Loading
Loading
Last Updated: June 29, 2026
This Privacy Policy explains how Atlaso Labs Inc. ("Atlaso", "we", "us", "our") collects, uses, shares, and protects personal data when you use the Atlaso memory layer — our dashboard, brain/API, Connectors, and CLI (together, the "Service"). In plain English: when you sign up we hold your account details with our authentication provider; when you connect a tool, the Memories you create or that our Connectors capture are stored on Atlaso's servers so they can sync across your sessions and devices, with a copy also kept on your own machine; we use specialist sub-processors (listed below) to run the Service; on our marketing website only we run one advertising-measurement pixel (Reddit), which never loads for visitors in the EU/EEA/UK/Switzerland or for anyone whose browser sends a Global Privacy Control signal, and we record which campaign brought you so we can measure our ads (Section 4); we do not sell your personal data, we do not operate a training endpoint, and we do not train any AI models on your Memory (on paid features your Memory is sent to our language-model provider only to generate your results); and you have rights to access, correct, and delete your data. Please read the full policy for the details, including the important explanation of where your Memories actually live.
Data controller: Atlaso Labs Inc., a Delaware C-Corporation.
Postal address: 131 Continental Dr, Suite 305, Newark, DE 19713, United States
Contact (all enquiries — privacy and data-rights requests, general and legal notices, support and billing): support@atlaso.ai
EU / UK data subjects: You can direct any question or request about your personal data to support@atlaso.ai.
India (Digital Personal Data Protection Act, 2023): You can raise any privacy question or grievance with us at support@atlaso.ai.
If you have questions about this policy or how we handle your personal data, contact us at support@atlaso.ai.
This policy applies to personal data we process about:
It does not cover third-party websites, tools, or AI models you choose to use alongside Atlaso, which are governed by their own privacy policies.
We want to be precise about where your data lives, because it matters.
When you connect a tool, your Memories are stored on Atlaso's servers so they can sync across your sessions and devices. A local copy is also kept on your machine. Your Memory is only purely local in these situations:
On the Free tier, your single active tool is cloud-linked, so its Memory syncs to and persists on Atlaso's servers as normal operation. Memory persists on our servers regardless of whether you are on Free or Pro. The only features reserved for Pro are the AI-powered ones described in Section 7 (Ambient Memory, automatic enrichment, and "Ask your memory").
In short: Atlaso is cloud-synced memory with a local mirror, not a purely local-only product. We have written this policy to reflect that accurately.
| Category | What it includes | When collected | Where it is stored |
|---|---|---|---|
| Account data | Email address and a user id | At signup | Clerk |
| Profile data | First and last name | After signup, if you add them | Clerk |
| Authentication credentials | Passkeys (optional) | If you enable passkey login | Clerk |
| Plan & billing identifiers | Your plan (free/paid) and your Stripe customer id | When you subscribe | Clerk metadata and Neon (user_plan) |
| Device data | A server-minted device_id, a user-chosen device label, and a last_seen timestamp | When you run atlaso connect | Neon (device_registry). We do not perform any hardware fingerprinting. |
| Local auth file | { server, token, user_id, device_id } | On connect | On your own machine, at ~/.atlaso/auth.json |
| Payment data | Card details, billing address, and subscription state | At checkout | Stripe only — card data never touches Atlaso systems |
| Memory / Content | Facts, decisions, preferences, gotchas, and auto-captured conversation snippets (your text plus a truncated assistant reply); may contain code or project facts | When you deposit a Memory or a Connector captures one | Server-side per-user database (the canonical copy), a local ~/.atlaso/cache.db mirror, and transiently in the Neon enrichment queue (cleared after processing) |
| Usage data | Content-free activity counters used to measure daily/monthly active usage | On activity | Neon (usage_event, daily_active). These never contain prompt or code content. |
| IP address | Your network IP | Per request | Used only in memory for rate-limiting — not stored in our application database. IPs are inevitably present in the operational logs of our infrastructure providers (Render, Vercel, Neon, Clerk, Stripe). |
