Privacy notice.

1. Who we are

Atlas Core Cloud Ltd ("Atlas Core", "we", "us") is a UK-registered company (no. 14829300) with its office in London. We are the data controller for the Atlas Core website and the data processor for the data you put into the Atlas Core platform on behalf of your customers, staff and suppliers.

This notice covers both roles, and flags which is which where the answer differs.

2. What we collect

When you visit atlascore.cloud

• A session cookie and an anti-CSRF cookie, both needed for the site to work at all
• Your answer to the cookie bar, kept in your own browser and never sent to us
• Analytics and advertising cookies, but only if you accept them
• If you arrived from one of our adverts, the click identifier Google put in the address
• Your IP address (truncated and stored for 14 days for security logging only)
• Basic browser/device information, for diagnosing bugs
• Whatever you tell us in a contact form or a demo booking

When you use the Atlas Core platform

As a processor, we store the business data you put into the system - inventory, orders, customers, staff records, invoices. We also store operational metadata: who logged in, from where, what they changed. What goes in is your choice and your responsibility.

3. Why we use it

• To run the service. You can't use the platform without us storing your data.
• To secure the service. Login logs, rate limits and fraud checks keep your data safe.
• To improve the service. Aggregate, anonymous usage signals. Never your customer records.
• To contact you, rarely. Service updates, security notices, new feature announcements (opt-out in one click).

We do not use your data to train AI models used by anyone else. We don't sell your data. There is no advertising product here.

4. Who we share with

We use five subprocessors: Akamai (Linode) for hosting, Cloudflare for DNS and traffic filtering, Stripe for subscription billing, OpenAI for the analysis behind Navigator, and Google Analytics on this marketing site. Only tokenised figures reach OpenAI - identifiers are replaced before a request leaves the platform, and the mapping back to your records stays with us. Each one is named on the subprocessor list, with what it does and where it processes data. We give 30 days' notice before adding one.

We use no resellers and no offshore support desks. Nobody outside that list gets access to your tenant.

We share data with the authorities only where we are legally required to do so.

5. How long we keep it

• Active customer data: as long as your account is active.
• After cancellation: 30 days. Your instance stays reachable for that window so you can export; then it is taken off the internet and the data deleted.
• Backups: 30 days after cancellation. They run nightly, are pruned on a 30-day cycle, and the last of them ages out with the instance.
• Security logs: 12 months. Logins, break-glass access, permission changes - the trail we need to investigate an incident.
• Application audit trail: 2 years. Who changed what inside the platform.
• Diagnostic server logs: 14 days. Error traces and request logs, kept only long enough to debug what went wrong.
• Financial records: 7 years, because our accountants and yours will ask.
• Support conversations: 2 years.

Deletion means deletion. Once a period above has run out, we do not keep a quiet copy for analytics or "in case you come back".

6. Your rights

If you're in the UK, EU or EEA, you can:

• Ask us what we hold on you
• Have it corrected
• Have it deleted (subject to the retention periods above)
• Port it elsewhere, in a common format
• Object to our use of it
• Complain to the ICO (UK) or your local DPA

Write to [email protected]. We answer within 5 working days; we always resolve within 30.

7. Security

TLS 1.3 in flight, terminated at Cloudflare's edge and re-encrypted on the way to our servers. Every instance has its own database on its own credentials, so one customer's queries cannot reach another's rows.

Backups run nightly, carry a checksum, and are test-restored on a rotation - a backup nobody has opened is a hypothesis, not a safety net. Staff access to a customer instance is brokered and logged with a reason in an append-only trail no engineer can edit, kept for 12 months.

We hold no security certifications today, and we won't claim ones we don't have. If you need a security questionnaire answered before you buy, send it to [email protected] and we'll answer it straight.

If something goes wrong, we'll tell you. Material incidents within 72 hours, with a full public post-mortem within two weeks.

8. Cookies

We set two first-party cookies: a session cookie and an anti-CSRF cookie. Neither can be switched off - without them the site does not work, and neither is used to track you across other sites.

Everything else waits for you. On your first visit a bar asks whether you accept analytics and advertising cookies, and until you answer, nothing of the sort is stored. We use Google Consent Mode v2, so before you choose, Google receives only cookieless pings carrying no identifier for you.

If you accept, Google Analytics 4 sets its own cookies and measures which pages get read, and Google may use that measurement to tell whether one of our ads led anywhere. If you reject, no analytics or advertising cookie is set at all and Google's advertising identifiers are redacted from what little it receives. The site works exactly the same either way, and we do nothing with the analytics beyond counting visits and telling which campaign a visit came from.

Your answer is kept in your own browser's local storage under ac_consent_v2. It is not a cookie, it is never sent to us, and clearing your browser data forgets it. To change your mind, use the Cookies link in the footer of any page - it reopens the bar, and rejecting after accepting stops the storage immediately.

Campaign pages and ad clicks

Some pages here are reached from a Google Ads advert. Google adds a click identifier (gclid) to the address you arrive on, and we pass it, along with any campaign tags, to the address of our signup app when you click through - so that a signup can be matched to the advert that paid for it. It travels in the URL, not in a cookie, and it identifies the advert, not you.

The Atlas Core platform itself carries no analytics tag and no third-party cookies at all. Nothing you do inside the platform reaches Google.

9. Contact & complaints

Questions, subject access requests, or complaints: [email protected]. Our Data Protection Officer is Robert Tudor, reachable at the same address.

If you're not happy with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk, or your local EU Data Protection Authority.