Atom9 makes data use visible and controlled.

1.1 Account data

Atom9 processes name, email, login method, password credential metadata where used, OIDC identifiers, passkey records, sessions, verification status, device information, and security events.

1.2 Workspace data

Atom9 processes company profile, workspace settings, team access, roles, billing references, connected apps, notification settings, privacy choices, and admin actions.

1.3 Project data

Atom9 processes prompts, chat history, plans, tasks, cards, boards, generated pages, atoms, files, images, approvals, launch checks, activity history, and tool results as project data.

1.4 Network and contact data

Atom9 processes contacts, companies, relationships, notes, and communication context in the network area. Contacts do not become login users unless an invitation or account flow creates access.

1.5 Customer-app data

Customer apps can collect bookings, forms, onboarding answers, profile fields, service-specific KYC, documents, customer messages, payment references, and operational records required for the customer service.

1.6 Operational data

Atom9 processes logs, errors, audit records, abuse-prevention signals, email delivery events, security monitoring, performance data, support communications, and provider events as operational data.

2.1 Account and login

Atom9 authenticates users, verifies emails, manages sessions, links approved providers, prevents abuse, and routes people to the correct workspace or customer app. The legal basis is contract performance, legitimate interest in security, and legal obligation where applicable.

2.2 Workspace service

Atom9 provides projects, content, files, AI-assisted workflows, approvals, roles, support, and connected tools. The legal basis is contract performance for Atom9 customers and processor instructions where a customer controls the workspace data.

2.3 Customer apps

Customer apps collect the data required for the customer service. The customer defines the lawful basis for its own users, and Atom9 processes that data according to the customer configuration and applicable agreement.

2.4 Security and compliance

Atom9 detects suspicious activity, enforces permissions, preserves audit trails, handles legal requests, responds to incidents, and maintains records. The legal basis is legitimate interest, legal obligation, contract performance, and establishment or defence of legal claims where relevant.

2.5 Optional preferences and analytics

Atom9 stores optional preference and analytics choices only according to the consent or preference mechanism shown to the user, except where storage is strictly necessary or explicitly requested by the user.

3.1 AI project context

AI agents use prompts, selected files, prior decisions, project records, tool outputs, and workspace settings needed for the requested task.

3.2 Visible AI action

Material AI work is shown in chat, tasks, approval gates, project history, generated content records, or tool records where the product flow requires it.

3.3 Provider control

Workspace configuration controls which AI providers and models are used. Provider identity, model identity, tool use, prompt context, and relevant settings are tracked where needed.

3.4 Restricted prompt content

Users must not place secrets, passwords, payment card data, health data, financial records, special-category data, or confidential third-party material into AI prompts unless the workspace is configured for that processing and the user is allowed to provide it.

3.5 Risk escalation

Regulated sectors, special-category data, financial data, health data, child data, or high-impact decisions require stronger setup, review, and approval controls.

4.1 Workspace access

Workspace owners, admins, and permitted team members can see data according to their role, permissions, and project access.

4.2 Customer-app disclosure

When a user signs in to a customer app through Atom9, the app receives the account fields, claims, roles, and onboarding fields displayed or required for that flow.

4.3 Service providers

Infrastructure, email, search, file storage, AI model, observability, support, security, and payment providers process data only to provide the relevant service.

1. Providers receive only the data needed for the configured service purpose.
2. Providers are selected with attention to security, confidentiality, location, and transfer safeguards.
3. Provider access is documented where production customer agreements require sub-processor records.

4.4 Legal and safety disclosure

Atom9 may use, disclose, or preserve data when required for security, fraud prevention, legal requests, disputes, incident response, compliance, or platform integrity.

4.5 No hidden sale

Atom9 does not sell personal data as a hidden product feature. Advertising or marketing tracking requires clear disclosure and consent where required.

5.1 EU orientation

Atom9 designs the service for EU privacy and AI compliance. Where personal data is transferred outside the EU/EEA, Atom9 uses appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, transfer risk review, or equivalent lawful mechanisms.

5.2 Retention

Atom9 keeps personal data for as long as needed for accounts, workspaces, customer apps, security, audit trails, billing, support, legal obligations, dispute handling, and backup recovery.

5.3 Deletion and anonymisation

Atom9 deletes or anonymises data when the purpose ends and retention is no longer required. Some records remain for security, accounting, compliance, legal claims, or backup ageing.

5.4 Backups

Deleted data can remain in encrypted or access-limited backups for a limited recovery period before it ages out according to backup lifecycle rules.

6.1 Available rights

Rights can include access, correction, deletion, restriction, objection, portability, consent withdrawal, complaint handling, and information about automated processing.

6.2 Account requests

Atom9 handles requests about Atom9 account data through Atom9 account, privacy, support, or security channels.

6.3 Customer-controlled data

If a customer controls the data, Atom9 helps the customer respond according to the data processing agreement and the configured product flow.

6.4 Identity verification

Atom9 verifies requester identity and authority before disclosing, exporting, correcting, or deleting personal data where verification is required.

7.1 Access control

Atom9 uses authentication, session controls, role boundaries, service authentication, and permission checks to limit access.

7.2 Auditability

Atom9 records important account, workspace, project, AI, approval, and operational events as an audit trail so decisions can be explained later.

7.3 Incident response

Atom9 investigates security events, contains impact, preserves evidence, and notifies affected customers, users, or authorities where required.

7.4 Confidentiality, integrity, and availability

Atom9 limits personnel and provider access, validates important changes, preserves audit trails, uses backups, monitors operation, and applies infrastructure controls to maintain service availability.