Privacy notice

1. Controller

Digitalgurus (Carsten Urbanski), Kettelerstr. 42, 76863 Herxheim, Germany
Email: office@athron.io

A data protection officer has not been appointed; the conditions of § 38 of the German Federal Data Protection Act are not met. Please direct questions about data protection to the controller at office@athron.io.

2. Two roles

For this website, for registration and for the account with COMPASS (name, email, sign-in, billing) we are the controller. This notice describes that processing.

What a customer stores in COMPASS (rules, decisions, lessons, messages, documents and the like) we process on behalf of that customer. The customer is the controller for it; the data processing agreement applies.

3. Hosting

The website and COMPASS run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in the Nuremberg data centre, Germany. Measured on 08.10.2026 via the network range lookup for the server’s IP address (HETZNER-RZ-NBG-NET, country DE).

The website athron.io runs behind Cloudflare. The names athron.io and www.athron.io point to machines of Cloudflare, which accept the request and forward it to the server in Nuremberg. The encrypted connection therefore terminates at Cloudflare and not only on our server; in doing so Cloudflare learns the IP address, the time and the address requested. Cloudflare has its seat in the USA and operates machines in many countries. Measured on 08.10.2026 from the response header (server: cloudflare, responding node Paris).

The application compass.athron.io does not run through Cloudflare: its name points directly to the server in Nuremberg, and the encrypted connection terminates there on our own web server, with a certificate from Let’s Encrypt.

4. Visiting this website

This website sets no cookies, uses no analytics tools and loads no fonts or scripts from third-party servers.

When any page is requested, the web server processes technically necessary details. The legal basis is Art. 6(1)(f) GDPR (secure operation).

Measured on 08.10.2026: the web server logs, per request, the IP address, the time, the address requested, the status, the size transferred, the referring address and the browser identifier. These logs are not held in files with a fixed deletion date, but in a rotation limited by size of at most five segments of 50 MB each; the oldest is deleted as soon as the rotation is full. How long an entry stays in them therefore depends on traffic and not on a period. The logs of the application itself contain no visitor IP addresses, only the internal addresses of our own services. For the application’s logs no limit is set.

5. Contact

If you write to us through the contact form (or by email), we use your details only to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete enquiries six months after the matter is closed, unless a retention obligation prevents that.

The contact form (added 28.10.2026). It asks for your name, your company or firm and your email address, and — optionally — the size of your team, whether you handle professional secrets, which offers interest you and a message; it also passes on the language of the page you used. Please do not write client or patient data into it. You must confirm that you have read this notice before it can be sent; there is no separate consent to tick. These details reach us in two ways: as a message in the operator’s inbox inside COMPASS itself, and as a notification email to the people who run COMPASS. The content of your enquiry is stored only in these two places — it is not written to the server’s logs; the logs only record that an enquiry arrived. A hidden field catches automated submissions and discards them without storing anything. The purpose is to answer your enquiry; the legal basis is Art. 6(1)(b) GDPR for an enquiry about the contract and (f) for all others. We use the address only for the reply and do not pass it on. The notification email is sent through the email service named in section 9.

To slow down misuse of the form, we count accepted enquiries per IP address (a separate counter, not the one for sign-ins) and delay further enquiries from the same address after the fifth. The legal basis is Art. 6(1)(f) GDPR; the retention period is that of the counters in section 8.

Your email, if you write one yourself, sits in the provider’s mailbox. On the mailbox itself and the third-country aspect see section 9, on retention see section 13.

Booking a call with Google Calendar. On the contact page and on the Enterprise page you can book a call through the appointment booking of Google Calendar. The booking view is embedded and is loaded only once you click “Load the booking calendar”; before that, the page makes no connection to Google. With the click, your browser loads the view from Google, and Google receives the technical details of your request, such as your IP address and browser identifier. What you enter when booking (name, email address, chosen time and, if you like, a message) is processed by Google to create and confirm the appointment; we receive these details in our calendar to hold the call. The legal basis is Art. 6(1)(b) GDPR, because you request the call. We delete the appointment together with the enquiry, six months after the matter is closed. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible. The privacy information of Google additionally applies.

