Privacy Policy

1. Data We Collect

You provide data directly when you create an account, use our services, or communicate with us.

Depending on your use of the Platform, this may include:

• Registration Data: name, email address, and password (stored in hashed form). For paid services, additional billing details (such as country, postal code, and payment method identifiers from Stripe or PayPal) are processed.
• Profile Information: information you choose to display on your public Alinme page, for example, profile photo, biography, area of expertise, external platform links (GitHub, Medium, YouTube, Udemy, etc.), and social links. You control what you include in your profile. Please avoid posting sensitive information you do not wish to make public.
• Marketplace Content: if you present resources (e.g., project, agents, or online courses), we collect the metadata you submit (title, description, pricing, files).
• Communications: when you contact us (for support, feedback, or partnership), we process your name, email, and message content.

All data you submit is processed on the legal basis of Art. 6 (1)(b) GDPR (performance of a contract) or Art. 6 (1)(a) GDPR (consent, where applicable).

1.2 Data Collected Automatically

When you use the Platform, we automatically collect certain technical data to ensure stability, security, and performance. This may include:

• Log and Usage Data: IP address, browser type and version, operating system, access times, and pages viewed.
  These logs help diagnose errors, prevent abuse, and optimize system performance.
• Device Information: device identifiers, screen resolution, and language preferences to improve user experience.
• Cookies and Similar Technologies: we use only essential cookies for authentication and session management.
  Analytics or marketing cookies are used only with your consent, as required under Art. 6 (1)(a) GDPR and § 25 TTDSG. Details are provided in our Cookie Policy.

1.3 Data from Integrated Platforms

Alinme allows you to connect your professional profiles to showcase your work. When you link third-party accounts (e.g., GitHub, Medium, Udemy, YouTube, Hugging Face), we collect publicly available data from those platforms, for example:

• repository or project names and descriptions
• course or article titles and links
• view counts or statistics (if publicly visible)

This aggregation happens only after your explicit consent and connection action. We do not access private data from those platforms and you can revoke access at any time. The legal basis is Art. 6 (1)(a) GDPR (consent).

1.4 Marketing, Analytics, and Communication Data

If you opt in to our newsletter or marketing updates, we process your email address and engagement metrics (e.g., opens, clicks) to improve our communications.
You can unsubscribe at any time via the link in each message or by contacting us.

We may use basic usage statistics (aggregated and anonymized) to understand general platform performance and feature adoption.

Legal basis: Art. 6 (1)(a) (consent) and Art. 6 (1)(f)(legitimate interest in improving our services).

1.5 Data from Others

We may receive limited data from:

• Referral partners or affiliates (e.g., Udemy, Coursera, Gumroad), information about commissions or course performance for accounting purposes.
• Service providers: email delivery, cloud infrastructure, or analytics in accordance with Art. 28 GDPR data-processing agreements.

No data is bought or sold to third parties.

2. How We Use Your Data

We process personal data only for specific, lawful, and transparent purposes in accordance with the EU General Data Protection Regulation (GDPR) and German data protection laws (particularly the TTDSG and AO/HGB for retention).

We apply the principles of data minimisation, purpose limitation, and storage limitation (Art. 5 GDPR).

Below we explain how and why we process your data, the lawful basis for each purpose, how long we keep it, and who may receive it.

2.1 Account Creation and Authentication

When you register an Alinme account, we process your name, email address, and a password (stored in hashed form).

The content you add is published on your public page at your request; therefore, the lawful basis is againperformance of a contract under Art. 6 (1)(b) GDPR.

If you connect an external account to import public content, you give explicit consent for that connection (Art. 6 (1)(a) GDPR).

You can revoke it at any time by disconnecting the account.

Your profile data is stored until you remove it or delete your account.

2.2 Service Communications

We use your email address to send essential communications, such as registration confirmations, password resets, billing Snackbars, and service updates.

These messages are necessary for the performance of our contract and for ourlegitimate interest in keeping users informed about material changes (Art. 6 (1)(b) and (f)).

Transactional email content is deleted once delivery is confirmed; metadata is kept only for troubleshooting.

2.3 Marketing Communications

If you opt in to receive newsletters or updates, we use your email address to send you Alinme-related news, product tips, and promotional information.

This occurs only with your explicit consent (Art. 6 (1)(a) GDPR).

You can withdraw consent at any time using the unsubscribe link or by contacting us.

We keep proof of consent and minimal delivery logs for up to twenty-four months to demonstrate compliance.

2.4 Analytics and Product Improvement

To improve stability and user experience, we process pseudonymous usage data such as page views, feature interactions, and device information.

