Privacy Policy
Effective date: 2026-10-16 · Version 1.0
This Privacy Policy explains how Atlasia SAS ("Atlasia", "we", "us") handles personal data when you use the Atlasia platform at https://ai.atlasia.us and related services (the "Service"). It is written to meet the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).
Who we are
Atlasia SAS, a société par actions simplifiée (SAS) registered in France under number [STUB: SIREN / company number], with its registered office at [STUB: registered street address], Narbonne, France, is responsible for the personal data described below where we act as controller. You can reach us about privacy at privacy@atlasia.us.
Our two roles
Atlasia handles personal data in two different capacities, and your rights differ accordingly:
- As a controller, for the data we decide to process ourselves: account and profile data, authentication logs, billing data, support correspondence, and website usage. This Policy governs that processing.
- As a processor, for the compliance content our customers upload and manage inside their ESG passports (supplier and manufacturer organisation data and documents). Here the customer organisation is the controller and decides the purposes; we process it only on their instructions under a Data Processing Agreement (see our DPA). If your data sits inside a customer's passport, direct your requests to that organisation; we will assist them as their processor.
What we collect and why
| Data | Examples | Why (legal basis) |
|---|---|---|
| Account & profile | Name, business email, job title, organisation, language, password (hashed) | To create and run your account — performance of our contract (Art. 6(1)(b)) |
| Organisation & role | Which organisations you belong to, your role, invitation records | To run multi-tenant access and permissions — contract (Art. 6(1)(b)) |
| Authentication & security logs | Login times, IP address, device/browser, security events | To keep accounts secure and prevent abuse — legitimate interests (Art. 6(1)(f)) |
| Usage data | Pages visited, features used, actions taken | To operate, support and improve the Service — legitimate interests (Art. 6(1)(f)) |
| Billing | Company billing details, subscription and payment records | To bill and meet accounting obligations — contract and legal obligation (Art. 6(1)(b),(c)) |
| Support | Messages you send us, their contents | To answer you — legitimate interests / contract |
| Compliance content (as processor) | Supplier/manufacturer details and uploaded documents, which may name individuals (e.g. certificate signatories, contacts) | Processed on the customer's instructions — the customer's legal basis, under our DPA |
We do not use personal data for advertising and we do not sell it.
How long we keep it
We keep account data for as long as your account is active and then delete or anonymise it within 90 days of account closure, except where law requires us to keep records longer (e.g. accounting records, typically up to 10 years in France). Security logs are kept for 12 months. Compliance content we hold as a processor is retained and deleted according to the customer's instructions and the DPA.
Who we share it with
We share personal data only with service providers who process it on our behalf under contract (our "sub-processors" — see the DPA for the current list, which includes our cloud host, transactional email provider and AI document-analysis providers), with professional advisers, and with authorities where legally required. Each provider is bound to use the data only to provide their service to us.
International transfers
We host the Service in the EU. Some sub-processors (for example certain AI and email providers) are based outside the EEA; where that is the case, transfers are protected by the European Commission's Standard Contractual Clauses and additional safeguards. Details and a copy of the safeguards are available at privacy@atlasia.us.
Your rights
Under the GDPR you may ask us to access, correct, delete, or port your data, to restrict or object to processing, and to withdraw any consent. Where we act as processor, we will pass your request to the relevant customer organisation. To exercise your rights, contact privacy@atlasia.us; we respond within one month. You may also complain to the French supervisory authority, the CNIL (www.cnil.fr), or your local authority.
Security and cookies
We apply technical and organisational measures to protect personal data, including encryption in transit, access controls, private document storage and audit logging. Our use of cookies is described in our Cookie Policy.
Changes
We may update this Policy; we will post the new version here and update the effective date, and notify you of material changes.