| Campaign attribution data | The campaign parameters in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_content, utm_term), an advertising click identifier if the link carried one (for example Reddit's rdt_cid), the referring website, the landing page, and a first-touch timestamp | When you arrive at atlaso.ai from a tagged link, an ad, or another website — a direct visit collects nothing — and again at signup if you create an Account | The atl_attr first-party cookie in your browser (90 days), and, if you sign up, one row against your user id in Neon (user_attribution) |
| Coarse region classification | A single value — eu (EU/EEA/UK/Switzerland) or row (rest of world) — derived from country-level IP geolocation at our hosting edge | On your first request to atlaso.ai | The atl_geo first-party cookie in your browser (180 days). No precise location and no IP address is stored. Used only to decide whether an advertising pixel may load. |
We buy ads (currently on Reddit) and need to know which of them work. Two things follow from that. Both are set up on our marketing website at atlaso.ai; no advertising pixel of any kind runs on the dashboard at app.atlaso.ai, which only reads our own attribution cookie once, at signup:
atl_attr cookie above is set by us, in all regions, and read only by us. If you create an Account while it is present, we store the campaign details against your user id so we can measure how many signups — and later, subscriptions — a campaign produced. We do not share that record with Reddit or any other third party, and it is not used to track you across other websites.Full detail on both, including how to block them, is in our Cookie Policy.
Connectors may capture text that inadvertently contains secrets (API keys, tokens, passwords). Our system assumes this can happen and scrubs detected secrets before storage (on every ingress and on enriched output, using a fail-closed redaction process). This means secret material may be transiently present in transit before it is redacted. Please do not rely on this scrubbing as a guarantee, and do not use Atlaso to store regulated or highly sensitive data (see Section 11 and our Acceptable Use Policy).
We do not knowingly collect special categories of data (e.g., health, biometric, or government-ID data) and ask that you do not store such data in your Memories.
Our role. For the Memory and account data of individual Free and Pro users, Atlaso is the data controller — we determine the purposes and means of processing, and this Privacy Policy governs that relationship. The processor/controller framing in our Data Processing Addendum (and its Standard Contractual Clauses) applies only where we process personal data on behalf of a business customer; it does not apply to individual users, whose safeguards are described here.
The legal ground we rely on for a given purpose depends on where you are. We describe the same processing activities below, region by region, because the applicable law differs.
Where the GDPR or UK GDPR applies, we rely on the following lawful bases:
| Purpose | What we do | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Provide the Service | Create and manage your Account; store, sync, retrieve, and inject your Memories; register and manage your Devices | Performance of a contract (Art. 6(1)(b)) |
| Authentication & security | Verify your identity, manage sessions and passkeys, prevent abuse and fraud, enforce rate limits | Performance of a contract; legitimate interests in securing the Service (Art. 6(1)(f)) |
| Billing & subscriptions | Process payments, manage your Pro subscription, calculate taxes | Performance of a contract; compliance with legal/tax obligations (Art. 6(1)(c)) |
| AI-powered Pro features | Send your Memory content to our LLM sub-processor for enrichment, ambient distillation, and "Ask your memory" | Performance of a contract (for Pro subscribers); see Section 7 |
| Product analytics | Count content-free daily/monthly active usage, and measure website/product usage via Google Analytics | Legitimate interests in understanding and improving the Service (Art. 6(1)(f)) |
| Advertising measurement | Record in a first-party cookie which campaign you arrived from and, if you sign up, store it against your Account so we can tell which campaigns work | Legitimate interests in measuring the effectiveness of our own marketing (Art. 6(1)(f)) |
| Communications | Respond to support requests and send service/billing notices | Performance of a contract; legitimate interests |
| Legal compliance | Comply with applicable law and respond to lawful requests | Legal obligation (Art. 6(1)(c)); legitimate interests |
Third-party advertising technology is not used in these regions at all. The Reddit advertising pixel described in Section 4 never loads for visitors we identify as being in the EU, EEA, UK, or Switzerland, so no data about those visitors reaches an advertising network and no consent-based advertising processing takes place. The advertising-measurement row above covers only our own first-party attribution record.
