Skip to content
AlicanTorun
Let's talk

Privacy Policy

Last updated: July 2026

Overview

This website (alicantorun.com) is operated by Torun Digital Ventures UG (haftungsbeschränkt), Berlin, Germany (see the Impressum). It is two things: a public site with an optional email newsletter, and a client portal where client teams sign in to work in their own workspaces. This policy covers both. For questions or any request about your data, contact the address at the bottom.

Analytics (consent-based)

I use PostHog, hosted in the European Union, to understand how the public site is used. Analytics and session recordings are OFF by default and start only if you allow them in the consent banner (Art. 6(1)(a) GDPR). You can change your mind at any time by clearing this site's data in your browser; the banner will ask again. Recordings, where allowed, run only on the public site (never inside the client portal), and everything you type is masked. Google Tag Manager loads only after the same consent. This data is not used for advertising and is not sold.

Booking and email contact

Booking a call goes through a Google Calendar appointment page; Google's privacy policy applies to what you enter there, and I receive the details you submit (name, email, chosen time). If you contact me by email, I use your address and message only to respond and follow up.

Newsletter (Resend)

If you subscribe to the newsletter, your email address is stored in my own database and sent through Resend, my email delivery provider. The legal basis is your consent (Art. 6(1)(a) GDPR). Every email carries a one-click unsubscribe link: unsubscribing stops all sending immediately, and I keep a suppression record of your address so you are never emailed again (legitimate interest, Art. 6(1)(f), in reliably honoring your opt-out). If you want that record erased as well, email me and I will remove it. I do not use open tracking, and I do not sell or share your address.

The client portal

Clients and their team members sign in to private workspaces. Two kinds of data are processed there:

  • Account data (your email, name, optional profile photo, role, sign-in method, and your communication preferences), for which Torun Digital Ventures UG is the controller. The basis is the contract with your company (Art. 6(1)(b)). Newsletter and product-tip emails are sent only if you opt in, and you can change both toggles in your account settings at any time.
  • Workspace content (documents, connected repositories, tasks, decisions, and chat with the assistant), which is processed on behalf of the client company that owns the workspace. The client is the controller; Torun Digital Ventures UG is the processor under a data processing agreement with that client.

When the workspace assistant answers a question or indexes content, the relevant text is processed by an AI model provider (currently OpenAI, routed through Vercel's AI Gateway) to produce answers and search embeddings. Workspace content is not used to train models. As the platform operator I can access client workspaces for support and operations; every such access is logged. Workspaces can be exported in full and deleted by their owners at any time; deletion removes the content, including search indexes and stored files.

Service providers

The site and portal run on the following providers, which process data on my behalf: Supabase (database, authentication, and file storage), Vercel (hosting and AI request routing), OpenAI (AI answers and embeddings for portal workspaces), PostHog EU (consent-based analytics), Resend (email delivery), Google (Tag Manager after consent, Calendar booking, and optional Google sign-in), and GitHub (only when a client connects a repository). I do not sell your data.

Retention

  • Newsletter: your address is kept while you are subscribed; after unsubscribing, only the suppression record remains (see above).
  • Analytics: kept according to the PostHog project retention settings; recordings expire automatically there.
  • Portal content: kept until the client deletes it or the workspace/account is deleted, which cascades through all content.
  • Usage and billing records: kept in pseudonymized form (no longer linked to a deleted account) to meet German statutory commercial retention duties (§ 257 HGB, § 147 AO).

Your rights

Under GDPR, you have the right to:

  • Access your personal data
  • Request correction or deletion
  • Restrict or object to processing
  • Data portability
  • Withdraw consent at any time (banner choices, email opt-ins)
  • Lodge a complaint with a supervisory authority

For workspace content, direct your request to the company that owns the workspace (the controller); I support them in fulfilling it.

Contact

For privacy-related questions or requests, contact me at: contact@alicantorun.com

Updates

I may update this policy occasionally. Check this page for the latest version.