the account is closed |
| Technical logs | 12 months |
| Billing data | 10 years, in accordance with legal accounting obligations |
Atako implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, disclosure, and alteration, including: encryption of data at rest and in transit, per-company data isolation, access controls, isolation of each AI agent in its own virtual machine, and logging of sensitive events.
In accordance with the GDPR, users have the following rights over their personal data: access, rectification, erasure, restriction of processing, portability, and objection.
These rights may be exercised by contacting: privacy@atako.ai.
Users also have the right to lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr.
The platform uses cookies and similar technologies. Cookies strictly necessary for the operation of the Service are set without prior consent. For any non-essential cookie (in particular Google Analytics), consent is collected via the cookie management banner displayed on first visit. Declining non-essential cookies does not degrade access to the Service. Preferences can be changed at any time via the cookie management banner.
The Service is reserved for professionals acting in the course of their business and for adults (18 years of age or older). Atako does not knowingly collect data relating to minors. If a parent or legal guardian becomes aware that data relating to a minor has been collected, they may contact privacy@atako.ai to request its deletion.
When a Client connects a Google service (e.g. Google Workspace) to the platform, Atako's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In particular:
Atako may update this Policy to reflect changes to the platform or to legal requirements. The current version is always available on the site, with its update date. In the event of a material change, users will be notified by email or via the platform.
See also Atako's Terms of Service and Legal Notice.
This Privacy Policy is drafted in French and may be translated into other languages to facilitate its understanding. These translations are provided for informational purposes only. In the event of any contradiction, ambiguity, or discrepancy in interpretation between the French version and a translated version, the French version shall prevail.
This document was drafted with the assistance of an AI and should be reviewed by legal counsel before any major update.