Join Now

Privacy Policy

Aimix GmbH

Contact Information

Data Controller:
Aimix GmbH
Kolonnenstraße 8
10827 Berlin, Germany
Commercial Register: HRB 272803 B (Amtsgericht Charlottenburg)

Contact:
Email: [email protected]
Managing Director: Ievgen Reginia

Data Protection Officer / Data Protection Contact:
Ievgen Reginia
Email: [email protected]

1. Introduction

We take the protection of your personal data seriously. This Privacy Policy explains how Aimix GmbH ("we," "us," or "our") collects, uses, and protects your personal information when you:

  • Visit our website (aimix.io)
  • Join our waitlist
  • Use our AI website builder platform (currently in private beta, by invitation only)
  • Store payment information for future billing

This policy complies with the EU General Data Protection Regulation (GDPR), German Federal Data Protection Act (BDSG), Telecommunications-Digital-Services-Data Protection Act (TDDDG), and other applicable data protection laws.

2. Data We Collect

2.1 Waitlist Registration

When you join our waitlist, we collect:

  • Email address
  • Timestamp of registration
  • IP address (for security and fraud prevention purposes)
  • Referral source (if applicable)

2.2 Beta Platform Account Data

When you create a beta account (by invitation), we collect:

  • Full name and contact information
  • Company details (if applicable)
  • Login credentials (email and encrypted password)
  • Profile information you provide
  • Account settings and preferences
  • Beta invitation code

2.3 Payment Information

We use Stripe to securely store your payment methods. Stripe processes and stores:

  • Payment card details (stored directly by Stripe via Stripe Customer Portal, not on our servers)
  • Billing address
  • Payment history and transaction records
  • Stripe customer ID and payment method tokens

Important: We never store complete payment card details on our servers. All payment card information is handled exclusively by Stripe, which is PCI DSS Level 1 compliant.

2.4 Platform Usage Data

When you use our beta platform, we collect:

  • Website content you create (text, images, layouts)
  • Design choices and templates used
  • Feature usage and interaction data
  • Session duration and activity logs
  • Files and media you upload
  • Project metadata and settings

2.5 Website Analytics

We use PostHog analytics (with EU data centers at eu.posthog.com) to understand website usage. PostHog collects:

  • Pages visited and time spent
  • Browser type and device information
  • General location (country/region level)
  • Referral source
  • User journey and behavior patterns
  • Unhandled browser errors (for debugging)
  • Feature usage statistics

If you consent to "Full experience" in our cookie banner, PostHog also records:

  • Session recordings of your interactions with our platform (with sensitive data masked)

Data Masking: PostHog automatically masks sensitive information in session recordings including passwords, payment card numbers, and other sensitive form fields.

PostHog Data Retention: Analytics data is retained for a maximum of 26 months.

2.6 Technical Data

When you visit our website or use our platform, we automatically collect:

  • IP address
  • Browser type and version
  • Operating system
  • Device information (type, screen resolution)
  • Pages accessed and timestamps
  • Referrer URL
  • Error logs and performance data
  • Connection information

2.7 AI-Generated Content

When you use our AI website builder, we process:

  • Your prompts and instructions to the AI
  • Content generated by our AI models
  • Feedback on AI-generated content
  • Editing history of AI suggestions

Important: We do not use your content to train our AI models. Your prompts and content are processed by EU-based AI providers (via Requesty.ai EU router) and are subject to their data processing agreements, which ensure EU data residency.

2.8 Communications Data

When you contact us or receive communications, we collect:

  • Email correspondence and attachments
  • Support ticket history
  • Feedback and feature requests
  • Survey responses (if provided)

2.9 Children's Data

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected], and we will delete such information.

