The short version
We collect what we need to run your account and your licensing, and nothing for advertising. Keys, passwords, and tokens are stored only as one-way hashes. For your End Users' data we act on your instructions as your processor. We don't sell data, and you can ask us to export or delete yours at any time.
1.Who we are
Atlas is a licensing platform for software companies, operated by Atlas Infra (United Kingdom). This policy explains what personal data we handle, why, and the choices you have.
Questions or requests: privacy@atlasinfra.cloud.
2.Our two roles
We handle personal data in two different capacities:
- As a controller for data about our own customers and visitors: people who sign up, sign in, belong to an organization, contact us, or browse our website. We decide how that data is used, and this policy governs it.
- As a processor for data our customers put into Atlas about their own End Users, such as the email address attached to a license or a device that activated one. Our customer (the software vendor) is the controller and decides how it is used. We process it only on their instructions and to provide the Service.
If you are an End User of software that uses Atlas, please contact that software's vendor about your data. We will help them respond to your request.
3.Data we collect
Data you give us
- Account data: name, email address, password (stored only as a one-way hash), and organization name.
- Sign-in with Google or GitHub: if you choose it, we receive your name, email address, and account identifier from that provider. We never receive your password for those services.
- Team data: invitations you send, roles, and organization settings.
- Billing data: plan, billing email, and payment history. Card details are handled by our payment processor and never stored by us.
- Communications: messages you send to support or sales.
Data created when you use the Service
- Security data: sign-in times, active sessions, the browser user agent, two-factor authentication status, and a hashed form of your IP address.
- Audit records: who changed what in your organization, and when.
- Operational logs: request identifiers, timestamps, and error details used to keep the Service reliable and secure.
Data our customers store about their End Users (as processor)
- Customer records: email address, name, and the vendor's own customer ID, if the vendor provides them.
- Licenses: status, dates, entitlements, and any metadata the vendor adds.
- Devices: the device identifier and name the vendor's app sends, platform, app version, a hashed device fingerprint, a hashed IP address, and when the device was last seen.
- Storefront orders: the buyer email and order identifiers received from a connected storefront such as SellAuth or Komerza.
4.How we use data and our legal bases
Under UK and EU data protection law we must have a legal basis for each use of personal data. For data we control:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, organizations, and team access | Performance of our contract with you |
| Providing licensing, activation, webhooks, and storefront delivery | Performance of our contract with you |
| Securing the Service: authentication, two-factor, session management, abuse and fraud prevention, audit logs | Our legitimate interest in keeping accounts and the platform secure |
| Service emails: verification, password resets, invitations, security alerts, changes to the Service or terms | Performance of contract, and our legitimate interests |
| Billing, invoicing, tax, and accounting records | Legal obligation, and contract |
| Understanding aggregate usage to improve performance and features | Our legitimate interest in improving the Service |
| Product news and marketing emails | Your consent, which you can withdraw at any time |
| Responding to legal requests and enforcing our terms | Legal obligation, and legitimate interests |
We do not sell personal data, we do not use it for advertising, and we do not use your or your End Users' data to train machine-learning models. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects.
7.International transfers
Some of our providers may process data outside the UK or European Economic Area. When that happens we rely on an adequacy decision, or we put in place safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, together with any additional measures needed. You can ask us for details.
8.How long we keep data
| Data | Retention |
|---|---|
| Account and organization data | While your account is active. Deleted within 30 days of account or organization closure. |
| Customer Data (licenses, customers, devices) | Until the customer deletes it or closes the organization, then deleted within 30 days. |
| Sessions | Until sign-out or expiry (at most 30 days). |
| Audit records | For the life of the organization, so owners can review changes. |
| Operational and security logs | Up to 90 days, unless needed to investigate an incident. |
| Billing and tax records | As long as the law requires, typically 6 years. |
| Backups | Deleted data may remain in encrypted backups for up to 35 days. |
9.How we protect data
- All traffic is encrypted in transit with TLS.
- Passwords, license keys, secret API keys, and session tokens are stored only as one-way hashes. Signing secrets and two-factor secrets are encrypted at rest.
- Each organization's data is isolated from every other organization's at the database level.
- Staff access is restricted, requires a recorded reason, and is logged in the affected organization's audit log.
- Two-factor authentication is available to every user and can be required by owners.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires.
10.Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent at any time. Residents of California and some other US states have similar rights to know about, delete, and correct their data, and we do not sell or share personal data as those laws define it.
Some of these you can do yourself, such as updating your name on your account page or removing records from the dashboard. For anything else, including a copy of your data or deleting your account, email privacy@atlasinfra.cloud. We will respond within one month, and may need to verify your identity first. Exercising your rights is free.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to a data protection authority. In the UK that is the Information Commissioner's Office (ICO); in the EU, the authority in your country.
11.Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12.Changes to this policy
We will update this policy when our practices change. If a change is material, we will tell you by email or in the dashboard before it takes effect. The “Last updated” date at the top shows the latest version. See also our Terms of Service.
13.Contact
Atlas Infra, United Kingdom. Email privacy@atlasinfra.cloud for any privacy question or request.