Privacy policy

The controller responsible for processing personal data on this website is:

Attanda eU, represented by Fehmi Imeri, Wienerbergstraße 9, 1100 Wien, Austria.

For questions about this policy or your personal data, you can contact us at hello@attanda.com or +43 1 435 0087.

You may also write to Attanda eU at Wienerbergstraße 9, 1100 Wien, Austria.

Depending on how you use the site and our services, the following categories of data may be processed:

Information you provide directly, including details submitted when contacting us or requesting a Readiness review.

Basic technical request information needed to deliver and secure the site and API.

Selected Blueprint options, deterministic Readiness results and, where requested, supporting narrative and report data.

The Blueprint and browser only Readiness Check save selected configuration options and assessment results in session storage so the experience can continue during the browsing session.

Your name and email are not stored in browser storage. After they are saved by Attanda, the current tab keeps only an opaque contact reference in session storage so retries and revisits do not create another contact. A report snapshot may be stored locally so a report can open in a new tab.

This storage supports the requested functionality. It is not used for advertising, analytics or cross site tracking.

Before the AI Readiness analysis can begin, your first name, last name and email are validated and stored in Firestore as a separate Readiness contact. If that save fails, the AI evaluation does not start and you can try again.

When you run a Readiness Check, Cloudflare Pages and the restricted API gateway forward the approved request to Attanda's Cloud Run service. Vertex AI evaluates the submitted Blueprint answers and returns an assessment of each readiness category together with written findings and recommendations. Attanda's backend derives the overall score and the readiness tier from those category assessments, so the total and the tier always follow from the evaluation.

If the AI evaluation cannot be completed, no assessment is issued: you are asked to try again, and your Blueprint selections remain saved in your browser.

The assessment is stored in Firestore and the generated report in private Cloud Storage. Contact details are stored separately from Readiness and architecture data, and are excluded from the Vertex AI request.

The score is a planning signal, not a verified audit or a legally significant automated decision.

The current service uses Google Cloud Run, Firestore and private Cloud Storage in the europe-west3 region. Vertex AI uses Gemini 2.5 Flash to generate supporting narrative from a sanitised architecture payload, with a thinking budget of zero.

Report PDFs are stored privately in Cloud Storage. A report is released only after a time limited report token is verified.

Cloudflare remains part of the site delivery and restricted API gateway path. Cloudflare D1 remains populated as a rollback backend and is not the active production store while the GCP provider is enabled.

Personal data may be processed to respond to your enquiries, to provide and operate the services you request, to maintain the security and reliability of the site, and to meet legal obligations.

Data is used only for purposes that are explained to you.

Processing is carried out on the lawful bases applicable to each purpose under the GDPR. Depending on the context, these may include consent, steps requested before entering into a contract, performance of a contract, legitimate interests or legal obligations.

Personal data is kept only as long as necessary for the purposes described or as required by law. Retention criteria take account of the request, the service relationship, security needs and applicable legal obligations.

The current platform uses Cloudflare Pages and a restricted Cloudflare API gateway to deliver the site and forward approved requests.

Google Cloud services are used for Cloud Run, Vertex AI, Firestore and private Cloud Storage. These services receive only the data required for their respective technical functions.

We do not state that all processing takes place exclusively in Germany or that no international processing occurs. Where personal data is transferred outside the EU/EEA, applicable GDPR safeguards are assessed and applied as required.

Subject to the conditions of the GDPR, you have the right to access your personal data, to request rectification or erasure, to restrict or object to processing, and to data portability.

Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

The Readiness Check produces an indicative score, written findings and recommendations from the answers you select. The evaluation is generated by an AI model, and the overall score and tier are derived by Attanda from that evaluation. Attanda does not use that output to make a decision producing legal effects or similarly significant effects about you.

Any technical review or follow up is performed by people.

Using the website and completing the browser only Blueprint is optional. First name, last name and email are required if you choose to start the AI Readiness analysis. Without them, the assessment cannot be generated or associated with your request.

For contact details and assessments already submitted to Attanda, use the contact information above.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country of your residence, place of work, or the place of an alleged infringement.

The current version of this website does not intentionally use non essential cookies or marketing/analytics tracking.

If analytics or marketing tools are introduced in the future, consent will be requested where required and this policy will be updated before those tools are activated.

We follow a privacy by design approach with data minimization and access controls appropriate to the processing.

This describes our approach to protecting data; it is not a guarantee of absolute security.

This policy may be updated to reflect changes to our services or legal requirements.

The current version applies from the date shown above.