Privacy Policy

1. Information We Collect

(a) Contact and waitlist information — our contact form asks for your name, your email address, and your message; our waitlist form asks for your email address.

(b) Security data — the internet address a form was sent from, kept for no more than a day to guard against spam, then deleted.

(c) Communications — the messages and feedback you send to us through the contact form.

(d) Cookies and similar technologies — see Section 6.

We do not knowingly collect special categories of personal data under GDPR (e.g., health, biometric, genetic, racial, religious, political, sexual-orientation data) or HIPAA-regulated health information. Do not submit such data to the Service.

2. How We Use Information

We use personal information to:

• reply to the messages you send us through the contact form;
• prevent spam, fraud, and abuse, and enforce our terms;
• tell you when there is something to try, if you joined the waitlist; and
• comply with legal obligations and respond to lawful requests.

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising.

3. Legal Bases (GDPR / UK GDPR)

For individuals in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing are:

• Contract — processing necessary to perform our agreement with you or to take steps at your request before entering into an agreement (replying to your message, adding you to the waitlist).
• Legitimate interests — securing the Service and preventing spam and fraud, where our interests are not overridden by your fundamental rights.
• Legal obligation — complying with applicable law (e.g., tax, anti-money-laundering, lawful requests).
• Consent — for telling you when there is something to try (the waitlist), and any other processing where consent is required. You may withdraw consent at any time without affecting prior processing.

4. How We Share Information; Sub-processors

We share personal information with the categories of recipients below.

(a) Service providers (sub-processors) that perform services on our behalf, under contracts that restrict their use of personal information. Major categories: cloud hosting and storage.

(b) Professional advisors — attorneys, accountants, auditors, and bankers, under confidentiality obligations.

(c) Legal and safety — to comply with applicable law, respond to lawful requests (subpoena, court order), protect our rights and the rights of others, and prevent fraud or harm. Where permitted, we will notify you of legal requests for your data.

(d) Business transfers — in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case the acquiring or successor party will be bound by this Privacy Policy or a successor policy with materially comparable protections.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete your personal information (subject to legal retention obligations);
• Restrict or object to certain processing;
• Receive a portable copy of your personal information;
• Withdraw consent at any time where processing is based on consent;
• Opt out of "sale" / "share" / targeted advertising under U.S. state privacy laws (we do not sell or share for behavioral advertising, but you may exercise this right at any time);
• Lodge a complaint with a supervisory authority.

Response timelines. We will verify your identity and respond to access, correction, deletion, restriction, and portability requests within the period required by applicable law: within 45 calendar days as required by the CCPA (extendable by an additional 45 calendar days where reasonably necessary, with notice), and within one month under the GDPR (extendable by up to two further months for complex or numerous requests, with notice). We will not discriminate against you for exercising your rights.

Authorized agents. Authorized agents may submit requests on your behalf with appropriate authorization. We may verify the agent's authority before responding.

To exercise any right, email operations@atomically.ai or send us a message through the contact form.

6. Cookies and Similar Technologies

This site sets no cookies and does not use analytics.

7. Data Retention

We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Typical retention:

• Contact messages: 12 months after you last wrote to us, then deleted.
• Waitlist email addresses: until you ask us to remove yours.
• Spam-guard trace (the internet address a form was sent from): no more than one day, then deleted.

8. Security

We implement reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit and encryption at rest. No system is perfectly secure; we cannot guarantee absolute security.

If we confirm a security incident affecting your personal information, we will notify you and applicable authorities without undue delay and in any event within 72 hours of confirmation, as required by GDPR Article 33 and applicable U.S. state laws.

Security-issue reports may be sent to operations@atomically.ai.

9. International Transfers

Atomically is based in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the United States. For transfers from the EEA, UK, or Switzerland, we rely on the Standard Contractual Clauses (EU 2021/914, including the UK Addendum and Swiss adaptation) or another lawful transfer mechanism. Contact operations@atomically.ai to request a copy of our standard transfer documentation.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact operations@atomically.ai and we will delete it.

11. Email Practices; CAN-SPAM and CASL Compliance

We send two categories of email:

• Transactional (e.g., a reply to your message) — sent regardless of marketing preference, because they relate to your account or the Service.
• Marketing / digest (e.g., a note that there is something to try) — sent only to opted-in users; each contains a clear unsubscribe link and unsubscribe is honored within ten (10) business days. We comply with CAN-SPAM (15 U.S.C. § 7704), Canada's CASL, and the marketing-consent requirements of GDPR.

You may manage email preferences by emailing operations@atomically.ai.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy at https://www.atomically.ai/privacy with a revised Effective Date and, for material changes, provide notice through the Service or by email. Continued use of the Service after an update constitutes acceptance.

13. State-Specific Disclosures (U.S.)

California (CCPA / CPRA). California residents have the rights described in Section 5. In the past 12 months we have collected the categories of personal information described in Section 1 for the purposes described in Section 2. We do not sell personal information for monetary consideration. We do not share personal information for cross-context behavioral advertising. We do retain certain categories of personal information for longer than 12 months as described in Section 7. To exercise rights, email operations@atomically.ai.

Colorado, Connecticut, Utah, Virginia, and similar state laws. Residents have rights of access, correction, deletion, portability, and to opt out of targeted advertising, "sale," and certain profiling that produces legal or similarly significant effects. Exercise rights at operations@atomically.ai. We conduct data protection assessments where required by applicable state law.

Nevada. Nevada residents may opt out of any sale of covered information; we do not sell.

14. Contact

General: operations@atomically.ai