Legal

Privacy Policy

UpdatedSeptember 18, 2026

1. Controller

The controller responsible for data processing on this website is:

Airbuild FlexCo
Liechtensteinstraße 22a / 4
1090 Vienna
Austria
Email: privacy@airbuild.ai
Website: airbuild.ai

2. General information

This privacy policy informs you about the nature, scope and purpose of the processing of personal data on our website. Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

3. Collection and storage of personal data

3.1 When visiting the website

When you access our website airbuild.ai, your internet browser automatically transmits information to our server. This information is temporarily stored in a log file:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the retrieved file
  • Website from which access is made (referrer URL)
  • Browser used and, where applicable, the operating system of your device

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical provision and security of the website)

3.2 When using our AI service

When you use our AI software-generation service, we process the following data:

  • Your inputs and prompts
  • Generated software and code outputs
  • Usage statistics and interaction data
  • Technical metadata to improve the service

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

3.3 When registering and creating an account

To use certain features you can create an account. We collect:

  • Email address
  • Username
  • Password (stored only as a one-way hash — never in plain text and not recoverable)
  • Optional: further profile data

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

4. Cookies and similar technologies

Our website uses cookies and comparable browser storage. The cookie banner offers exactly two categories:

  • Strictly necessary: for the basic functions of the website (session, security) and to record your cookie choice. Always active.
  • Analytics: for statistical evaluation of site usage (Google Analytics 4) — loaded only with your consent.

We do not offer a marketing or advertising category and we set no advertising cookies. The language you see follows the URL you open (the /de section for German) and is not stored in a cookie. Your cookie choice itself is kept only locally in your browser (local storage, key “xaio-cookie-consent”) and is not transmitted to us; it records only the categories you selected and when you selected them.

You can configure your browser settings to block or delete cookies. However, this may limit the functionality of the website.

Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest) for technically necessary cookies

Google Analytics

With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics is only loaded after you accept the “Analytics” category in the cookie banner; IP addresses are processed in anonymised form. Google may also transfer data to servers of Google LLC in the USA; this is based on the EU-US Data Privacy Framework and Standard Contractual Clauses.

You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer — Google Analytics is then disabled and analytics cookies are removed. Legal basis: Art. 6(1)(a) GDPR (consent).

5. Disclosure of data

We disclose your personal data only if:

  • you have given your express consent (Art. 6(1)(a) GDPR)
  • it is necessary for the performance of a contract (Art. 6(1)(b) GDPR)
  • there is a legal obligation (Art. 6(1)(c) GDPR)
  • there is a legitimate interest (Art. 6(1)(f) GDPR)

5.1 Hosting and cloud services

We use external hosting providers to operate our website. These providers process your data on our behalf and are contractually bound pursuant to Art. 28 GDPR.

5.2 AI model providers

To provide our AI services we work with the following AI model providers: Anthropic (Claude), OpenAI, Mistral AI, Google (Gemini) and Lyceum, which runs the open-weight models (DeepSeek, Kimi K3, Qwen3-Coder, GLM-5.3) inside the EU. The same models are also available natively through each provider's own API — only if you explicitly select that route. The current list is available at /sub-processors. Your inputs are processed to generate software code. This processing is carried out under data processing agreements pursuant to Art. 28 GDPR.

Your inputs and the generated outputs are not used by Airbuild or these providers to train AI models. Exception: the native DeepSeek, Kimi and GLM routes, where you explicitly select one — see the sub-processors page for details.

6. Transfer of data to third countries

Where we process data in countries outside the EU/EEA, we ensure an adequate level of data protection through:

  • EU Standard Contractual Clauses
  • Adequacy decisions of the EU Commission
  • Certifications under the EU–US Data Privacy Framework (DPF)

7. Storage period

We store personal data only for as long as necessary to fulfil the purposes or as required by statutory retention periods:

  • Server logs: 30 days
  • Account data: until the account is deleted
  • Contract data: 7 years (pursuant to § 132 BAO – Austrian Federal Fiscal Code)
  • Consents: until withdrawn
  • Project content (prompts, chat history, generated code, uploaded files): until you delete the project or your account; there is no automatic deletion period. Where a data processing agreement is in place, deletion after termination of the contract follows Section 12 of that agreement (as a rule within 30 days, subject to backup cycles and statutory retention obligations).

8. Your rights as a data subject

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): you can request information about your stored data
  • Right to rectification (Art. 16 GDPR): you can request the correction of inaccurate data
  • Right to erasure (Art. 17 GDPR): you can request the deletion of your data
  • Restriction of processing (Art. 18 GDPR): you can request the restriction of processing
  • Data portability (Art. 20 GDPR): you can receive your data in a structured format
  • Right to object (Art. 21 GDPR): you can object to processing
  • Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consents granted at any time

To exercise your rights, please contact us at: privacy@airbuild.ai

9. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the competent data protection authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

10. Data security

We use technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons:

  • SSL/TLS encryption for data transmission
  • Encrypted storage of sensitive data
  • Regular security updates
  • Access controls and authentication
  • Regular backups

11. Automated decision-making and profiling

We do not use automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or significantly affects you. AI-generated software creation is based on your explicit inputs and remains under your control at all times.

12. Changes to this privacy policy

We reserve the right to adapt this privacy policy to reflect changes in the legal situation or changes to our services. You can always find the current version on our website at airbuild.ai/privacy.

13. Contact

If you have any questions about data protection or wish to exercise your rights, please contact us:

Airbuild FlexCo
Data-protection contact
Liechtensteinstraße 22a / 4
1090 Vienna, Austria
Email: privacy@airbuild.ai
Website: airbuild.ai