3. How We Use Your Data

3.1 Platform Services

  • To provide access to our AI website builder
  • To save and sync your website projects
  • To deliver platform features and functionality
  • To provide customer support
  • To process AI-generated content and website hosting
  • To enable collaboration features (when available)

3.2 Account Management

  • To create and maintain your user account
  • To authenticate your access to the platform
  • To communicate about your account status
  • To process billing and payments (when subscriptions launch on July 1, 2026)
  • To manage subscription renewals and cancellations

3.3 Product Development

  • To improve our AI algorithms and features
  • To develop new functionality
  • To analyze platform performance
  • To fix bugs and optimize user experience
  • To conduct user research and testing

3.4 Communications

  • To send product updates and announcements
  • To provide technical support
  • To notify about billing and account matters
  • To share beta program updates
  • To send waitlist notifications
  • To request feedback on our services
  • To comply with legal obligations
  • To detect and prevent fraud
  • To ensure platform security
  • To protect our rights and those of our users
  • To enforce our Terms & Conditions
  • To respond to legal requests and prevent harm

3.6 Analytics and Improvement

  • To understand how users interact with our platform
  • To identify usability issues
  • To measure feature adoption
  • To optimize user experience
  • To generate aggregated, anonymized statistics

We process your data based on the following legal bases under Article 6 of the GDPR:

Processing Activity Data Collected Legal Basis (GDPR Art. 6)
Waitlist signup Email, IP address, referral source Consent (Art. 6(1)(a)) - You voluntarily provide your email to join the waitlist
Platform account & service delivery Account data, usage data, website content Performance of a Contract (Art. 6(1)(b)) - Necessary to provide the service you signed up for
Payment processing Billing info, payment details Performance of a Contract (Art. 6(1)(b)) - Necessary to process payments for subscriptions
PostHog analytics (without session recordings) Usage patterns, device info, page views Consent (Art. 6(1)(a)) - When "Analytics" selected in cookie banner
PostHog session recordings User interactions (with masking) Consent (Art. 6(1)(a)) - When "Full experience" selected in cookie banner
AI content processing User prompts, generated content Performance of a Contract (Art. 6(1)(b)) - Essential to deliver AI features
Fraud prevention & security IP address, device fingerprint, access logs Legitimate Interest (Art. 6(1)(f)) - Protecting platform integrity and preventing abuse
Tax compliance & accounting Transaction records, invoices, billing data Legal Obligation (Art. 6(1)(c)) - German tax laws (AO, HGB)
Product improvement & bug fixes Aggregated usage patterns, error logs Legitimate Interest (Art. 6(1)(f)) - Improving service quality and fixing technical issues
Customer support Support correspondence, account details Performance of a Contract (Art. 6(1)(b)) - Providing support you requested

Withdrawing Consent: Where processing is based on consent, you can withdraw consent at any time by:

  • Adjusting cookie banner settings (for analytics)
  • Unsubscribing from waitlist emails
  • Contacting us at [email protected]

Withdrawal does not affect the lawfulness of processing before withdrawal.

5. Data Sharing and Third Parties

We do not sell your personal data. We share data with trusted service providers who process data on our behalf:

5.1 Essential Service Providers

Stripe (Payment Processing)

  • Purpose: Payment processing and subscription management
  • Data shared: Billing information, payment details
  • Location: Stripe processes data globally with EU data centers; protected by EU Standard Contractual Clauses (SCCs)
  • Privacy policy: https://stripe.com/privacy
  • Role: Data Processor (acting on our instructions)
  • Safeguards: PCI DSS Level 1 compliant, SCCs for international transfers

PostHog (Analytics Platform)

  • Purpose: Website and product analytics, error tracking, session recordings
  • Data shared: Usage patterns, device information, interaction data, unhandled errors
  • Location: EU data centers (eu.posthog.com) - all data resides in the EU
  • Data retention: Maximum 26 months for analytics data
  • Privacy policy: https://posthog.com/privacy
  • Role: Data Processor
  • Opt-out: Via cookie banner "Privacy settings" (select "Essential only")
  • Data processing agreement: In place to ensure GDPR compliance

Requesty.ai EU Router (AI Processing)

