Privacy Policy

1. Data Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

For full company details including registered address and directors, please see our Imprint (Impressum).

2. Overview of Data Protection

This policy explains what personal data we collect when you use our website and the Celian platform, how we use it, and your rights regarding that data. “Personal data” means any information that can directly or indirectly identify you.

3. Data We Collect

3.1 Account Data

When you create an account, we collect:

• Name and email address (via authentication provider)
• Profile image (if provided by your authentication provider)
• Company information you voluntarily provide

3.2 Project & Usage Data

When you use the platform, we store:

• Projects, chat sessions, and generated code artifacts
• Design system configurations and context sources
• Token usage and API key metadata (keys are encrypted at rest)

3.3 Newsletter & Waitlist

If you subscribe to our newsletter or join the waitlist, we collect your email address and, optionally, your name. This data is stored until you unsubscribe or request deletion.

3.4 Website Analytics

With your consent, we use Google Analytics and Hotjar to understand how visitors use our website. These tools may set cookies on your device. You can manage your preferences at any time via the “Manage Cookies” link in our footer. For full details, see our Cookie Policy.

4. Legal Basis for Processing

We process your data based on the following legal grounds (GDPR Article 6):

5. Artificial Intelligence & Transparency

In accordance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), we provide the following transparency disclosures about how Celian uses AI:

5.1 AI-Generated Content

Celian is an AI-powered platform that generates code, design artifacts, and technical recommendations. When you interact with Celian's chat interface, you are communicating with an artificial intelligence system — not a human. All AI-generated responses are clearly distinguished in the user interface through visual indicators (the Celian AI avatar and labelling).

5.2 How AI Processes Your Data

When you use Celian, the AI system processes:

• Your chat messages — to understand your intent and generate appropriate responses
• Your project context — code, design systems, and project configuration to produce contextually relevant output
• Session history — to maintain conversational continuity within a project

Your data is sent to Google's Gemini API for inference processing. Google acts as a data processor under our instruction and is bound by a Data Processing Agreement.

5.3 User-Provided API Keys (BYOK)

Celian allows you to connect your own API keys for third-party AI models (e.g. Anthropic Claude). When you provide your own API key, your data is sent to that provider through our server acting as a pass-through. In this case, the data processing relationship for that provider is between you and the provider directly, governed by your own agreement with them. Celian does not store or log the content of requests made with user-provided API keys beyond the active session.

5.4 Automated Decision-Making

Celian uses automated intent classification to determine how to best respond to your requests. This includes confidence scoring to decide whether to ask clarifying questions or proceed with code generation. These automated decisions affect only the quality and type of response you receive — they do not produce legal effects or significantly affect you in a similar manner as described in GDPR Article 22.

5.5 Local Processing (MCP Protocol)

Celian operates primarily through a local Model Context Protocol (MCP). Unlike traditional cloud-based tools, Celian can read your local file system directly on your machine. Your proprietary code, design tokens, and routing configurations are processed locally and are not permanently stored on our cloud servers unless you explicitly opt in to cloud synchronisation.

5.6 Risk Classification

Under the EU AI Act risk framework, Celian is classified as a limited-risk AI system. It does not fall within the high-risk categories defined in Annex III of the regulation. Our primary obligations are transparency (Article 50), which we fulfil through clear UI labelling and this disclosure.

6. Third-Party Processors & International Transfers

We use the following third-party services to operate our platform:

Where data is transferred outside the EU/EEA (e.g. to the United States), we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as approved by the European Commission to ensure adequate protection of your personal data.

User-provided API keys: If you connect your own API key for a third-party AI provider (e.g. Anthropic Claude), data is routed to that provider under your agreement with them. Please review their privacy policies and data processing terms directly.

7. Data Retention

• Account data: Retained for the duration of your account. Deleted within 30 days of account deletion.
• Project data: Retained for the duration of your account. You may delete individual projects at any time.
• Newsletter data: Retained until you unsubscribe or request deletion.
• Analytics data: Google Analytics retains data for 14 months. Hotjar retains session data for 365 days.
• Chat data sent to AI providers: Not retained by our AI providers beyond the inference request. See each provider's data processing terms for details.

8. Your Rights Under the GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) — Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — Request correction of inaccurate data.
• Right to erasure (Art. 17) — Request deletion of your personal data (“right to be forgotten”).
• Right to restriction (Art. 18) — Request that we restrict certain processing activities.
• Right to data portability (Art. 20) — Request your data in a structured, machine-readable format.
• Right to object (Art. 21) — Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7) — Withdraw consent at any time (e.g. cookie preferences, newsletter).

To exercise any of these rights, please contact us at privacy@celian.ai. We will respond within 30 days.

9. Cookies

We use cookies and similar technologies on our website. Non-essential cookies (such as analytics) are only placed with your explicit consent. For a full list of cookies, their purposes, and how to manage them, please see our Cookie Policy.

You can change your cookie preferences at any time by clicking the “Manage Cookies” link in the footer.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Row-level security policies on our database
• Secure authentication via established providers
• Regular security reviews and access controls

11. Children's Data

Celian is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Germany, the competent authority depends on the federal state in which our company is registered. A list of data protection officers and their contact details can be found at: www.bfdi.bund.de.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this page. For significant changes, we may also notify you by email or through a notice on our website.

14. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at: