Skip to main content

Privacy Policy

Last updated: September 2026

1. Who Is Responsible

ATBICE AB (organisation number: 559508-9805; VAT number: SE 559508980501), registered in Sweden, is the data controller for account, purchase, donation, and service-security data described below. Contact us at [email protected].

If you put another person's data in a Year Wheel, you remain responsible for having a lawful reason to do so and for sharing it only with the intended people. Organisations that require AtBice to act under a data processing agreement should contact us before storing personal data in a Wheel.

2. Data We Process

  • Visits and security: IP address, request time and path, browser and protocol headers, request identifiers, rate-limit data, errors, and security events. We do not run a product analytics or advertising tracker.
  • Account: your Zitadel account identifier, email address, name, access role, account status, and timestamps. Zitadel handles your credentials; atbice-org does not store your password.
  • Purchases and donations: checkout and payment-session identifiers, amount, currency, product, account identifier for a signed-in purchase, and the resulting access Entitlement. Stripe and the AtBice billing service hold payment and bookkeeping records; atbice-org does not receive card details.
  • Saved Year Wheels: the title and complete Wheel document you deliberately Save, including names or other personal data you choose to enter.
  • Share links: a one-way hash of the share token, a preview image, and sharing timestamps. Anyone holding the URL can read that Wheel until you revoke the link. Services where a URL is posted may retain their own preview copy.
  • Consent records: consent type, grant and withdrawal timestamps, and the network address visible to the API when the record was made.
  • Signed-in preferences: Year Wheel Anchor and Divider defaults you choose are synchronized to your account so they follow you across devices.
  • Communications: the contents and contact details in messages you send to us.

3. Browser-Only Tools and AI

File converters, PDF tools, OCR, and text-to-speech process your input in your browser. Their software and model files are downloaded from AtBice, then run on your device. Tool inputs and generated outputs are not sent to AtBice, Anthropic, or another model provider to operate those tools. They are not used for training or automated decisions about you.

A Year Wheel Draft also stays in browser storage. It reaches our server only when you deliberately Save it. Anonymous preferences, the privacy-notice acknowledgement, cached model files, and the signed-in OIDC session are stored locally on your device; signed-in Year Wheel defaults are also synchronized to your account as described above.

4. Why We Process Data

  • Contract: create and operate accounts, Save and share Wheels, provide purchased features, and handle donations and purchases.
  • Legitimate interests: secure, troubleshoot, and operate the service, prevent abuse and fraud, and keep reliable access records.
  • Legal obligation: retain accounting records held by the billing service as required by Swedish law.
  • Consent: only for an optional purpose when we specifically ask for it; consent can be withdrawn.

5. Services and Recipients

  • Cloudflare: DNS, traffic delivery, TLS termination, and network security. Cloudflare receives visitor network and request metadata.
  • Contabo: infrastructure hosting for parts of the AtBice Kubernetes platform.
  • Stripe: embedded checkout, payment processing, receipts, and payment-fraud controls.
  • Anthropic: AI-assisted diagnosis of non-customer infrastructure alerts and operational logs. This can incidentally include identifiers present in a log, such as an account, checkout-session, request, or network identifier. Saved Wheel bodies are not an intended input to this process. Anthropic's commercial service does not use prompts or code for model training and retains this data for 30 days under the current service setting.
  • Authorities: information when disclosure is required by law.

Zitadel identity, AtBice Billing, PostgreSQL, and Garage backup storage are operated by AtBice as parts of the service. We do not sell personal data. Sentry, marketing email, and product analytics are not enabled in the deployed service.

6. International Processing

The product database and its backups run on AtBice-managed infrastructure. Cloudflare uses a global network, and Stripe and Anthropic may process data outside the EU/EEA, including in the United States. Contact us at [email protected] for information about the transfer safeguards applicable to a particular processing activity.

7. Retention and Deletion

  • Local account, Wheels, share links, consent records, and Entitlements: kept until you delete the relevant item or remove your atbice-org product data.
  • Database backups: rolling 7-day retention. A deleted row may remain in an inaccessible backup until that backup expires.
  • Operational logs: 14 days in AtBice's central log system.
  • Anthropic diagnostics: 30 days under the current commercial service setting.
  • Payment and bookkeeping records: retained by AtBice Billing for seven years under Swedish accounting requirements. Stripe also applies its own retention obligations and policy.

The profile offers two choices. The product-data choice removes atbice-org product data only; complete account deletion also deletes your shared AtBice identity and stops sign-in across AtBice. Neither choice erases data independently held by another AtBice product, and required bookkeeping records are not erased.

8. Your Rights

Subject to the GDPR's conditions and exceptions, you may request access, correction, erasure, restriction, or portability of your data, object to processing based on legitimate interests, and withdraw consent. The profile data export includes account information, consent history, and saved content. Contact [email protected] to exercise a right.

9. Cookies and Browser Storage

AtBice does not use advertising or product-analytics cookies. The site uses browser storage for essential preferences, local Drafts and model caches, and the OIDC session. Cloudflare provides operational network reporting, and the separate Zitadel sign-in and Stripe checkout services may use cookies or browser storage needed to provide their services. We do not use these technologies for cross-site advertising or behavioural profiling.

10. Security

We use encrypted transport, access controls, isolated service identities, restricted network paths, hashed share tokens, rate limits, and tested backups. No internet service can be guaranteed completely secure; report a concern to [email protected].

11. Contact and Complaints

Data protection contact: [email protected]
Address: ATBICE AB, Göteborgsvägen 78B, 1101, 445 57 Surte, Sweden

You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY): www.imy.se