Privacy Policy

Status: Founder approved. Version: 1.0 Effective date: September 14, 2026.

ATLASENT PRIVACY POLICY

Last updated: September 14, 2026.

This Privacy Policy describes how AtlaSent Systems, Inc. ("AtlaSent," "we," "us") collects, uses, and shares Personal Data when you visit our websites, use our Service, communicate with us, or otherwise interact with us.

1. Two roles, two scopes

We play two different roles depending on context:

1. About you (Controller role). This Privacy Policy covers Personal Data we collect from website visitors, prospects, applicants, account holders, and people who communicate with us. We decide the purposes and means of processing this data, so we are the "Controller" under GDPR (or "Business" under CCPA).

2. Data customers submit through the Service (Processor role). When a Customer submits Personal Data to the AtlaSent Service (e.g., via POST /v1-evaluate), AtlaSent processes that data on the Customer's instructions. We are a "Processor" (or "Service Provider" under CCPA) for that data. Our handling is governed by the Data Processing Agreement (DPA) at https://atlasent.io/legal/dpa, not by this Privacy Policy. If you are an end-user whose Personal Data was submitted to the Service by a Customer, please contact the Customer first about your rights; they are the Controller of that data.

The rest of this Privacy Policy applies to the Controller role unless otherwise stated.

2. Personal Data we collect

2.1 Information you provide

• Account information when you sign up: name, email, organization name, password (hashed).
• Profile and configuration information you enter into the Console (organization details, billing contact).
• Communications when you email us, fill in a contact form, schedule a demo, or chat with us: name, email, phone, the content of your message.
• Payment information when you purchase a paid plan: billing contact, billing address, tax ID, last four digits of payment instrument, and transaction history. Full payment card numbers are entered directly into our payment processor (Stripe) and never touch AtlaSent systems.
• Applicant information if you apply for a job with us.

2.2 Information collected automatically

When you visit our websites or use the Console, we collect:

• Device and connection information: IP address, browser type and version, operating system, device identifiers, time zone, language.
• Usage information: pages visited, features used, time spent, referring URL, search terms.
• Cookies and similar technologies: see §8 below.

We use Plausible Analytics, a privacy-focused, cookie-less analytics tool, for docs.atlasent.io. Other AtlaSent surfaces may use additional analytics, listed in our cookie disclosures.

2.3 Information from third parties

• SSO providers (when you sign in with SSO): identifiers, name, and email released by the provider.
• Sales-intelligence providers. AtlaSent does not currently purchase Personal Data from third-party sales-intelligence or data-enrichment providers. If that changes, this policy will identify the relevant providers before use.

3. How we use Personal Data

We use Personal Data to:

• provide, maintain, and secure the Service and our websites;
• authenticate you and authorize your access;
• process payments and manage subscriptions;
• communicate with you about the Service, including security and service announcements, and (with your consent or as permitted by law) marketing communications;
• respond to inquiries and provide support;
• comply with legal obligations, enforce our Terms, and protect our rights and the rights of others;
• detect, prevent, and respond to security incidents and abuse;
• improve and develop our Service, including by analyzing Service Data (as defined in our MSA / Terms); and
• recruit and evaluate job applicants.

We do not use Customer Personal Data (Personal Data submitted to the Service by Customers) to train any general-purpose machine-learning or large-language model.

4. Legal bases (EEA / UK / Switzerland)

If you are in the EEA, UK, or Switzerland, our legal bases for processing your Personal Data are:

• Contract. Processing necessary to provide the Service to you or to your organization (Art. 6(1)(b) GDPR).
• Legitimate interests. Processing necessary for our legitimate interests, including operating and securing the Service, responding to inquiries, sending non-marketing communications about your account, and detecting fraud (Art. 6(1)(f) GDPR). We balance our interests against your rights and freedoms.
• Legal obligation. Processing necessary to comply with our legal obligations, including tax, accounting, and lawful requests from authorities (Art. 6(1)(c) GDPR).
• Consent. Where required, processing based on your consent, which you may withdraw at any time (Art. 6(1)(a) GDPR). Withdrawal does not affect the lawfulness of processing before withdrawal.

5. How we share Personal Data

We share Personal Data with:

• Service providers (sub-processors) who help us operate the Service. Our current sub-processors are listed at https://trust.atlasent.io/subprocessors. We require each sub-processor to protect Personal Data under appropriate contractual obligations.
• Professional advisors (accountants, auditors, lawyers, insurers) under appropriate confidentiality obligations.
• Successors in interest in connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets, subject to a successor's commitment to honor this Privacy Policy.
• Government and law enforcement where required by law, subject to our policy of resisting overbroad demands and notifying you to the extent legally permitted.
• Other parties with your consent or at your direction.

AtlaSent does not, and has not in the preceding 12 months, sold or shared (as those terms are defined in the CCPA) Personal Information. See §10 for California rights.

6. International transfers

AtlaSent is based in the United States. Where we transfer Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on:

(a) the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "EU SCCs"), incorporating the modules and clause selections set out in our DPA; (b) the International Data Transfer Addendum to the EU SCCs issued under section 119A of the UK Data Protection Act 2018 (the "UK IDTA") for transfers subject to the UK GDPR; and (c) the Swiss equivalent mechanism recognized by the Swiss Federal Data Protection and Information Commissioner for transfers subject to the Swiss FADP.

