Privacy
AtsIg is a rehearsal coach: you give it a recording of your own talk, and it gives you notes. That means it handles something personal, so this page says exactly what happens to it, in plain language. Trust, plainly covers the same ground less formally.
Last updated 29 July 2026. This is the pilot version.
Who is responsible
AtsIg is operated by Daniel Elmaleh as an individual (no company is incorporated yet). For anything in this policy, including any request about your data, write to daniel.elmaleh@epfl.ch. During the pilot that address reaches the person who built the product.
What is collected, and why
| Data | Why | Basis |
|---|---|---|
| Email address | To create your account and send the sign-in link. | Needed to provide the service you asked for. |
| What you say about your talk | Topic, objective, format, and anything optional you add (audience, setting, style to preserve, concerns). It conditions the coaching. | Needed to provide the service. |
| Your recording | The take that gets analyzed. Only its audio is used. | Your explicit consent, given per session before anything runs. |
| Derived material | Transcript with timings, measured delivery signals, findings, and your report. | Your explicit consent, same gate as the recording. |
| Accommodations you declare | Optional and free-text. Used only to adjust the coaching rules, never stored for any other purpose or used in analytics. | Your explicit consent. If what you write concerns your health, you are choosing to share it; you can leave the field empty and the product works. |
| Waitlist entry | Your email and, if you write one, a line about what you are preparing. Used only to invite you, in date order. | Your consent, withdrawable at any time. |
| Technical logs | Ordinary server and error logs from the hosting providers below, used to keep the service working. | Legitimate interest in a functioning, secure service. |
There is no analytics product, no advertising pixel, and no tracking cookie on this site. Your data is never sold, rented, or used to train anyone’s models.
Who else touches it
These providers process data on AtsIg’s behalf, under their own terms. They are named on the consent screen before any analysis starts.
| Provider | Role and location |
|---|---|
| Supabase | Account, database, and media storage. Hosted in the EU (Frankfurt). |
| Railway | Runs the analysis worker. Hosted in the EU (west). |
| Google Cloud | Speech-to-Text transcription, via Google’s EU endpoint. |
| Anthropic | Runs the coaching analysis on Claude models, by API. Processing may take place outside the EEA. |
| Vercel | Hosts this website. Processing may take place outside the EEA. |
| Resend | Sends the sign-in emails. Receives your email address only, never your content. Processing may take place outside the EEA. |
Storage, database, and analysis infrastructure run in the EU. Where a provider processes data outside the EEA, that is stated above rather than hidden behind a general residency claim.
How long it is kept
- LiveRecordings: 30 or 90 days, the window you pick yourself when you consent. An automated job deletes them when the window ends.
- LiveWorking artifacts such as intermediate analysis records are removed with the recording. Your reports stay in your account so your progress across takes still works, until you delete the session or your account.
- LiveWaitlist entries: deleted once you are invited and join, if you decline, or as soon as you ask.
- BuildingA self-serve delete button with a receipt is a launch requirement still being built. Until it ships, email the address above and deletion is done for you.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its processing, or receive it in a portable form. Where processing rests on your consent, you can withdraw that consent at any time, and withdrawing it stops any analysis that has not already finished. Declining consent in the first place simply means no analysis happens; nothing else about your account changes.
Write to daniel.elmaleh@epfl.ch for any of these. During the pilot, requests are handled by hand and quickly, since the group is small.
If you think your data has been mishandled, you can complain to a data protection authority: in the EEA, the authority where you live or work; in Switzerland, the Federal Data Protection and Information Commissioner.
Security, plainly
- Your account is isolated. Database rules scope every row and every file to its owner, so one account cannot read another’s data.
- Media is not public. Recordings are served only through short-lived signed links, never from an open URL.
- Consent is enforced where the data lives. The analysis pipeline refuses to start without a valid consent record; it is not merely a checkbox in the interface.
- No security theatre. This is a young product built by one person. It has no security certification, and this page will never claim one it does not hold.
Age
AtsIg is meant for adults preparing talks, and is not directed at children. If you are under 16, please do not create an account without a parent or guardian’s involvement.
Changes
When the product changes what it collects or who processes it, this page changes with it, and the date at the top moves. Pilot users are told directly about changes that matter.