6. Registration and account

For an account we process the email address, name, company name and a password. We store the password only as a digest, never in clear text. For confirmation we send an email with a link. The legal basis is Art. 6(1)(b) GDPR (contract).

The confirmation link is valid for 48 hours. Registrations not confirmed by then are deleted. Confirmed registrations are stored without a time limit.

Signing in with Google. If you sign in with Google, we receive from Google your email address, your name and whether Google has confirmed the address. We do not store a Google identifier. The privacy information of Google additionally applies. The provider is Google Ireland Limited, Dublin; a transfer to Google LLC in the USA is possible. The Commission’s adequacy decision on the EU-US Data Privacy Framework may serve as the basis.

7. Cookies in COMPASS

After sign-in, COMPASS sets only cookies that are necessary for the service (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act):

• Session: keeps you signed in, at most 30 days, not readable by scripts.
• Sign-in with a key: keeps a sign-in made with an access key, at most 30 days, not readable by scripts.
• Sign-in procedure: protects signing in with Google and the authorisation for agents (MCP) against forgery, 10 minutes.
• Language: remembers the chosen language, one year, contains no identifier.

In browser storage COMPASS keeps only display settings (light or dark theme, expanded or collapsed areas). COMPASS sets no advertising or analytics cookies.

Program libraries come from our own server. Measured on 09.10.2026 across all delivered pages, stylesheets and scripts: the interface loads no program library, font or graphic from a third-party server. Everything your browser fetches by itself when a page is opened, it fetches from compass.athron.io or athron.io respectively. No additional connection to a third party arises. For athron.io it does, however, remain the case that Cloudflare sits in front of it as an intermediary and accepts every request — section 3 describes that; for compass.athron.io there is not even that intermediary. Links to third-party sites still exist; those fetch something only once you click them.

Until 09.10.2026 this was different: four templates loaded htmx, mermaid and vis-network from cdnjs.cloudflare.com, and because htmx was included on every signed-in page, that affected practically every request. Cloudflare thereby learned the IP address, the time and the file requested. Since 09.10.2026 these three libraries have been held in the same version on our own server. That it stays that way is checked by an automatic test on every change: it searches all templates and stylesheets for an address that the browser fetches by itself, and raises an alarm as soon as one of them points outwards. Clicked links to third-party sites are excluded — they transmit nothing as long as nobody clicks them.

8. Protection against misuse

To slow down sign-in attempts by strangers, we count failed sign-ins per email address and per IP address and delay further attempts. The legal basis is Art. 6(1)(f) GDPR. We delete the counters for failed attempts after 30 days without a new attempt.

The intention is to delete failed attempts after 30 days without a new attempt. Measured on 08.10.2026: the function for this exists, but no regular call is set up — among the server’s scheduled runs there is none that triggers it. The entries therefore remain until someone calls it by hand.

COMPASS also counts, per account and day, which areas were accessed and with which program (browser or program identifier). This count contains no IP address and no content. It serves traceability for the customer themselves and is deleted after twelve months.

Human check on the sign-up form (added 28.10.2026). To keep automated programs from creating accounts in bulk, the form asks your browser to solve a small computing task (the open-source ALTCHA method). It runs on our own server and in your browser: no cookie is set, nothing is sent to a third party, and no picture or text puzzle is shown. The server keeps the identifier of a solved task in memory only until the task would have expired (ten minutes), so that one solution is used once; nothing about it is written to a database or a log. A hidden field that no person fills in, and a minimum time between opening and sending the form, serve the same purpose. The legal basis is Art. 6(1)(f) GDPR (security of the service).

9. Sending email

We send confirmation, invitation and notification emails encrypted (STARTTLS) through an email service. Notification emails may contain excerpts from a customer’s content, for example a check report.

Measured on 08.10.2026: sending runs through the email service of Google (smtp.gmail.com, port 587, STARTTLS). The provider is Google Ireland Limited, Dublin; processing in the USA by Google LLC is possible. The contents of a notification email therefore pass through Google — including when they carry excerpts from customer content.

10. Optional features with external services

COMPASS may use external services for certain optional features. They are active only if they are set up and approved for the particular use.