Essential technical logs are collected under ourlegitimate interest in maintaining a secure and functional service (Art. 6 (1)(f)).

Any optional analytics that rely on cookies or device identifiers are only activated after you have given consent, as required by § 25 TTDSG.

Raw logs are typically deleted within ninety days, while aggregated statistics may be kept longer in anonymised form.

2.5 Security and Fraud Prevention

We continuously monitor our systems to detect abuse, spam, and security incidents.

This includes automated vulnerability scanning (e.g., Gosec), incident alerting, and rate-limiting through Azure Security Center.

Such processing is necessary to fulfil our legal obligations under Art. 32 GDPR and our legitimate interest in protecting our services(Art. 6 (1)(f)).

Security logs are retained no longer than necessary, typically up to ninety days.

2.6 Affiliate Program and Blog Monetisation

When users or visitors click affiliate links (for example, to Udemy, Coursera, edX, Amazon, or Gumroad), we may process limited technical identifiers to attribute commissions and comply with our partner agreements.

Affiliate tracking that relies on cookies or advertising IDs is only activated after you consent via our cookie banner, in line with § 25 TTDSG andArt. 6 (1)(a) GDPR.

Financial records of affiliate commissions are kept for accounting purposes for up to ten years.

2.7 Advertising Campaigns

We occasionally run paid advertisements on platforms such as LinkedIn, YouTube, or Google.

Any data collected through those services (e.g., cookies or ad IDs) is processed only after your consent and managed in accordance with their respective privacy policies.

Our legal basis is consent (Art. 6 (1)(a) GDPR) and § 25 TTDSG.

2.8 Events and Webinars

When you register for an Alinme meetup or webinar, we use your contact details to send event information and manage participation.

Processing is necessary for contract performance (Art. 6 (1)(b)).

Event-related data is deleted within twelve months after the event unless required for invoicing.

2.9 Legal Compliance and Enforcement

We may process personal data to comply with our legal obligations, for instance, taxation, record-keeping, and responding to lawful requests from authorities, and to establish, exercise, or defend legal claims.

This processing is required under Art. 6 (1)(c) and (f) GDPR.

Retention follows the statutory periods in German commercial and tax law, generally ten years for financial records.

2.10 Profiling and Automated Decisions

Alinme does not use automated decision-making that produces legal or similarly significant effects under Art. 22 GDPR.

Any future personalisation (for example, recommending relevant experts or AI content) will be limited to improving your experience, hosted entirely within the EU, and can be turned off where feasible.

2.11 International Transfers

All core processing occurs within the European Economic Area (EEA) on Microsoft Azure (West Europe).

Where partners or affiliates are based outside the EEA, such as certain payment processors or advertising platforms — we ensure that EU Standard Contractual Clauses or equivalent safeguards are in place in compliance with Art. 46 GDPR.

2.12 Special Categories of Data

We do not intentionally collect sensitive data such as health, political opinions, or religious beliefs (Art. 9 GDPR).

If you voluntarily publish such information in your profile, it becomes visible according to your settings.

We recommend avoiding the disclosure of sensitive information on public pages.

3. How We Share Your Data

Alinme does not sell personal data and shares it only when strictly necessary to operate the Platform, perform our contractual obligations, or comply with legal duties.

All recipients are bound by data-processing agreements (Art. 28 GDPR) or act as independent controllers with equivalent safeguards.

Whenever possible, data is processed within the European Economic Area (EEA) on Microsoft Azure West Europe infrastructure.

3.1 Public Profiles and Content Visibility

Information you choose to publish on your Alinme profile, such as your name, photo, biography, professional links, and showcased projects — becomespublicly visible in accordance with your settings.

Public content may be indexed by search engines or seen by visitors who are not registered users. This visibility is an inherent part of the Platform’s purpose and is therefore based on Art. 6 (1)(b) GDPR (performance of contract).

You can edit or remove your content at any time; changes take effect immediately for new views, although cached versions may persist temporarily on external search engines.

When you connect your account with external services (e.g., GitHub, Medium, Udemy, YouTube, Hugging Face) to display your work, only public data from those platformsis imported, after your explicit consent (Art. 6 (1)(a) GDPR).

You may revoke access at any time in your account settings.

3.2 Technical and Infrastructure Providers

To run the Platform reliably and securely, we use several data processors who act solely on our documented instructions:

• Microsoft Azure (Region West Europe): hosting, databases, file storage, container apps, and security monitoring.
• Microsoft 365 / Exchange Online: transactional emails and communication.
• Azure Domains or accredited registrars: custom domain and SSL provisioning.
• CI/CD and security tools (e.g., Github Actions): automated deployment and vulnerability scanning.
• Email or support platforms (e.g., SendGrid or equivalent EU service): user communications.

