Privacy Policy
Last updated: October 9, 2026
1. Who we are and what our roles are
Atako is an artificial intelligence agent platform intended for professionals, published by AIYBIZ, a simplified joint-stock company (société par actions simplifiée) with share capital of €100, located at 47 rue Vivienne, 75002 Paris, France, Paris Trade and Companies Register No. 105 452 585 ("Atako"). Contact: privacy@atako.ai.
Atako is the controller of the data required to manage its customers, prospective customers, and visitors, as described in Section 2. For the data that its customers entrust to their agents, as described in Section 3, Atako acts as a processor: the customer determines the purposes and the instructions, and the data processing agreement annexed to the Terms of Use and Sale applies. If your data is processed by the agent of a customer organization, contact that organization first.
We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
2. Processing for which Atako is the controller
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Account creation and management | Last name, first name, email address, encrypted password, role, company, job title | Performance of the contract | Duration of the account, then 3 years after the last activity; contractual evidence archived for 5 years |
| Support and customer relations | Communications and tickets | Performance of the contract | Duration of the contract, then 5 years |
| Billing and payment | Stripe transaction and account identifiers, payment history, invoices (no full card data is retained by Atako) | Performance of the contract; legal obligation | 10 years (Article L.123-22 of the French Commercial Code) |
| Identification of hosted account holders | Identity, account identifier | Legal obligation (hosting provider) | 5 years after account closure |
| Security, fraud prevention, technical logs | IP address, connection and event logs, suspicious attempts | Legal obligation; legitimate interest | 12 months |
| Marketing outreach (direct marketing) to professionals and newsletter | Professional contact details, email address | Legitimate interest; consent for the newsletter | 3 years after the last contact or until consent is withdrawn |
| Audience measurement and improvement of the website and platform | Trackers, browsing data, session recordings (inputs masked; on the platform, all page text is masked) | Consent, except for exempt trackers | Trackers: 13 months maximum; session recordings: 30 days; other data: until Atako stops using the measurement tool |
| Improvement of the Service | Aggregated usage statistics (number of agents, features used, performance), excluding any content processed by the agents | Legitimate interest | 24 months |
| Proof of acceptance of the Terms of Use and Sale | Accepted version, date, identifier | Legitimate interest | Duration of the contract, then 5 years |
3. Data processed by agents for our customers
This data consists of the agents' instructions, conversations, memories, acquired skills, files, and outputs; projects; and the company context layer, as well as data from the tools that the customer connects to its agents. Each connection is authorized by the customer; the legal basis for this processing is the customer's responsibility.
Atako processes this data on the customer's instructions, solely to provide the service. It does not sell this data, does not use it for its own purposes, and never uses it to train models.
To generate their responses, the agents transmit this content to an artificial intelligence model provider: the provider used for Atako inference, or the provider whose API key the customer has registered. These providers process the data they receive under their own terms, which may permit its use for training purposes. These terms are accessible via a link displayed in the platform at the time the model is selected; the customer chooses its model on an informed basis.
This data is retained for the duration of the contract. Archiving an agent stops its execution and retains its data, which the customer may retrieve at any time. Upon a request for erasure, the data is erased within 30 days, unless a legal retention obligation applies. At the end of a trial period that is not converted into a subscription, the agents and their data are permanently deleted on the 28th day after sign-up.
4. Recipients
Only those Atako teams that need access to the data have access to it. Atako uses the following service providers, which are bound by contract:
- hosting of the website and platform: Scaleway (France);
- platform database and files: Supabase (European Union, Ireland);
- agent virtual machines: Scaleway, OVHcloud, or Cisco;
- artificial intelligence model inference: the providers offered in the platform, whose terms are accessible at the time the model is selected;
- payment: Stripe;
- audience measurement, with your consent: Google Analytics (Google) and Amplitude;
- session recording, with your consent: Amplitude;
- support chat: Intercom.
The vendors of the tools connected by the customer, and the model provider whose API key the customer itself registers, receive data in accordance with the authorizations the customer has granted; their own policies apply. The up-to-date list of service providers and their locations is provided upon request to privacy@atako.ai. Data may also be disclosed to authorities that lawfully request it.
5. Location and transfers outside the European Union
Platform data — user accounts, agent names, messages exchanged between users and agents or between agents, session messages, and settings — is hosted in the European Union.
The virtual machines in which the agents run may be located outside the European Union: Atako remains free to choose the provider and the region, and the region is not guaranteed. Certain service providers and model providers also belong to groups established outside the European Union and may access data from abroad, for example for support purposes.
The audience-measurement tools (Google Analytics, Amplitude) and the support chat (Intercom) are provided by companies established in the United States, where the data they collect with your consent is hosted.
These transfers are governed by the European Commission's Standard Contractual Clauses or, where one applies, by an adequacy decision, together with supplementary measures. A copy of the safeguards is available upon request to privacy@atako.ai.
6. Security
Each agent runs in an isolated virtual machine. Atako encrypts data in transit and at rest, controls access, and logs sensitive events. Any data breach presenting a risk is notified to the CNIL (French data protection authority) and, where required by law, to the data subjects.
7. Your rights
You have the rights of access, rectification, erasure, restriction of processing, objection — including, at any time, to marketing outreach (direct marketing) — data portability, and withdrawal of your consent. You may set directives regarding what happens to your data after your death.
Write to privacy@atako.ai; we respond within one month, a period that may be extended by two months if the request is complex. For data processed by a customer's agents, we forward your request to that customer, which is responsible for that data. You may lodge a complaint with the CNIL (www.cnil.fr).
8. Automated decision-making
Atako does not make any decision producing legal effects concerning you based solely on automated processing. Decisions made by means of a customer's agents are the responsibility of that customer, which defines the agents' role and instructions.
9. Intended audience
The service is intended for professionals and reserved for persons aged 18 or over.
10. Cookies
Cookies that are strictly necessary for the operation of the service are placed without consent. Other trackers (audience measurement with Google Analytics and Amplitude, session recording, Intercom support chat) are placed only with your consent, obtained through a banner on your first visit; refusing them does not impair access to the service. Session recording reproduces your browsing (pages viewed, clicks, scrolling): input fields are always masked, and on the platform all page text is masked too. You may change your choices at any time from the "Cookie settings" link in the website footer; withdrawal takes effect immediately. Cookies have a maximum lifespan of 13 months; your choice is retained for 6 months.
Cookies set by Atako:
atako_consent: stores your choice about trackers (accept or refuse) so that it applies on both atako.ai and app.atako.ai. Strictly necessary; kept for 6 months.atako_acq: set only if you accept trackers. It keeps the origin of your visit (campaign parametersutm_*, ad click identifiersgclid,gbraid,wbraid,msclkid,fbclid, referring site, landing page and Google Analytics identifier) to measure which campaigns lead to sign-ups. If you create an account, this information is attached to your company, and Atako reports the sign-up, the start of the trial and the first payment to Google Analytics under that same identifier. Kept for 90 days; without your consent, nothing is set or sent.
11. Changes and language
Atako may amend this policy to reflect changes in the service or in regulations; you will be notified of any material change. The version in force is available on the website, together with its date of last update. This policy is written in French; in the event of translation, only the French version shall prevail.