This Privacy Policy explains how Atlas Ally (“we”, “us”, or “our”) collects, uses, and protects information about you when you visit our website, send us a fit-check enquiry, book or take part in a consulting session, or use our hosted agent service. By signing up for the hosted agent, you agree to this policy.
The controller responsible for data processing under the GDPR is André Filipe Gomes Faria (sole proprietor), Schillerpromenade 10, 12049 Berlin, Germany — see the Imprint. Contact: privacy@atlasally.net.
1. What Data We Collect
- Account & email: your name, email address, and password hash (stored by Supabase Auth).
- Chat messages: messages you send to your agent through the dashboard chat or connected channels (Telegram, WhatsApp, Slack, email). Stored to power the conversation history and context window.
- Agent memory & profile:facts and preferences your agent learns about you over time (stored on your dedicated server and optionally synced to the platform dashboard). You can opt out of platform sync in Settings. If you use the “Learn my voice” feature, we also derive a writing-style profile from a bounded sample of your sent email; this profile is generated and stored only on your dedicated server, never synced to the platform.
- Connected-account tokens: OAuth tokens for external services you connect (e.g. Google, Slack, Notion) are held securely by Composio on our behalf. We do not store raw tokens ourselves.
- Usage & billing: subscription tier, payment method details (held by Stripe — we store only the Stripe customer/subscription ID), and LLM token usage figures.
- IP address: collected transiently for rate-limiting and abuse prevention. Not stored persistently in application logs.
- Consent record: the version of this policy you accepted and the timestamp of acceptance (GDPR Art. 7 demonstrable consent).
- Email communications: we may send you account, legal, and (when applicable) product emails via our email provider, Resend. Legal/account emails (e.g. billing, security notices) are sent regardless of preference; you can opt out of non-essential product emails at any time from the Settings page or via the unsubscribe link included in every such email.
2. Why We Collect It & Legal Basis
- Contract performance (Art. 6(1)(b) GDPR): account data, chat messages, agent memory, and usage data are necessary to provide the service you signed up for.
- Legal obligation (Art. 6(1)(c) GDPR): billing and consent records must be retained to comply with applicable law.
- Legitimate interest (Art. 6(1)(f) GDPR): IP-based rate-limiting to protect the platform from abuse.
3. Retention
Account and profile data is retained while your account is active. After account deletion, data is purged within 30 days except where we are required by law to retain it (e.g. billing records, which are kept for 7 years). Anonymised aggregate usage statistics may be retained indefinitely.
4. Your Rights (GDPR)
If you are in the EEA, UK, or Switzerland, you have the right to access, correct, port, or erase your data, and to object to or restrict processing. You can exercise most of these rights directly from the Settings page (data export, memory opt-out, email preferences, account deletion). For requests we cannot fulfil in self-service, contact us at privacy@atlasally.net. We will respond within 30 days.
5. Sub-Processor List
We share data with the following sub-processors to operate the service:
- Supabase
- Database, authentication, and file storage (PostgreSQL + Auth)
- OpenRouter + downstream LLM providers
- LLM inference for agent responses and memory summarisation. Your chat messages are sent to the model provider selected for your agent. Message-intent classification (routing a message to a connected app) separately uses TypeSafe via OpenRouter, independent of your agent’s own selected inference provider.
- Composio
- Secure storage and execution of OAuth tokens for external integrations (Google, Slack, Notion, etc.)
- Stripe
- Payment processing and subscription management, and payment for Starter Sessions and other consulting services via Stripe Payment Links. We share your email and billing details with Stripe.
- Hetzner
- VPS hosting for your dedicated agent server. Your agent data resides on a Hetzner server in the EU.
- Telegram / WhatsApp (Meta) / Slack
- Messaging delivery when you connect these channels. Your messages transit their infrastructure.
- Linear
- In-product feedback submission (when you use the feedback feature).
- Cloudflare
- DNS resolution and DDoS protection. Cloudflare sees your IP address.
- Resend
- Outbound email delivery for account, legal, and (when applicable) product emails, and delivery of fit-check form submissions to our inbox, and delivery of withdrawal confirmations of receipt. You can opt out of non-essential emails in Settings.
- Notion
- When you connect Notion as an integration, we access your Notion data on your behalf via Composio.