Each provider is contractually bound under Art. 28 GDPR, implements state-of-the-art security (Art. 32 GDPR), and may not use your data for its own purposes.

3.3 Marketing, Affiliates, and Advertising Partners

Where you have consented (Art. 6 (1)(a) GDPR and § 25 TTDSG), we may share limited pseudonymous identifiers or cookie data with verified affiliate or advertising partners to attribute commissions or measure campaign reach.

hese partners include platforms such as Udemy, Coursera, edX, Gumroad, Amazon Associates, LinkedIn Ads, YouTube, and Google Ads.

No personally identifying payment or profile data is transferred to them unless you explicitly interact with their services (e.g., clicking an affiliate link).

You can withdraw consent for such sharing at any time via the cookie-consent banner or browser settings.

3.4 Events, Meetups, and Webinars

If you register for an in-person or online Alinme event, we may share your registration details (name, email, ticket number) with event-management platforms or venue providers solely to facilitate access and communication.

These partners are bound by Art. 28 GDPR processing agreements and delete the data after the event unless further retention is required for accounting or legal obligations.

3.5 Professional Advisors and Compliance Recipients

For statutory compliance, financial auditing, or legal representation, we may share limited personal data with:

• Certified accountants or tax advisors (to comply with German bookkeeping obligations under AO and HGB)
• Legal counsel (for contract enforcement or defence of claims)
• Insurance or financial authorities when required by law.

Such sharing is based on Art. 6 (1)(c) (legal obligation) and Art. 6 (1)(f) (legitimate interest in safeguarding our rights)

3.6 Public Authorities and Legal Disclosure

In rare cases, we may be required to disclose personal data to law-enforcement or supervisory authorities when legally mandated under the GDPR, the German Federal Data Protection Act (BDSG), or other applicable EU law.

Disclosures occur only if they are necessary to comply with a binding legal request, court order, or to protect the rights, property, or safety of Alinme or others.

We carefully assess every request for legality and proportionality and, where permitted, notify affected users before disclosure.

This processing is required under Art. 6 (1)(c) GDPR.

3.7 Corporate Transactions

If Alinme undergoes a merger, acquisition, restructuring, or sale of assets, relevant personal data may be transferred to the acquiring entity as part of that transaction, but only under strict confidentiality and subject to this same Privacy Policy.

The receiving entity must continue to use your data solely for the same purposes and comply with the GDPR.

If ownership or control changes, you will be informed in advance, and your existing privacy choices will remain valid.

3.8 International Data Transfers

All operational data is stored in the EEA (Microsoft Azure West Europe).
Where a sub-processor or partner operates outside the EEA, transfers take place only under:

• an adequacy decision by the European Commission (Art. 45 GDPR), or
• the Standard Contractual Clauses (SCCs) approved by the Commission (Art. 46 GDPR).

We regularly verify that all international partners maintain equivalent levels of protection, and we record these transfers in our internal processing registry as required by Art. 30 GDPR.

3.9 General Safeguards

Every recipient of personal data from Alinme is contractually obligated to:

• Use the data only for the defined purpose;
• Apply security measures meeting Art. 32 GDPRstandards;
• Maintain confidentiality;
• Delete or return data once the contractual purpose is fulfilled.

No third party is authorised to use Alinme user data for independent marketing or profiling activities.

This section ensures full compliance with Articles 13 and 14 GDPR and § 25 TTDSG, detailing all categories of recipients, conditions of disclosure, and safeguards for international transfers—exactly what a supervisory authority in Germany (BayLDA) would expect.

4. Your Rights, Choices, and Data Retention

Alinme processes your personal data transparently and in accordance with the data-protection principles set out in Articles 5–11 GDPR.

This section explains how long we keep your data, what rights you have under European and German law, and how you can exercise them.

4.1 Data Retention and Deletion

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law.

The specific retention periods depend on the data category and purpose of processing.

Account Data

Your profile and account information are kept active as long as your account remains open.

If you delete your account, we anonymise or erase your data within 30 days, unless further retention is legally required or justified.

Transactional and Financial Records

Payment data, invoices, and donation or sales records are retained for ten (10) years, in accordance with §§ 147 AO and 257 HGB, which require German companies to preserve financial documentation.

Security and Log Data

Technical logs, such as IP addresses or access metadata, are stored for up to 90 days to maintain system security and detect fraud.

