Ce document est disponible en anglais et en allemand. En cas de doute, la version allemande fait foi.

Privacy policy

Last updated: October 2026 · Draft – to be reviewed before launch

1. Controller

Dipl.-Ing. Philipp Rufinatscha, Am Europlatz 2, 1120 Vienna, Austria – email privacy@acard.ai (see Imprint).

2. What Acard is

Acard is a search service for building products used through AI assistants such as ChatGPT (OpenAI) or Claude (Anthropic) and through this website. Your assistant sends search requests to our server.

3. Data we process

Visiting the website: When you open a page, our hosting provider processes technically necessary connection data (IP address, time, page, browser) to deliver and secure the website; it is stored only briefly. We use no tracking or advertising cookies and no analytics tools. Your choice of light or dark design is stored only locally in your browser. Fonts are currently loaded from Google Fonts (Google Ireland Ltd.), which transmits your IP address to Google – switching to self-hosted fonts is planned.

Searches through AI assistants: Your assistant calls Acard from its own servers, so we receive neither your IP address nor your name, account or chat history. For each call we log the time, the function used, search terms and filters, the number of results, the manufacturers and products shown and the client type (e.g. “ChatGPT”). If your assistant passes an anonymised user identifier (ChatGPT does), we store only a salted one-way hash of it to count returning use without being able to identify you. For semantic search, the search text is converted into a numeric vector by our hosting provider (Cloudflare Workers AI). Purpose: operating, securing and improving the service and aggregated statistics for manufacturers (how often products were shown, opened or requested, plus anonymised search trends such as frequent search terms and categories – never individual searches or users). Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Individual log entries are deleted after 180 days; aggregated daily counts per manufacturer are kept.

Sample and contact requests: When you order a sample or contact a manufacturer, we process the details you provide (name, email, optionally company, phone, project, delivery address, message) and forward them to that manufacturer so it can reply or send the sample. Legal basis: performance of your request (Art. 6(1)(b) GDPR). We keep requests for up to 24 months for follow-up questions unless you ask us to delete them earlier. The manufacturer then processes your data under its own responsibility.

Manufacturer accounts: For signing in to the manufacturer dashboard we process the business email address, name and role, the link to the manufacturer, the acceptance of the profile terms (time, person) and corrections and settings. Sign-in links and sessions are stored only as hashes. We set a strictly necessary session cookie for signing in (valid for 30 days). Legal basis: contract or pre-contractual measures (Art. 6(1)(b) GDPR) and legitimate interest in documenting the approval (lit. f). Retention: for the life of the account; records of the approval for up to 3 years afterwards.

Manufacturer requests via the form: We process name, role, business email, company, website and message to handle and document your request (Art. 6(1)(b) and (f) GDPR) and keep them for up to 36 months.

4. Recipients and processors

Hosting, database, AI-assisted search and vector search: Cloudflare, Inc. (USA) as processor. Sending sign-in and notification emails: Resend, Inc. (USA) as processor. Manufacturers only receive requests you explicitly address to them. Your AI assistant (OpenAI, Anthropic and others) processes your chats under its own privacy policy.

5. Transfers to third countries

Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.

6. Product images

Product images are loaded directly from manufacturers’ websites, which therefore technically receive your IP address.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. Contact: privacy@acard.ai. You may also lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

8. Manufacturer data

Product profiles contain publicly available company and product information and general contact addresses of manufacturers. Manufacturers can claim, correct or remove their profile at any time via the manufacturer page or manufacturers@acard.ai.

9. Changes

We update this policy when the service changes. The version published here applies.