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing as described in Section 12. Where we rely on consent (for example, certain optional features), you may withdraw it at any time without affecting prior processing.
For data principals in India, the DPDP Act recognizes consent and a set of enumerated legitimate uses as the grounds for processing — it does not recognize performance-of-contract or legitimate-interests as separate bases. Accordingly, for Indian users we process your personal data on the basis of your consent, obtained through an itemized notice at the point of collection, and on the DPDP-enumerated legitimate uses where they apply (for example, where you have voluntarily provided data for a specified purpose, or to comply with law). You may withdraw your consent at any time (see Sections 12.3 and 12.1), which does not affect processing carried out before withdrawal. See Section 12.3 for our Data Fiduciary duties and grievance-redressal contact.
Where US state privacy laws or the laws of other jurisdictions apply, we process your personal data as permitted under those laws to provide, secure, bill for, and improve the Service, to communicate with you, and to comply with legal obligations, as described above. See Section 12.2 for US state-specific rights.
Atlaso involves AI processing in two distinct ways. We want both to be transparent.
(a) Your own model, at your direction. When you use a Connector, your Content is routed through the AI model you have chosen to use (e.g., Claude or GPT) at your direction, as part of how that tool works. That processing is governed by your relationship with that model provider.
(b) Atlaso's LLM sub-processor (Pro features only). For three server-side Pro-only features, we send your Memory content (raw captures, related/recalled Memories, and your question) to our LLM sub-processor, Fireworks AI:
Free-tier users' Memory content is never sent to the LLM — Free-tier items are removed from the processing queue without enrichment.
We do not operate a training endpoint and we do not train Atlaso models on your Memory. Raw Memory content is sent to our large-language-model sub-processor only for paid (Pro) features; Free-tier Memory is never sent to any language model. We send that content to the provider solely to generate your results, and we do not use your Memory to train any AI models.
We believe this is a meaningful difference from some competitors that take broad licenses to train on user content. We do not.
We use the trusted service providers below to operate the Service. Each is bound by data-protection terms appropriate to its role. Our current list:
| Sub-processor | Purpose | Data shared | Location |
|---|---|---|---|
| Clerk | Authentication, session, and profile | Email, user id, name, passkeys, plan and Stripe-customer-id metadata | USA |
| Stripe | Payment processing and subscription billing | Email, card/payment data, billing address, subscription state | USA |
| Neon | Brain metadata database and transient enrichment queue | Token hashes, device registry, plan, usage counters, OAuth state, and transient raw capture text | USA |
| Fireworks AI | LLM for enrichment, "Ask your memory", and ambient distillation (Pro features) | User Memory content (raw captures and recalled Memories) | USA |
| Render | Hosting the brain (all server-side Memory and metadata) | All server-side data at rest | USA |
| Vercel | Hosting the dashboard | Request data and served content | USA |
| Google LLC (Google Analytics) | Website and product analytics (aggregate usage measurement) | Online identifiers (cookie IDs), device/browser info, pages viewed, approximate (city-level) location, and — for signed-in dashboard users — a pseudonymous user id and plan tier | USA |
| Sentry (Functional Software, Inc.) | Application error and crash monitoring for the dashboard | Error events, stack traces, the route where an error occurred, and browser/device metadata. Session Replay is disabled; no IP address, user id, or Memory content is attached. | USA |
For the maintained, dated list and a way to subscribe to changes, see our Sub-processors List. We use Google Analytics (Google LLC) for aggregate usage analytics and Sentry (Functional Software, Inc.) for application error and crash monitoring, both as listed above; apart from those, we do not use any third-party analytics or email-marketing vendors.
