Konfigrator — Privacy Policy

ATTICCA REALITIES, S.L. ("Atticca", "we", "us") provides Konfigrator at konfigrator.com. Our Spanish tax identification number is B72771066 and our address is Gran Vía Corts Catalanes 630, 08007 Barcelona, Spain.

For privacy questions, rights requests or contact with our Data Protection Officer, email hello@atticca.io. Product support: support@atticca.io.

This Policy covers visitors, Clients operating configurators, authorised workspace members and Customers using Client Sites. It is supplemented by the Client-specific privacy information accessible on each site. The Terms and Conditions govern use of the Service.

Atticca is responsible for processing necessary for the common Konfigrator account, its own subscription and billing relationship, service administration, security, support and legal obligations.

A Client operating a configurator is responsible for its own use of Customer data, such as handling requested configurations and enquiries. Its identity and privacy contact appear under Client privacy information on its site and are presented before you connect your account. Where Atticca stores and manages configurations solely on that Client's instructions, Atticca acts as its processor under the Data Processing Addendum.

One common account does not give every Client access to your information. Nor does acceptance of Konfigrator's Terms authorise a Client to use your data for unrelated purposes. Any additional Client processing, including information independently kept outside Konfigrator, must be explained by that Client with an appropriate legal basis.

Stripe collects full card numbers and CVC directly on its hosted payment pages. We do not collect those fields in Konfigrator. Clients, not Customers, pay for the Konfigrator subscription; product purchases from Clients take place outside the Service.

We do not ask you to upload health information, government identification documents or other sensitive information as part of ordinary configurator use. Please do not include unnecessary personal information in models, descriptions or support attachments. Required fields are identified when collected; without necessary information we cannot provide the relevant account, payment or requested feature.

Corporate logo references are limited by the Terms. We do not use account registration as consent to promotional emails or surveys, and do not send those communications under this launch policy. Service, security, billing and contractual notices are separate.

We do not sell personal data or share it with other businesses for their unrelated commercial marketing. We do not use models, textures, logos, configurations, personal data or other submitted Content to train AI models, or authorise providers to do so. We do not use advertising analytics, behavioural profiling or solely automated decisions producing legal or similarly significant effects under this service scope.

You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time. We assess the purpose and your rights before relying on legitimate interests; they are not a general permission for unrelated reuse.

When you sign in or deliberately connect an existing account to a Client Site, that Client can see your email and configurations saved for its own sites. A separate send/share action is not required. It cannot see your configurations for other Clients. Before the first connection, the site identifies the Client and links to its privacy information, including when you are already signed in globally.

Visitor configurations use a browser identifier. They remain available for seven days from saving. If you sign in within that period, the configuration is linked to that account and becomes visible to the relevant Client with your email. If you do not, it is deleted from active systems. An identifier without your email is not necessarily irreversibly anonymous data.

The Client contact button provides an email address for direct communication. The feature-feedback link opens an email to Atticca. Konfigrator does not provide an internal chat at this version's launch. Information you send directly to a Client is also subject to that Client's privacy information.

Providers receive information necessary for their services under applicable processing arrangements. Further provider information is available in the service-provider register. Authorised Atticca personnel and contracted personnel access information only as required for their work. Professional advisers and public authorities may receive limited information where necessary for their services, legal obligations or claims.

Stripe determines some purposes independently, including certain payment-security and compliance activities. Those uses are explained in Stripe's Privacy Policy. Our DPA identifies processors used for Client-controlled processing; a supplier used for Atticca's own billing is not automatically a processor of every Client.

The Supabase project's primary database region is Ireland. Our providers operate internationally, and technical operations or authorised access may involve countries outside the European Economic Area, including the United States and Singapore. A European storage region does not establish that every operation remains in Europe.

For transfers requiring safeguards, our provider processing arrangements must provide an applicable transfer mechanism. The published Vercel DPA and Supabase DPA include European Commission Standard Contractual Clauses for covered transfers. Stripe's DPA addresses its processing and international transfers. An adequacy decision may instead apply where it covers the destination and recipient. We assess the applicable mechanism and supplementary protections required for our processing; a provider's public policy does not replace that assessment.

Contact hello@atticca.io for information on the safeguards applicable to your data and to request a copy, subject to necessary redaction of confidential or security information. Transfers must not proceed without the protections required by applicable law.

Our application uses localStorage rather than sessionStorage for the items below. Konfigrator's application code does not set first-party HTTP cookies or embed advertising/analytics scripts.

Clearing site data may sign you out, reset preferences and prevent recovery of configurations linked only to that browser. It does not itself delete records on our servers. Necessary storage is used only for requested functions. Any non-essential storage requiring consent must remain disabled until consent is given, with an equally accessible withdrawal mechanism.

Payments and billing management redirect you to Stripe-hosted pages. Stripe may use its own cookies there under its cookie/privacy information. This statement about application code is not a claim that provider domains never use operational cookies.

Disconnecting from one Client deletes its configurations and removes the operative association, but preserves your global identity. Global Customer deletion removes the account, associations and configurations. Client account deletion removes its models and associated configurations, not the common identities of its Customers. Account deletion does not trigger a six-month recovery period.

An export/switching retrieval window is handled as described in the Terms and is not cut short by an ordinary scheduled deletion. Information retained for law or claims is limited, segregated and unavailable for ordinary product use. Where Spanish law requires blocking rather than immediate erasure, access is restricted for the applicable responsibility period, followed by deletion. We reapply recorded deletions if a database backup is restored.

A Client may retain records independently outside Konfigrator for its own lawful purposes; contact the Client about those records. We do not promise deletion from systems we do not control.

We apply measures proportionate to the information and risks, including access restrictions, separation of Client records, secure authentication and processes for handling incidents and deletion. Where we act as processor, the DPA describes our contractual safeguards. No service can guarantee absolute security, but this does not remove our legal duties or any required breach notification.

Subject to applicable conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Objection to direct marketing is unconditional. You may withdraw consent without affecting prior lawful processing.

Write to hello@atticca.io. We request only proportionate identity verification where needed. We normally respond within one month. If a permitted extension is necessary, we explain it within that first month. Requests are normally free; any refusal or fee must meet the legal conditions and will be explained.

For Client-controlled processing, use the Client's public privacy contact. If you contact Atticca, we help route the request and assist the Client under our obligations. You may complain directly to the Spanish Data Protection Agency or another competent authority, including in the EEA country where you live or work. You do not have to complain to us first. Any additional mandatory rights applicable to you remain available.

Client accounts require age 18 and local majority. Customer accounts require age 16 and guardian authorisation if still a minor, subject to stricter local rules. For under-16 users, an adult must use their own account to save or contact. Tell us if an account appears to breach these rules; we will review and take appropriate action without collecting unnecessary identification.

We update this Policy when processing changes and identify its version date. Material changes are brought to affected Users' attention. An updated notice alone does not supply consent where consent is required.