  • Purpose: Routing AI requests to EU-based AI model providers
  • Data shared: User prompts, AI-generated content
  • Location: EU data centers only (we exclusively use EU-hosted AI providers via Requesty.ai EU router)
  • AI Models: Primarily OpenAI EU data center; all models guarantee EU data residency
  • Training: Your content is NOT used to train AI models
  • Privacy policy: https://www.requesty.ai/privacy
  • Role: Data Processor
  • Data processing agreement: In place with EU data residency guarantees

Cloud Hosting Provider

  • Purpose: Secure platform hosting, data storage, and website delivery
  • Data shared: All platform data (encrypted at rest with AES-256 and in transit with TLS 1.3)
  • Location: EU data centers
  • Role: Data Processor
  • Security: ISO 27001 certified, regular security audits

Email Service Provider

  • Purpose: Transactional emails, account notifications, support communications
  • Data shared: Email address, name, account information
  • Location: EU or with SCCs for international transfers
  • Role: Data Processor

We may disclose your data when required by:

  • Legal obligations or court orders
  • Protection of our rights, property, and safety
  • Protection of the rights, property, and safety of our users
  • Fraud prevention and security threat investigation
  • Compliance with regulatory requests

We will notify you of such disclosures unless prohibited by law.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the new entity. We will notify you via email and/or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

6. International Data Transfers

6.1 EU Data Residency Commitment

Your data is primarily processed within the EU/EEA. We have made a commitment to use only EU-hosted service providers wherever possible:

  • PostHog: EU data centers (eu.posthog.com)
  • AI Processing: EU-only routing via Requesty.ai EU
  • Cloud Hosting: EU data centers
  • Primary data storage: Germany

6.2 Transfers Outside the EU

Where data transfers outside the EU/EEA are necessary (e.g., for Stripe's global payment processing), we ensure adequate protection through:

  • EU Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914)
  • Adequacy decisions by the European Commission (where applicable)
  • Additional technical safeguards: Encryption, access controls, regular audits
  • Organizational measures: Data processing agreements, audit rights, incident notification procedures

Right to Information: You can obtain copies of the relevant safeguards by contacting us at [email protected]

7. Data Retention

We retain your data for as long as necessary to provide services and comply with legal obligations:

Data Type Retention Period Reason
Waitlist data Until you unsubscribe or request deletion Ongoing consent
Account data Duration of your account plus 3 years Legal compliance (German commercial law HGB § 257)
Payment data Retained by Stripe: 7 years Tax compliance (German AO § 147)
Transaction records 10 years German commercial and tax law requirements
PostHog analytics 26 months maximum Service improvement, then automatically deleted
Session recordings 90 days Debugging and UX improvement
Technical logs 90 days maximum Security monitoring and debugging
Website content & projects Until you delete them or close your account (with 30-day recovery period) Service provision
Support correspondence 3 years after ticket closure Customer service quality and legal protection
Marketing consents Until withdrawn or 3 years of inactivity Ongoing consent

After Account Closure: We delete or anonymize your data within 30 days, except where longer retention is required by law. You can request immediate deletion by contacting us.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

8.1 Right of Access (Art. 15 GDPR)

You have the right to:

  • Know what personal data we hold about you
  • Receive a copy of your personal data
  • Understand how we use your data

How to exercise: Email [email protected] with subject "Data Access Request"

Response time: Within 30 days (free of charge for first request)

8.2 Right to Rectification (Art. 16 GDPR)

You have the right to:

  • Correct inaccurate personal data
  • Complete incomplete personal data

How to exercise: Update via account settings or email [email protected]

8.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You have the right to request deletion of your personal data when:

  • Data is no longer necessary for the purposes collected
  • You withdraw consent (where processing was based on consent)
  • You object to processing (and no overriding legitimate grounds exist)
  • Data was unlawfully processed
  • Legal obligation requires deletion

Exceptions: We may retain data where required by legal obligations (e.g., tax records) or to establish, exercise, or defend legal claims.

How to exercise: Email [email protected] with subject "Data Deletion Request"

8.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to restrict processing when:

  • You contest the accuracy of data (during verification)
  • Processing is unlawful but you prefer restriction over deletion
  • We no longer need the data but you need it for legal claims
  • You have objected to processing (pending verification of legitimate grounds)

8.5 Right to Data Portability (Art. 20 GDPR)

You have the right to:

  • Receive your data in a structured, commonly used, machine-readable format (JSON or CSV)
  • Transmit your data to another service provider

Scope: Applies to data you provided and processed based on consent or contract.

How to exercise: Use platform export tools or email [email protected]

Export includes:

  • Account information
  • Website projects and content
  • User settings and preferences
  • AI generation history (prompts and outputs)

8.6 Right to Object (Art. 21 GDPR)

You have the right to object to processing based on legitimate interests or for direct marketing purposes.

Direct marketing: You can object at any time by:

  • Clicking unsubscribe in emails
  • Adjusting email preferences in account settings
  • Contacting [email protected]

Where processing is based on consent, you can withdraw at any time:

  • Cookie banner: Use "Privacy settings" link in footer
  • Waitlist: Click unsubscribe link in emails
  • Analytics: Change cookie settings to "Essential only"

8.8 Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to file a complaint with a supervisory authority:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin, Germany
Phone: +49 30 13889-0
Email: [email protected]
Website: https://www.datenschutz-berlin.de

How We Handle Requests:

  • Identity verification may be required for security
  • We respond within 30 days (can be extended by 2 months for complex requests)
  • All requests are handled free of charge (unless manifestly unfounded or excessive)

9. Data Security

We implement comprehensive technical and organizational measures to protect your data:

9.1 Technical Safeguards

  • Encryption:

    • Data in transit: TLS 1.3 (Transport Layer Security)
    • Data at rest: AES-256 encryption
    • Database encryption at rest

  • Access Controls:

    • Multi-factor authentication (MFA) for administrative access
    • Role-based access control (RBAC)
    • Principle of least privilege
    • Regular access audits

  • Infrastructure Security:

    • Secure cloud infrastructure with EU data centers
    • Regular security assessments and penetration testing
    • Automated security monitoring and alerts
    • DDoS protection
    • Firewall and intrusion detection systems

  • Application Security:

    • Regular security updates and patches
    • Secure coding practices
    • Input validation and sanitization
    • Protection against common vulnerabilities (OWASP Top 10)

9.2 Organizational Measures

  • Staff Training: Regular data protection and security training
  • Access Management: Limited staff access based on role necessity
  • Incident Response: Documented procedures for data breaches
  • Vendor Management: Data processing agreements with all processors
  • Regular Audits: Internal security audits and compliance reviews
  • Backup Procedures: Regular encrypted backups with 30-day retention

9.3 Payment Security

  • All payment data is processed by Stripe (PCI DSS Level 1 compliant)
  • We never store payment card details on our servers
  • Tokenized payment methods for secure storage
  • 3D Secure authentication for card payments

9.4 Data Breach Notification

In the event of a data breach affecting your rights and freedoms:

  • We will notify the supervisory authority within 72 hours
  • We will notify you directly without undue delay
  • Notification will include nature of breach, likely consequences, and measures taken

Report Security Issues: [email protected]

We use cookies and similar technologies on aimix.io and related subdomains. These technologies are used for essential website functions and, if you consent, for privacy-friendly analytics. We do not use advertising or marketing cookies.

When you first visit our website, you can choose between the following levels in the cookie banner:

Essential Only

  • Only technologies that are technically necessary to operate the website
  • No analytics or tracking
  • No consent required (TDDDG § 25(2))

Analytics

  • Enables privacy-friendly analytics without session recordings
  • Helps us understand how our product is used
  • Requires consent (TDDDG § 25(1))

Full Experience

  • Enables full analytics including session recordings
  • Helps us understand detailed user interactions to improve UX
  • Session recordings have sensitive data masked
  • Requires consent (TDDDG § 25(1))

Changing Settings: You can change your choice at any time via the "Privacy settings" link in the footer of our website. Your selection is stored in a first-party cookie across our subdomains for 12 months.