- Vercel
- Website hosting and cookieless Web Analytics for atlasally.net.
- Google (Workspace)
- Email hosting for our inbox, Google Meet for consulting sessions, and Google Drive storage of session recordings.
- ImprovMX
- Email forwarding for addresses on the atlasally.net domain.
- Cal.com
- Session scheduling and the pre-session questions you answer when booking a Starter Session.
6. Cookies & Local Storage
We use a Supabase session cookie (HttpOnly, Secure) for authentication. We do not use third-party advertising cookies or tracking pixels. The withdrawal form sets one short-lived functional cookie, described in section 10.
7. Website Visitors & Analytics
When you browse atlasally.net, we use Vercel Web Analytics, a cookieless analytics tool that counts aggregated page views without tracking individual visitors. Our hosting provider, Vercel, also keeps server logs for security and delivery of the site. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding which pages are used.
8. Fit-Check Enquiries
The written fit-check form on our Contact page collects your name, email address, company, team or role, a description of the work you want help with, and, optionally, the tools you already use. Submitting the form requires your consent to be contacted about your request; we use these details only to reply. The form is sent as an email through our provider, Resend, to our inbox and is not stored in a database. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). We delete fit-check submissions after 12 months if no engagement follows.
9. Starter Session Booking, Payment & Scheduling
A Starter Session is booked and paid for through a Stripe Payment Link. Stripe processes the payment; we receive your name, email address, company or billing details, and the payment status, but never your full card number. Legal basis: contract performance (Art. 6(1)(b) GDPR). After payment, you book a session slot through Cal.com, whose booking form asks five questions to prepare for the session. Invoices and billing records are kept as required by tax law (see Retention above).
10. Contract Withdrawals
If you withdraw from a contract through the form “Vertrag widerrufen” (atlasally.net/vertrag-widerrufen, English version atlasally.net/withdraw-contract), we process the name, contract details, email address and optional note you enter. We need them to handle your withdrawal and to send you the confirmation of receipt (Art. 6(1)(b) and (c) GDPR, § 356a BGB). Between the two steps your entries are held in a first-party cookie that is strictly necessary for the form, is not readable by scripts, and expires after 15 minutes or when you confirm. On confirmation we send one email to you, with a copy to us, through our provider Resend (section 5). The form stores nothing in a database.
We keep the confirmation of receipt and our copy for three years from the end of the year in which your withdrawal arrived (the limitation period, §§ 195 and 199 BGB), and longer only where tax law requires us to keep the related billing records (section 3). Resend keeps email data for 30 days. To protect the form from abuse we use a hidden field and a rate limit at our hosting provider, which sees your IP address (section 7).
11. Sessions: Video Calls & Recordings
Sessions run on Google Meet. You share your screen while working in your own accounts, and you type your own login credentials; we never store your passwords. A session is recorded only when everyone taking part agrees at the start. The recording is saved to Google Drive, shared with you, and deleted 90 days after the session. The one-page recap and 14 days of follow-up email questions are sent through the same mailbox. Legal basis: contract performance (Art. 6(1)(b) GDPR) for the session itself; recording rests on the agreement of everyone taking part (Art. 6(1)(a) GDPR).
12. Client Data You Give Us Access To
When our work touches personal data inside your own systems, for example on a screen share or as an invited member of your accounts, we act as a processor on your behalf under a data processing agreement (AVV, Art. 28 GDPR), signed before any personal data is touched. You remain the controller for that data, and the AVV, not this policy, governs how we process it.
13. Retention & Rights for Non-Account Users
If you contact us through the fit-check form, book a consulting session, or otherwise deal with us without creating a hosted-agent account, you have the same rights described in section 4. Since you have no dashboard, send requests to privacy@atlasally.net and we will respond within 30 days. Retention periods for this data are set out in the sections above.
14. International Data Transfers
Some of the providers listed in section 5 are based in, or may process data in, countries outside the EU/EEA, in particular the United States. Where that happens, transfers rely on an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework, for providers certified under it) or on the European Commission's Standard Contractual Clauses. You can request more information via privacy@atlasally.net.
15. Changes to This Policy
When we make material changes we will update the “Last updated” date and, if required by law, notify you by email or in-app. Continued use after the effective date constitutes acceptance of the revised policy.
16. Contact
Questions or requests: privacy@atlasally.net