AtlaSent has conducted, and on a documented cadence reviews, a transfer impact assessment that considers the legal regime of the destination country and the supplementary technical, organizational, and contractual measures applied. You may obtain a copy of the safeguards relied upon and a summary of the most recent transfer impact assessment by emailing privacy@atlasent.io. For a list of where Personal Data is processed, see our sub-processor list at https://trust.atlasent.io/subprocessors.

6A. EU-US Data Privacy Framework

AtlaSent is not currently certified under the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, or the Swiss-US Data Privacy Framework. AtlaSent relies on the SCCs and UK IDTA described in §6 for international transfers.

7. Retention

We retain Personal Data in accordance with the schedule below. When Personal Data is no longer needed, we delete or anonymize it, or if deletion is not feasible (e.g., embedded in tamper-evident audit records), we restrict further processing.

For Customer Personal Data processed in our Processor role, retention is governed by the DPA.

8. Cookies and similar technologies

We use first-party and third-party cookies and similar technologies to:

• operate the Service (e.g., session cookies that keep you logged in);
• remember your preferences;
• measure usage and improve the Service.

Where required, we obtain your consent before placing non-essential cookies. You can manage cookie preferences through your browser or our cookie banner where shown.

Global Privacy Control. AtlaSent honors the Global Privacy Control (GPC) browser signal as an opt-out of "sale" or "sharing" under the CCPA, where applicable. AtlaSent does not engage in "sale" or "sharing" of Personal Information in the ordinary course (see §5), and will treat receipt of a GPC signal as an additional confirmation of opt-out for any contested or future processing.

9. Your rights (EEA / UK / Switzerland)

Subject to applicable law, you have the right to:

• Access your Personal Data.
• Rectify inaccurate or incomplete Personal Data.
• Erase Personal Data where the legal basis no longer applies.
• Restrict processing under certain conditions.
• Object to processing based on legitimate interests.
• Data portability: receive Personal Data you provided in a structured, commonly-used, machine-readable format.
• Withdraw consent at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email privacy@atlasent.io. We may need to verify your identity. We will respond within thirty (30) days (or as required by applicable law).

If you are an end-user whose Personal Data was submitted to the Service by a Customer (our Processor role), contact the Customer first; they are the Controller.

10. California rights (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know. Request the categories and specific pieces of Personal Information we have collected about you, the sources, purposes, and recipients.
• Delete Personal Information we have collected from you, subject to legal exceptions.
• Correct inaccurate Personal Information.
• Opt out of "sale" or "sharing." AtlaSent does not, and has not in the preceding 12 months, sold or shared (as those terms are defined in the CCPA) Personal Information.
• Limit use of sensitive personal information. AtlaSent does not use sensitive personal information for purposes beyond what is necessary to provide the Service.
• Non-discrimination. AtlaSent will not discriminate against you for exercising your rights.

10.1 Notice at Collection (Cal. Civ. Code §1798.100)

AtlaSent does not collect Sensitive Personal Information beyond account credentials. AtlaSent does not use Sensitive Personal Information for purposes beyond those permitted by Cal. Civ. Code §1798.121(a).

To exercise these rights, email privacy@atlasent.io. We will respond within forty-five (45) days (or as required by law). You may also designate an authorized agent.

11. Security

We use technical and organizational measures to protect Personal Data, including TLS encryption in transit, AES-256 encryption at rest, access controls, logging, and personnel training. No system is perfectly secure; if you believe your account or Personal Data has been compromised, contact security@atlasent.io.

12. Children

Under 13 (US — COPPA). The Service is not directed to children under 13. We do not knowingly collect Personal Data from children under 13. If we learn that we have collected Personal Data from a child under 13 without verifiable parental consent, we will delete it.

Under 16 (EU — GDPR Art. 8). The Service is not directed to children under 16 (or, in any EU Member State that has lowered the GDPR Art. 8 age to between 13 and 16, the age set by that Member State). We do not knowingly collect Personal Data from such children without parental authorization.

13. Automated decision-making

The AtlaSent Service makes automated authorization decisions based on Customer-defined policies. As to Customer Personal Data, the Customer (not AtlaSent) is the Controller of that decision-making.

AtlaSent does not make solely-automated decisions about visitors or account holders that produce legal or similarly significant effects on them within the meaning of Article 22 of the EU GDPR or analogous provisions of applicable Data Protection Laws.

14. Changes

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email, in-product notice, or a prominent notice on our website at least thirty (30) days before the change takes effect.

15. Contact

For questions about this Privacy Policy or our handling of your Personal Data, contact:

• Email: privacy@atlasent.io
• Postal: AtlaSent Systems, Inc., 525 Market Street, Suite 2900, San Francisco, CA 94105.

EU / UK representative. AtlaSent does not, at this time, target the Service to data subjects in the European Union or United Kingdom in a manner that triggers Article 27 GDPR / UK GDPR. AtlaSent monitors its targeting activity and will appoint a representative promptly if Article 27 thresholds are met.

Data Protection Officer. AtlaSent is not currently required to appoint a DPO under GDPR Art. 37. AtlaSent will review this position on an annual cadence and on material changes in processing.

Changelog