Reddit is an advertising partner, not a sub-processor. As described in Section 4, our marketing website may load a Reddit advertising pixel for visitors outside the EU/EEA/UK/Switzerland who are not sending a GPC signal. Reddit, Inc. does not process that data on our behalf or on our instructions — it decides its own purposes within its advertising ecosystem — so it is an independent controller and is deliberately not listed in the sub-processor table above or in our Sub-processors List. Its handling of the data is governed by Reddit's Privacy Policy. Aside from Reddit, we use no other advertising vendor.
Atlaso is a US company whose operations and personnel are located in India, and our sub-processors are located in the United States. This means your personal data is processed in the United States and in India. If you access the Service from the EU, UK, India, or elsewhere, your personal data will be transferred to and processed in these jurisdictions, which may not provide the same level of data protection as your home country.
International transfers of personal data therefore occur as a normal part of operating the Service. We are bringing these transfers under appropriate safeguards — for transfers out of the EEA or UK, the European Commission's Standard Contractual Clauses (SCCs) (and the UK Addendum where applicable) or another valid Article 46 transfer mechanism, together with the assessments those mechanisms require. We are finalizing the corresponding instruments for the US and India legs with counsel; we do not represent that every instrument is already executed. If you would like more information about the safeguards that apply to your data, contact us at support@atlaso.ai.
We retain personal data for as long as needed to provide the Service and for the purposes described in this policy.
atl_attr cookie expires from your browser after 90 days; where a signup was attributed to a campaign, that single row is retained for the life of the Account and deleted with it on a verified deletion request.Deletion and retraction paths:
Erasure and our LLM provider. For Pro features, Memory content is sent to our LLM provider only at the moment you use the feature, to generate your results; we do not maintain a separate store of your Memory with that provider. Deleting your Memory from our systems therefore removes it from the canonical store.
Legal-hold and preservation carve-out. Where we are legally required to preserve data — for example, to comply with a legal hold, a law-enforcement preservation request, a subpoena or court order, our obligations to report and preserve suspected illegal content (including the preservation duties under 18 U.S.C. §2258A), or to establish, exercise, or defend legal claims — we may suspend deletion of the affected data for as long as the preservation obligation lasts, even if you have asked us to delete it. We delete the data once the obligation ends.
We take reasonable and appropriate technical and organizational measures to protect personal data. These measures, implemented among others, currently include:
sk-, GitHub, AWS, Google, and Slack tokens; JWTs; bearer tokens; credentials embedded in URIs; high-entropy blobs) on every ingress and on enriched output. The redaction process is designed to fail closed — if a check cannot complete, the content is treated as if it contained a secret rather than passed through. As noted in Section 4, secret material may be transiently present in transit before it is redacted, so this is not a guarantee.user_id; per-project visibility is designed to fail closed; cross-user access attempts return a 404.Encryption. Data is encrypted in transit (HTTPS everywhere; Neon connections require SSL). At rest, data is protected by our infrastructure providers' provider-level encryption (Neon, Render). We do not apply application-level field encryption to Memory content, so please do not describe Atlaso as applying its own at-rest encryption to your Memories.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Do not store regulated data (such as health information or payment-card data) in your Memories unless separately contracted with us.
Breach notification. In the event of a personal-data breach, we will assess and notify as required by applicable law, in-product and/or by email where available. In particular:
You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority in your country of residence or work.
To exercise these rights, contact support@atlaso.ai. We will respond within the timeframes required by law (generally one month under the GDPR).
We provide notice at collection through this policy. California residents have the right to know/access, delete, and correct personal information, and to limit the use of sensitive personal information.
We do not sell your personal information, as that term is defined under the CCPA/CPRA, and we have not done so in the preceding 12 months.
"Sharing" for cross-context behavioral advertising. As of August 1, 2026, our marketing website at atlaso.ai loads a Reddit advertising pixel for visitors outside the EU/EEA/UK/Switzerland whose browsers are not sending an opt-out signal. Through that pixel Reddit receives online identifiers and the fact of your visit, and uses them for advertising measurement and to build advertising audiences. We treat this as "sharing" for cross-context behavioral advertising under the CCPA/CPRA, and we describe it here rather than characterizing it as something else. We did not share personal information for that purpose before that date, and the dashboard at app.atlaso.ai carries no advertising technology in any region.