These cookies and similar technologies are required for the core functionality of the website:

Cookie Name Purpose Duration Legal Basis
session_id Authentication and session management Session TDDDG § 25(2) - Technically necessary
cookie_consent Stores your cookie preferences 12 months TDDDG § 25(2) - Technically necessary
language Saves language preference 12 months TDDDG § 25(2) - Technically necessary
csrf_token Security - prevents Cross-Site Request Forgery Session TDDDG § 25(2) - Security

Essential cookies are used on the basis of our legitimate interests in providing a secure and functional website (GDPR Art. 6(1)(f)).

10.3 Analytics via PostHog (EU)

If you choose "Analytics" or "Full experience" in the cookie banner, we use the analytics platform PostHog with EU data residency:

PostHog Cookies:

Cookie Name Purpose Duration Legal Basis
ph_* Anonymous user identification 12 months Consent (GDPR Art. 6(1)(a), TDDDG § 25(1))

What PostHog Collects:

  • Measurement of page views and navigation paths
  • Aggregated analysis of feature usage and performance
  • Error and stability monitoring of the website
  • Browser and device information (anonymous)
  • Session recordings (only with "Full experience" consent)

PostHog Privacy Features:

  • EU data residency (eu.posthog.com)
  • No third-party advertising or cross-site tracking
  • Automatic sensitive data masking in recordings
  • IP address anonymization

Withdrawal: You can withdraw your consent at any time via the "Privacy settings" link, after which analytics will be deactivated for future visits. Existing data is subject to PostHog's retention policy (26 months maximum).

PostHog Privacy Policy: https://posthog.com/privacy

10.4 Managing Cookies and Tracking

In addition to the choices in our cookie banner, you can control cookies through your browser settings:

Browser Controls:

  • Chrome: Settings > Privacy and Security > Cookies
  • Firefox: Settings > Privacy & Security > Cookies
  • Safari: Preferences > Privacy > Cookies
  • Edge: Settings > Privacy, search, and services > Cookies

Important: Disabling essential cookies may impair or prevent the use of certain website functions (login, session persistence).

10.5 Do Not Track (DNT)

We respect Do Not Track (DNT) signals. When DNT is enabled in your browser, we will not load analytics scripts or set tracking cookies.

11. Automated Decision-Making and Profiling

11.1 AI Content Generation

Our platform uses AI models to generate website content based on your prompts. This involves automated processing but does NOT constitute automated decision-making with legal or similarly significant effects under GDPR Art. 22.

How it works:

  • You provide prompts and instructions
  • AI models generate content suggestions
  • You retain full control to review, edit, or reject AI outputs
  • No automated decisions are made about you

AI Model Information:

  • Models: Primarily OpenAI GPT models via EU data centers
  • Logic: Large language models trained on diverse text data
  • Limitations: May generate inaccurate, biased, or inappropriate content
  • Your responsibility: Review all AI outputs before use

11.2 No Profiling for Marketing

We do not use automated profiling for marketing, personalized advertising, or credit decisions.

11.3 Analytics Profiling

PostHog may create pseudonymous user profiles for analytics purposes (e.g., aggregating "new users" vs. "returning users"). This is:

  • Based on pseudonymous identifiers (not your real identity)
  • Used only for service improvement
  • Subject to your consent via cookie banner
  • Does not produce legal or similarly significant effects

12. Beta Program Specific Terms

12.1 Beta Data Handling

As a beta user, please note:

  • The platform is in development and may have limitations
  • We may collect additional diagnostic data to fix bugs
  • Your feedback may be used to improve our services (anonymized)
  • Beta features may change or be discontinued