After that, they are automatically deleted or anonymised.

Communications and Support Requests

Emails and customer-support interactions are deletedafter resolution unless retention is necessary for dispute handling or legal compliance.

Marketing and Consent Records

If you subscribed to newsletters or consented to cookies or marketing, we store your consent record for up to 24 months to demonstrate lawful processing, or until you withdraw it.

Aggregated and Anonymised Data

We may keep non-identifiable, aggregated data (for example, platform usage statistics) indefinitely for legitimate business or research purposes, provided it can no longer be linked to an individual.

4.2 Your Rights Under the GDPR

s an individual located in the European Union, the EEA, the United Kingdom, or Switzerland, you have the following rights under Articles 12–23 GDPR and the German Federal Data Protection Act (BDSG).

You can exercise these rights free of charge at any time by emailing privacy@alinme.com.

• Right of Access (Art. 15 GDPR): You have the right to obtain confirmation as to whether Alinme processes your personal data and, if so, to receive a copy of that data and information about its processing.
• Right to Rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data. You can also update most information directly within your Alinme account settings.
• Right to Erasure (“Right to Be Forgotten,” Art. 17 GDPR): You may request deletion of your personal data when it is no longer necessary, when you withdraw consent, or when processing is unlawful. This does not apply where retention is required by tax, accounting, or other legal obligations.
• Right to Restriction of Processing (Art. 18 GDPR): You can request that we temporarily stop processing your data in specific cases, such as when you contest its accuracy or object to processing.
• Right to Data Portability (Art. 20 GDPR): You may request that we provide your personal data in a structured, commonly used, and machine-readable format so you can transfer it to another provider, where technically feasible.
• Right to Object (Art. 21 GDPR): You have the right to object to processing based on legitimate interests (Art. 6 (1)(f)) or for direct marketing purposes. We will honour your objection unless we demonstrate compelling legitimate grounds to continue processing (e.g., to comply with legal obligations).
• Right to Withdraw Consent (Art. 7 (3) GDPR): If we process your data based on consent (e.g., newsletters, analytics, cookies, affiliate tracking), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it was withdrawn.
• Right to Lodge a Complaint (Art. 77 GDPR): If you believe your rights have been infringed, you can lodge a complaint with your local data-protection authority.

For Alinme, the competent authority is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
Website: www.lda.bayern.de

4.3 Exercising Your Rights

Requests should be sent to privacy@alinme.com.

We may need to verify your identity before processing your request to protect your data from unauthorised access.

We aim to respond within 30 days, as required by Art. 12 (3) GDPR.

Complex or multiple requests may extend this timeframe by a further two months; if so, we will inform you.

If your request involves data that we process on behalf of an enterprise client (for example, a company using “Alinme as a Solution”), we will forward your request to the relevant data controller.

4.4 Account Closure and Data After Deletion

You can delete your Alinme account at any time through your account settings or by contacting us.

After closure:

• Your profile will no longer be publicly visible within 24 hours.
• All personal data will be deleted or anonymised within 30 days, except where retention is legally required.
• Data shared with other users (for example, in consultation bookings or transaction receipts) may remain visible to those users as part of their own records.
• Publicly available content, such as portfolio pages indexed by search engines, may remain accessible until external caches are refreshed.
• If your account was subject to a restriction for misuse or fraud, minimal identifiers may be retained to enforce our Terms of Use and protect our community.

We retain anonymised, non-personal data (such as aggregated usage metrics) indefinitely for service improvement and statistical reporting, as it can no longer identify you.

4.5 Limitations and Exceptions

Certain rights may be restricted if fulfilling your request would:

• Interfere with the rights or freedoms of others (Art. 23 GDPR);
• Prevent compliance with a legal obligation (e.g., bookkeeping);
• Compromise system security or legitimate business interests.

In such cases, we will provide a clear explanation of the reasons and the applicable legal basis.

4.6 Children’s Data

Alinme is intended for individuals aged 16 and older.

We do not knowingly collect data from children under 16 years of age.

If we become aware that personal data has been collected from a minor without parental consent, we will promptly delete it.

4.7 Contact for Data Protection Inquiries

If you have any questions or requests regarding the processing of your personal data under this Privacy Policy, you can contact us at:

Data Protection Contact

Maryam Bahrami: Founder, Alinme

📧 privacy@alinme.com

All other company and contact details (including the postal address and phone number) are provided in ourImprint.

If a formal Data Protection Officer (DPO) is appointed or an external consultant engaged, their contact details will be published and kept up to date on this page.