Privacy Policy

As of 14 August 2026 - information pursuant to Art. 13 and Art. 14 GDPR (EU) 2016/679

    Summary: This website sets no cookies and does no cross-site tracking. Your IP
    address is not stored for analytics. All processing takes place on servers in the EU. You can
    withdraw your analytics consent at any time. Content that customers send to Talos through the
    API is never used to train our models.
  

This policy explains how Ablatic AI FlexCo (in formation) processes personal data for which it is itself the controller. That covers visits to this website, contacting us, the waitlist, registration and administration of the customer account, billing, use of the management console and support.

For content that customers transmit to the Talos service through the interface (API), Ablatic is not the controller but the processor. See section 5.

1. Controller

Ablatic AI FlexCo (in formation)
Altenberger Straße 69, 4040 Linz, Austria
Represented by Florian Zimmermann (CEO)
Email: [email protected]

Register court: Landesgericht Linz. Until entry in the Austrian company register, the company operates as „Ablatic AI FlexCo (in formation)“; register number and VAT ID will be added upon registration.

2. Data Protection Contact

For data protection matters and to exercise your rights, an email to [email protected] with the subject „Data protection“ is sufficient, or write to Ablatic AI FlexCo (in formation), „Data protection“, Altenberger Straße 69, 4040 Linz, Austria.

3. Processing We Carry Out Ourselves

3.1 Website access and server logs

When you visit the website, we process the technically necessary data your browser transmits automatically:

IP address of the requesting device (IPv4 or IPv6)
date and time of access
URL requested, HTTP status code and data volume transferred
browser or client identifier (user agent) and, where applicable, the referring URL

Purpose: delivering the website and keeping operations stable and secure, in particular detecting and repelling attacks.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Retention: 7 days, after which logs are deleted or anonymised.

3.2 Contacting us

If you contact us by email, we process the data you provide, such as name, email address, company and the content of your request, in order to handle your enquiry and any follow-up correspondence. The legal basis is Art. 6(1)(b) GDPR where there is a contractual context, otherwise Art. 6(1)(f) GDPR.

3.3 Waitlist

When you sign up through the waitlist form on ablatic.ai, we process:

First and last name - to address you personally
Email address - to contact you regarding product access
Message (optional), where you choose to add details
Timestamp of your submission

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in managing the waitlist).
Storage location: delivered by email to our internal address and stored exclusively on our email server in the European Union (netcup GmbH, Germany).
Retention: until you object or until we close the waitlist. We delete your data immediately upon request.

3.4 Registration and customer account

To create and administer the customer account we process:

email address, which serves as the user identifier
name of the contact person and, where applicable, their role
company name and business address of the customer
VAT ID or company register number as evidence of entrepreneur status. The service is directed exclusively at entrepreneurs within the meaning of sec. 1 UGB
credentials: the password is stored only as a cryptographic hash, we do not store the plaintext password
account settings and master data for account administration

Purpose: providing the account, authentication, performance of the contract and verification of entrepreneur status. Legal basis: Art. 6(1)(b) GDPR.

3.5 Login and security data

To secure access we process IP address and timestamp, the client identifier, failed login attempts including lockout status, and the session or access-token identifier. The legal basis is Art. 6(1)(f) GDPR (detecting and repelling abuse). We keep this data only as long as necessary for that purpose.

3.6 Billing

For billing we process company and invoice address, VAT ID, the plan booked, the volume of use and the charges derived from it, as well as invoice number, invoice date, outstanding and settled amounts, payment method and payment status. The customer's bank details (IBAN) are not stored permanently on our side. The legal bases are Art. 6(1)(b) and Art. 6(1)(c) GDPR.

3.7 Management console

In the management console (console.ablatic.ai) customers administer their account, their access keys and their usage. We process account and administration data as well as aggregated usage and billing figures, such as the number of requests and consumption per key. This administration data is distinct from the content transmitted through the API; section 5 applies to the latter.

3.8 Support

For support requests we process the data needed to handle them: contact details, the account reference and the matter you describe, including technical details such as error messages and timestamps.

