Privacy Policy
Last updated: 2026-07-25
This Privacy Policy explains how Atlas Ally (“we”, “us”, or “our”) collects, uses, and protects information about you when you use our service. By signing up, you agree to this policy.
The controller responsible for data processing under the GDPR is André Faria (sole proprietor), Schillerpromenade 10, 12045 Berlin, Germany — see the Imprint. Contact: privacy@atlasally.net.
1. What Data We Collect
- Account & email: your name, email address, and password hash (stored by Supabase Auth).
- Chat messages: messages you send to your agent through the dashboard chat or connected channels (Telegram, WhatsApp, Slack, email). Stored to power the conversation history and context window.
- Agent memory & profile:facts and preferences your agent learns about you over time (stored on your dedicated server and optionally synced to the platform dashboard). You can opt out of platform sync in Settings. If you use the “Learn my voice” feature, we also derive a writing-style profile from a bounded sample of your sent email; this profile is generated and stored only on your dedicated server, never synced to the platform.
- Connected-account tokens: OAuth tokens for external services you connect (e.g. Google, Slack, Notion) are held securely by Composio on our behalf. We do not store raw tokens ourselves.
- Usage & billing: subscription tier, payment method details (held by Stripe — we store only the Stripe customer/subscription ID), and LLM token usage figures.
- IP address: collected transiently for rate-limiting and abuse prevention. Not stored persistently in application logs.
- Consent record: the version of this policy you accepted and the timestamp of acceptance (GDPR Art. 7 demonstrable consent).
- Email communications: we may send you account, legal, and (when applicable) product emails via our email provider, Resend. Legal/account emails (e.g. billing, security notices) are sent regardless of preference; you can opt out of non-essential product emails at any time from the Settings page or via the unsubscribe link included in every such email.
2. Why We Collect It & Legal Basis
- Contract performance (Art. 6(1)(b) GDPR): account data, chat messages, agent memory, and usage data are necessary to provide the service you signed up for.
- Legal obligation (Art. 6(1)(c) GDPR): billing and consent records must be retained to comply with applicable law.
- Legitimate interest (Art. 6(1)(f) GDPR): IP-based rate-limiting to protect the platform from abuse.
3. Retention
Account and profile data is retained while your account is active. After account deletion, data is purged within 30 days except where we are required by law to retain it (e.g. billing records, which are kept for 7 years). Anonymised aggregate usage statistics may be retained indefinitely.
4. Your Rights (GDPR)
If you are in the EEA, UK, or Switzerland, you have the right to access, correct, port, or erase your data, and to object to or restrict processing. You can exercise most of these rights directly from the Settings page (data export, memory opt-out, email preferences, account deletion). For requests we cannot fulfil in self-service, contact us at privacy@atlasally.net. We will respond within 30 days.
5. Sub-Processor List
We share data with the following sub-processors to operate the service:
| Sub-processor | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage (PostgreSQL + Auth) |
| OpenRouter + downstream LLM providers | LLM inference for agent responses and memory summarisation. Your chat messages are sent to the model provider selected for your agent. |
| Composio | Secure storage and execution of OAuth tokens for external integrations (Google, Slack, Notion, etc.) |
| Stripe | Payment processing and subscription management. We share your email and billing details with Stripe. |
| Hetzner | VPS hosting for your dedicated agent server. Your agent data resides on a Hetzner server in the EU. |
| Telegram / WhatsApp (Meta) / Slack | Messaging delivery when you connect these channels. Your messages transit their infrastructure. |
| Linear | In-product feedback submission (when you use the feedback feature). |
| Cloudflare | DNS resolution and DDoS protection. Cloudflare sees your IP address. |
| Resend | Outbound email delivery for account, legal, and (when applicable) product emails. You can opt out of non-essential emails in Settings. |
| Notion | When you connect Notion as an integration, we access your Notion data on your behalf via Composio. |
6. Cookies & Local Storage
We use a Supabase session cookie (HttpOnly, Secure) for authentication. We do not use third-party advertising cookies or tracking pixels.
7. Changes to This Policy
When we make material changes we will update the “Last updated” date and, if required by law, notify you by email or in-app. Continued use after the effective date constitutes acceptance of the revised policy.
8. Contact
Questions or requests: privacy@atlasally.net