How to opt out. We treat the Global Privacy Control (GPC) signal as a valid opt-out request and act on it directly: when your browser sends GPC, the advertising pixel is not loaded at all, so nothing is shared in the first place. Blocking third-party cookies in your browser has the same practical effect, and you can also opt out by emailing support@atlaso.ai.
We will not discriminate against you for exercising your rights. To make a request, contact support@atlaso.ai.
Other US states. Comprehensive privacy laws in states including Virginia, Colorado, Connecticut, Texas, and Oregon (among others) give residents comparable rights — to access, correct, delete, and obtain a portable copy of their personal data, to opt out of sale/targeted advertising/certain profiling, and, in several states, to appeal a decision on a rights request. Some of these laws apply regardless of a business's size or revenue (for example, Texas and Oregon have no such thresholds). If you are a resident of one of these states, you may exercise your rights by contacting support@atlaso.ai, and we will honor them as required by your state's law. Your browser's Global Privacy Control signal is honored in every region, not only California: where it is present, the advertising pixel described above does not load.
For data principals in India, Atlaso acts as a Data Fiduciary and processes your personal data on a consent-based model (with the enumerated legitimate uses where they apply), as described in Section 5.2. In that role we take on the Data Fiduciary duties under the Act, including maintaining the accuracy and security of your data, using it only for the notified purpose, and erasing it when the purpose is served or you withdraw consent (subject to Section 10's legal-hold carve-out).
If you are in India, you have the right to access a summary of your personal data and our processing, to correction and erasure, to grievance redressal, and to nominate another individual to exercise your rights in the event of death or incapacity. Because our processing is based on your consent, you may withdraw that consent at any time by contacting support@atlaso.ai; withdrawal does not affect processing carried out before it.
Children. We require verifiable parental consent before processing the personal data of anyone under 18 (see Section 13), and we do not track, profile, or serve targeted advertising to children.
Grievance redressal. You can raise any privacy grievance with us at support@atlaso.ai, and we will work to resolve it. If your grievance is not resolved, you may complain to the Data Protection Board of India.
To protect your data, we may need to verify your identity before fulfilling a request. We will only use information provided in a request to verify and respond to it.
The Service is not directed to children, and you must meet the minimum age set out in Section 3 of our Terms of Service to use it: at least 13 years old, and where local law requires a higher age or parental involvement — 16 in parts of the EU/EEA, and under 18 in India — only with the verifiable consent of a parent or guardian. We do not knowingly collect personal data from children below the applicable age without the required parental consent. If you believe a child has provided us with personal data without that consent, contact support@atlaso.ai and we will delete it.
We use essential authentication cookies (set by Clerk), a functional theme preference stored in your browser's local storage, and Google Analytics 4 cookies for aggregate usage analytics. On the marketing website only, we also set two first-party cookies for advertising measurement (atl_attr and atl_geo) and — for visitors outside the EU/EEA/UK/Switzerland who are not sending a Global Privacy Control signal — load a Reddit advertising pixel, which sets Reddit's own third-party cookies. The dashboard at app.atlaso.ai loads no advertising pixel and no third-party advertising cookies; the only thing it does is read our own atl_attr cookie once at signup, which is shared across atlaso.ai and app.atlaso.ai. For the full detail, including how to block each of these, see our Cookie Policy.
If Atlaso is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, personal data — including your Memories and account data — may be transferred or disclosed as part of that transaction or diligence, as a business asset. Any acquirer or successor will remain bound by the commitments in this Privacy Policy, or we will require it to honor equivalent protections, and we will notify you (in-product and/or by email where available) of any change in ownership or use of your personal data, and of any choices you may have, as required by applicable law.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy.
Questions about this policy? Contact us at support@atlaso.ai.