4. Legal Bases

Art. 6(1)(b) GDPR (contract and pre-contractual measures): registration, account administration, provision of console and service, billing, support, enquiries with a contractual context
Art. 6(1)(c) GDPR (legal obligation): retention of billing and accounting records under the Austrian Federal Fiscal Code (BAO) and the Commercial Code (UGB)
Art. 6(1)(f) GDPR (legitimate interest): IT security, detecting and repelling abuse and attacks, server logging, stability of operations
Art. 6(1)(a) GDPR (consent): the optional analytics described in section 9.2. You can withdraw consent at any time with effect for the future

5. Scope: Content Processed Through the API

Talos is an AI service provided through api.ablatic.ai. Content that the customer transmits to the API, meaning text, images, video and files, along with the outputs generated from it, is processed by us exclusively on behalf of and on the instructions of the customer. For that content the customer is the controller under GDPR and Ablatic is the processor. The data processing agreement under Art. 28 GDPR governs this relationship.

We do not use customer data to train or fine-tune our AI models. Model weights are not altered by it.

5.1 Security logging during the beta phase

During the limited beta phase we log inputs sent to the API and the outputs generated from them in pseudonymised form, in order to keep the service secure. Before storage, the content passes through automated detection and redaction of personal data, including email addresses, phone numbers, IBANs, names, tax and social security numbers, and special categories under Art. 9 GDPR. Beta participants were additionally advised not to process particularly sensitive data through the service.

Purpose: detecting and repelling abuse and reviewing and improving the safety filters of the service. These logs are not used to train model weights. Legal basis: Art. 6(1)(f) GDPR in conjunction with the consent given as part of the beta. Retention: until the end of the beta phase plus 30 days, then automatic deletion. Access is limited to the people who operate the safety filters.

6. Recipients and Processors

Within Ablatic, access is limited to those who need it for the purposes described. Where we use service providers, for example for hosting, email delivery, payment processing or monitoring, we bind them as processors under Art. 28 GDPR.

Processing takes place exclusively in the European Union or the European Economic Area. No transfer of personal data to a third country takes place. Should such a transfer become necessary in an individual case, it will only occur on the basis of an adequacy decision or appropriate safeguards under Chapter V GDPR.

7. Retention

We keep personal data only as long as necessary for the respective purpose or as required by statutory retention obligations.

Billing and accounting records: 7 years, under sec. 132 BAO and sec. 212 UGB
Customer account and master data: until the account is deleted or the contract ends, then deletion subject to statutory retention obligations
Server logs: 7 days
Analytics data: up to 12 months
Login, security and support data: as long as necessary for the respective purpose

8. Your Rights

Under GDPR you have the following rights vis-a-vis the controller:

Access to the data processed (Art. 15 GDPR)
Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
Erasure (Art. 17 GDPR), unless a retention obligation applies
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

Where we process data on the basis of your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected. To exercise your rights, an email to [email protected] is sufficient.

Without prejudice to other remedies, you have the right to lodge a complaint with a supervisory authority. In Austria this is the
Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna - www.dsb.gv.at

9. Cookies, Storage on Your Device and Analytics

9.1 Technically necessary cookies

This website (ablatic.ai) sets no cookies. In the management console we use technically necessary cookies for authentication and protection against cross-site request forgery. They are required for operation and, under sec. 165(3)(2) of the Austrian Telecommunications Act 2021, need no consent.

9.2 Analytics on the website

On ablatic.ai we run our own data-minimising analytics. It runs on our own server in the European Union (OVH SAS, Vienna data centre, Austria). It sets no cookies and does not track you across other websites. With your consent we record per page visit:

the URL requested
the referring domain, for example „google.com“
the country, derived from a Cloudflare header; no precise location is stored
browser type and device category from the user agent
a daily visitor token: a daily-rotating, salted SHA-256 hash of your IP address. The IP address itself is never written to disk. The hash changes every day and allows no recognition across days

Legal basis: Art. 6(1)(a) GDPR (consent) and sec. 165(3) of the Austrian Telecommunications Act 2021 for access to your device.
Consent and withdrawal: a notice is shown on your first visit. You can change or withdraw your choice at any time via „Analytics settings“ in the footer. The choice itself is stored in your browser's localStorage, not in a cookie.
Retention: up to 12 months, then deletion.

9.3 No advertising or tracking technology

We use no advertising, marketing or tracking technology and pass no data to third parties for advertising purposes. No tracking pixels, ad networks or social media widgets are used. Web fonts are served locally from our own server; no connection is made to Google Fonts, Adobe Fonts or any other external font service.

10. Hosting

This website runs on a dedicated server at OVH SAS in Vienna, Austria. Our email infrastructure runs on a separate dedicated server at netcup GmbH in Germany. A data processing agreement under Art. 28 GDPR is in place with each hosting provider.

11. Changes to This Policy

We adapt this privacy policy when the underlying processing or the legal situation changes. The version published on this website applies, available at ablatic.ai/datenschutz.