• Writing assistant: the text of a rule currently being reviewed would go to a language model (Anthropic) or to a self-operated model. Measured on 08.10.2026 this feature is switched off in operation — no language model is set up, and no call takes place. If it is switched on and set to Anthropic, the texts go to Anthropic PBC in the USA.
• Portraits: name, role and a short description go to an image service (OpenAI), which generates an image from them. An uploaded photo is not transmitted. Measured on 08.10.2026 this feature is switched on in operation; it runs only when someone triggers it in the interface. The recipient is OpenAI, USA. For a portrait of a person rather than a persona, this is the name of a real individual.

Neither Anthropic nor OpenAI receive customer data from us for training their models. The writing assistant and portraits are switched on or off by the provider; there is no field for it on the individual customer (measured on 08.10.2026).

Read-only walkthrough

The optional read-only walkthrough is switched off by default. It is explicitly enabled per customer. Mistral AI SAS, France, is the intended external service and additional processor. When this feature is switched off, the read-only walkthrough makes no call to Mistral.

The purpose is to describe connections between the walkthrough's measurements and the company's applicable rules, and to suggest a next step. The service receives check-area labels, measurements already calculated and message texts from the walkthrough, as well as selected applicable company rules. If this customer content contains personal details, such as names or statements about individuals, those details may also be processed. The model receives no permission to write to the customer's memory. The customer remains responsible for the legal basis for personal data stored by the customer (see section 2).

Use for the read-only walkthrough requires a reviewed data processing agreement. Customer content submitted and the results generated from it must not be used to train models; this exclusion must be contractually secured for the specific account and model used.

Before approval, there must also be evidence that the service used processes the data in the EU. The company's registered office in France alone establishes neither the processing location nor the locations of possible subprocessors.

Webhooks. A customer can set up their own targets (for example Slack) to which COMPASS reports changes. The customer chooses those targets; they are not service providers of ours.

11. Payment

For paid tiers, Stripe is the payment service provider. Credit card and SEPA direct debit are envisaged as payment methods. You enter card details and bank details directly with Stripe; we do not see or store them. From Stripe we receive only what we need for allocation and billing: payment identifier, amount, status and the last digits of the payment method. The legal basis is Art. 6(1)(b) GDPR (contract).

Measured on 08.10.2026: the integration is built but not set up in operation — no payment data flows today. Operation is to start in test mode first.

12. Backups

The database is backed up daily. Every copy is encrypted (AES-256 with a derived key) before it is stored; this also applies to the additional backup before every rollout of a new version. The 14 most recent daily copies are kept on the server, older ones are deleted. Only the operator has access.

A copy is kept off-site. Every night the most recent encrypted copy is transferred to separate storage of Hetzner Online GmbH in the EU (Storage Box) and read back there after storing. Depending on age, up to 14 daily, 8 weekly and 12 monthly states are kept there; older ones are deleted. Restoring is rehearsed monthly: a copy is loaded into an empty database and checked row by row against the count.

Measured on 28.10.2026: no unencrypted copy on the server; copies that were previously stored unencrypted now exist only in encrypted form. Off-site copy last successful on 28.10.2026; last restore rehearsal on 25.10.2026, 594 of 594 checks passed.

13. Retention

We store account data for as long as the account exists. After that we delete it, unless statutory retention obligations apply; we keep invoices for ten years (§ 147 of the German Fiscal Code, § 14b of the German VAT Act).

In detail: account 90 days after termination, then deleted — the export is available for 30 days. Email enquiries six months after closure. Failed-attempt counters 30 days without a new attempt. Access counts twelve months. For the web server’s logs no period applies, but a rotation by size (section 4). The 30 days and the twelve months are enforced today by a manual call; a regular call is not set up (section 8).

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please write to office@athron.io. We carry out an erasure request within 30 days of receipt; where a request is particularly complex the period is extended by up to two further months, and we tell you so with reasons. How we go about it — the entry is made unrecognisable rather than the row deleted — and what the running audit trail retains is set out in the data processing agreement, section 8.

You can lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz — responsible by reference to the controller’s seat in Herxheim (Rhineland-Palatinate).

Status

In force since 15.10.2026. The German version is authoritative.