Privacy Policy
DRAFT. Requires attorney review. Not legal advice. It describes the system as built on 2026-10-28. Update it whenever data flows change.
_Last updated: [date]_
Atlas Automation Group LLC ("we") operates the Atlas Automation Group AI agent service.
What we collect
- Account data: name, email address, a password hash (we never store the password itself), workspace name, and role.
- Content you provide: uploaded files, pasted text, and the agent outputs generated from them.
- Provider keys: stored encrypted (AES-256-GCM envelope encryption). They're shown back only as a short hint.
- Usage and billing records: runs, active time, charges, ledger entries, audit events, and IP address and user agent for sessions.
- Payment data: Stripe collects your card details directly. We receive a customer ID, payment status, and amounts, never card numbers.
- How you found us: if you arrive from a link with campaign tags (UTM parameters), we store those tags, the page you landed on, and the referring site's domain in a first-party cookie (
atlas_src, 30 days). If you sign up, they're saved with your workspace so we can tell which campaigns work. We don't use third-party advertising or analytics trackers.
How we use it
To provide the Service, meter and bill usage, prevent abuse and fraud, give support, send transactional emails, and (with an opt-out) send product emails. We don't sell personal data, and we don't use your content to train models.
Where your content goes
- To the AI provider you select for a run, under your account with that provider. That provider's terms and retention policies apply (see subprocessors.md).
- We don't send your content to another provider unless your workspace policy explicitly allows fallback to that provider.
- Customer content isn't sent to analytics tools.
Retention
- Files and outputs: according to the workspace retention setting (30 days by default).
- Ledger and billing records: kept as long as required for accounting [attorney/accountant to set the period].
- Audit logs: [period].
Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your data, and to object to processing. To exercise them, contact justinc128@gmail.com. [Attorney: add GDPR/UK and US state-law specifics, as applicable.]
Security
Encryption of provider keys at rest, hashed passwords and session tokens, role-based access, redaction of credentials from logs, and tenant isolation.
Contact
justinc128@gmail.com · [physical address]