12.2 Data Migration

When we transition from beta to commercial launch (July 1, 2026):

  • Your account and data will be migrated to the production platform
  • You'll be notified of any changes to terms at least 30 days in advance
  • You can opt out and request data deletion if preferred
  • Beta pricing or features (if any) will be communicated separately

12.3 Feedback and Suggestions

If you provide feedback, suggestions, or feature requests:

  • We may use them to improve our services
  • Feedback is considered non-confidential
  • We are not obligated to implement suggestions
  • No compensation is provided for feedback

13. Third-Party Services and Integrations

13.1 User-Initiated Integrations

If you choose to integrate third-party services with your Aimix account (e.g., connecting your own domain, analytics tools):

  • You authorize us to share necessary data with those services
  • You remain responsible for reviewing their privacy policies
  • We are not responsible for third-party data practices
  • You can revoke integrations at any time via account settings

Our platform may contain links to third-party websites. We are not responsible for:

  • Privacy practices of linked sites
  • Content or accuracy of external websites
  • Security of data you provide to third parties

Always review privacy policies before providing data to third-party sites.

14. Updates and Changes to This Policy

14.1 Policy Updates

We may update this policy as our services evolve or laws change. Material changes will be:

  • Communicated via email to account holders
  • Posted on our website with prominent notice
  • Effective 30 days after notification (unless immediate compliance required by law)

What constitutes a material change:

  • New data collection practices
  • Changes to data sharing or recipients
  • Reduction in data protection measures
  • Changes to legal basis for processing

14.2 Continued Use

Your continued use after changes indicates acceptance of the updated policy. If you disagree with changes:

  • You can close your account
  • You can request data deletion
  • Contact us to discuss concerns

14.3 Version History

Current version: 1.0 (February 3, 2026)

15. Contact and Complaints

15.1 Privacy Questions

For privacy questions or to exercise your rights:

Email: [email protected]
Subject line: Please specify your request type (e.g., "Data Access Request", "Data Deletion Request")

Postal Address:
Aimix GmbH
Attn: Data Protection
Kolonnenstraße 8
10827 Berlin
Germany

Response Time: We respond to all privacy inquiries within 30 days.

15.2 Supervisory Authority

You have the right to file complaints with the data protection supervisory authority:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59-61 10555 Berlin Phone: +49 30 13889-0 Email: [email protected] Website: https://www.datenschutz-berlin.de

When to contact supervisory authority:

  • If you believe your data protection rights have been violated
  • If you're unsatisfied with our response to your request
  • To report potential GDPR violations

15.3 Security Issues

To report security vulnerabilities:

Email: [email protected]
Subject: "Security Issue - [Brief Description]"

We appreciate responsible disclosure and will acknowledge reports within 48 hours.

16. Additional Information

16.1 Data Protection by Design and Default

We implement data protection principles in all aspects of our service:

  • Data minimization: We only collect data necessary for our purposes
  • Purpose limitation: Data is used only for stated purposes
  • Storage limitation: Data is deleted when no longer needed
  • Integrity and confidentiality: Strong security measures protect your data
  • Accountability: We document our compliance efforts

16.2 Privacy-Friendly Features

  • Local storage: Some data processed locally in your browser
  • End-to-end encryption: Planned for sensitive project data
  • Granular permissions: Control what data you share
  • Easy export: Export your data anytime in portable formats
  • Clear deletion: Simple account and data deletion process

16.3 Compliance Certifications

We are working toward:

  • ISO 27001 (Information Security Management)
  • SOC 2 Type II (Security, Availability, Confidentiality)
  • GDPR compliance certification (when available)

17. Language

This Privacy Policy is available in German and English. In case of any discrepancies between the German and English versions, the German version shall prevail in accordance with applicable German law.

Last Updated: February 3, 2026
Effective Date: February 3, 2026
Version: 1.0

© 2026 Aimix GmbH. All rights reserved.

Last updated: 03.02.2026
Effective date: 03.02.2026