Privacy Policy

Who we are

Atlas Tools is operated by Atlas Studios (“we”, “us”), a UK web design and software studio. For questions about this policy or your data, contact us at hello@atlasstudios.co.uk.

Atlas Tools provides website tools (chatbots, review collection, lead capture, content publishing and similar) to small businesses (“customers”), which run on those customers' own websites and are used by their visitors (“end users”).

Two roles: controller and processor

For our customers (people with an Atlas Tools account), we act as a data controller. We collect your email address to operate your account, your business details (name, website, industry, location) to configure your tools, and billing information processed by Stripe.

For end users of our customers' websites, we act as a data processor on the customer's behalf. Depending on which tools a customer has enabled, this may include: messages sent to a website chatbot, names, email addresses and phone numbers submitted through contact or booking forms, newsletter sign-ups, blog comments, review responses and private feedback, and SMS conversations with the customer's business number. The customer is the controller of this data; requests about it should be directed to the business whose website you used, and we will assist them in responding.

What we collect and why

• Account data — email address, session cookies. Used to sign you in (we use passwordless magic links) and keep your account secure. Legal basis: contract.
• Business configuration — site name, domain, industry, location, connected service credentials (stored encrypted). Used to run the tools you enable. Legal basis: contract.
• End-user submissions — chat messages, form submissions, subscriptions, comments, SMS threads. Processed on your instructions to deliver the enabled tools. Legal basis: our contract with the customer; the customer is responsible for their own lawful basis.
• Usage and billing data — which tools are enabled, AI usage metering, payment records via Stripe. Legal basis: contract and legitimate interest in operating and billing the service.

We do not sell personal data, and we do not use end-user data to train AI models.

Cookies

The Atlas Tools dashboard uses a single strictly-necessary session cookie (atlas_session) to keep you signed in. Our marketing site does not use advertising or cross-site tracking cookies. The embed script we provide to customers does not set tracking cookies on their visitors.

Who processes data for us

We use a small number of subprocessors to run the service:

• Vercel — application hosting
• Supabase — database hosting
• Anthropic — AI text generation for enabled AI tools
• Resend — transactional email delivery
• Stripe — payment processing (we never see full card details)
• Twilio — SMS delivery, where SMS tools are enabled
• Google — PageSpeed, Places and Business Profile APIs, where those tools are enabled

Some subprocessors are based outside the UK. Where data leaves the UK, transfers rely on appropriate safeguards such as the UK International Data Transfer Agreement or adequacy regulations.

Retention

Account and configuration data is kept while your account is active and deleted on request after closure. End-user data (chats, leads, subscribers, comments, SMS threads) is retained while the relevant tool is active so the customer can use it, and deleted when the customer deletes it or closes their account. Billing records are kept as required by UK tax law (typically six years).

Your rights

Under UK GDPR you can request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. Email hello@atlasstudios.co.ukand we'll respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Security

Data is encrypted in transit (TLS) and at rest. Stored third-party credentials are additionally encrypted at the application level. Access to production data is restricted to those who need it to operate the service. If a breach affecting your data occurs, we will notify you and the ICO where required.

Changes

We'll post any changes to this policy on this page and update the date above. Material changes will be announced by email to account holders.