Privacy policy
Who is responsible
Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany, runs BodyAtlas (bodyatlas.site) and is the controller for the personal data described here. Contact: info@nubri.co.
What we process
- Your account: email address, name, an Argon2id hash of your password, and when you confirmed your email address.
- Signing in: for each session, the IP address and browser it was opened from; sign-in attempts with their IP address; and a security log of sign-ins and account changes with the IP address.
- Your study data: lesson progress, quiz results and your notes.
- The AI tutor (Pro): your questions, with the lesson you are reading, are sent to Anthropic's Claude on Amazon Bedrock (Claude Sonnet 5.5, or Claude Opus 5.5 when you choose "Think deeper"). Your conversations and the amount of AI used are stored with your account. Amazon Bedrock doesn't use your data to train models.
- Billing: your Stripe customer and subscription (plan, status, renewal date) and Stripe's notifications about them. We never see card details.
- Emails we send you: address confirmation, password resets and subscription notices.
- Site analytics: our pages keep a random visitor id and where you first came from (source, campaign, referring site, page) in your browser's local storage, and send page events to our own server. No third-party analytics or advertising tools.
- Messages you send through the contact form, which reach us by email.
Why, and on what legal basis
To provide the service you signed up for (Art. 6(1)(b) GDPR); to keep it secure and free of abuse, and to know which channels bring visitors (Art. 6(1)(f) GDPR, our legitimate interests); and to keep the records the law requires (Art. 6(1)(c) GDPR). We don't sell personal data.
Processors
- Amazon Web Services: hosting, Claude on Amazon Bedrock, and email delivery (United States).
- Stripe: payments (United States).
Transfers to the United States rely on the EU Standard Contractual Clauses.
How long we keep it
Your account and study data are kept until you delete your account on the Account page. Deleting it removes at once your name, email address, password, notes, progress, quiz results and tutor conversations, and signs you out everywhere. Subscription and payment records, including Stripe's notifications, are kept as long as accounting law requires. Session records are deleted 30 days after a session ends, sign-in attempts after 7 days, and the security log after a year.
Cookies and local storage
One cookie, atelier_session, keeps you signed in until you sign out or the session expires; it is needed for the service to work. Your browser's local storage holds the visitor id and first-visit source described above, and a flag in session storage makes sure a visit is counted once (it is cleared when you close the tab).
Server logs
When you open any page, our web server records your IP address, the time, the address requested, the response and your browser's user agent. We use these logs only to keep the service secure and to find faults (Art. 6(1)(f) GDPR). They are deleted automatically after at most 8 days.
Your rights
You can ask for access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and you can object to processing based on legitimate interests. Email info@nubri.co. You may also complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.