Atlas Privacy Policy

1. Who we are

Atlas is operated by OBVIOUS SARL, a company registered in France (RCS Nanterre 985 320 209), whose registered office is at 34 rue des Longs Prés, 92100 Boulogne-Billancourt, France ("Atlas", "we"). For the personal data of the people who use Atlas, we are the data controller. For the data a brand brings into its own workspace, such as its leads and prospects, the brand is the controller and we process that data on its behalf and on its instructions.

You can contact us about anything in this policy at contact@atlasgtm.ai.

2. The data we collect

• Account data. Your name, email address, password (stored only as a salted hash by our authentication provider), profile photo, the workspaces you belong to and your role in each.
• Workspace content. The posts, drafts, comments, briefs, strategies, images, files and settings you and your team create or upload.
• LinkedIn data. When you connect a LinkedIn account: your profile details, the posts you publish through Atlas or ask it to track, their performance metrics, and comments and reactions on them. For ad accounts you connect: the ad accounts you can access and your role on each, campaign, ad and spend data, and the changes you make to your ads from Atlas, such as pausing or resuming them. If you connect LinkedIn for outreach: the invitations and messages Atlas sends for you and the replies to them.
• Google account data. If you connect Gmail: your Google email address and an access token that lets Atlas send email for you. Section 3 covers this in full.
• Creator data. If you take part as a creator: your contact details, LinkedIn profile, the programs you join, your content and its results, and the details needed to pay you, such as invoices and billing information.
• Leads and prospects. Brands use Atlas to find and contact professionals interested in their content: people who engaged with a post, or who match a target profile. For them we process professional information such as name, job title, company, LinkedIn profile URL and, where a brand asks for it, a professional email address or phone number found through the enrichment providers listed in section 5.
• Link clicks. Posts can carry an Atlas tracked link. When someone clicks it we record the time, the page it leads to, the referring page and the browser's user agent. We do not store the IP address: we keep only a one-way code derived from it that changes every day, used to count repeat clicks once.
• Technical data. Server logs needed to run and secure the service. Atlas uses only the cookies needed to keep you signed in and to complete a connection securely. It uses no advertising or analytics cookies.

3. Google user data

An admin of a workspace can choose to connect a Google account so that creator invitations and their follow-up emails are sent from their own address instead of from Atlas. When they do, Atlas asks Google for these permissions only:

• Send email on your behalf (gmail.send). Atlas uses it only to send the emails you write or approve in Atlas, and the follow-ups you schedule, to the creators you choose.
• Your email address and basic identity (openid, email). Atlas uses it to show which address is connected and to send from that address.

Atlas cannot read, search, delete or change any email, label, contact or setting in your mailbox. It never asks for those permissions.

Storage. The token Google issues is encrypted (AES-256-GCM) before it is stored in our database, and is decrypted only at the moment an email is sent. We keep a record of the emails sent through Atlas (recipient, subject, time and delivery status) so you can follow your invitations.

Sharing. Google user data is not sold, not shared with third parties, and not used for advertising. It is not sent to AI providers and is not used to develop, improve or train any AI or machine learning model. No person at Atlas reads it, except with your explicit consent for a support request, when required for security, or when required by law.

Retention and deletion. The connection is kept until you disconnect it in Settings, then Integrations. Disconnecting deletes the stored token and revokes Atlas's access at Google, unless the same address is still connected in another of your Atlas workspaces. You can also remove Atlas at any time from your Google Account, under Security, then Third-party access.

Atlas's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

4. How we use data

• To provide Atlas: run workspaces, publish and schedule posts, promote them as LinkedIn ads and pause or resume those ads, track their performance, manage creator programs, send the emails and messages you set up, and produce reports.
• To pay creators and invoice brands.
• To keep the service secure, prevent abuse and fix problems.
• To send service messages, such as sign-in links, invitations and notifications you can control in Settings.
• To draft and analyse content with AI tools when you ask for it. Only the content needed for the task is sent, and our AI providers do not use it to train their models.

Under the GDPR, we rely on the performance of our contract with you or your organisation, on our legitimate interest in running and securing the service, on the brand's legitimate interest in reaching relevant professionals, and on your consent where we ask for it, such as when you connect an account. You can withdraw consent at any time by disconnecting that account.

5. Service providers

We use these providers to run Atlas. Each receives only the data it needs for its task and is bound by a data processing agreement.

• Hosting and storage: Supabase (database, authentication, file storage) and Vercel (application hosting).
• LinkedIn connectivity: LinkedIn's own APIs, including the LinkedIn Marketing (Advertising) API, Zernio (publishing and post metrics) and Unipile (messaging for outreach).
• Email delivery: Resend, for emails sent from Atlas's own address, and Google, for emails you send from your connected Gmail.
• AI: Anthropic, OpenAI and OpenRouter, for drafting, analysis and images.
• Public profile data and enrichment: Apify, FullEnrich, Dropcontact, Kaspr and Hunter, for public professional information and professional contact details.
• Tools a workspace chooses to connect: Slack, Notion, Google Sheets, LeadJourney and Fibbler, which receive only what that workspace sends them.

6. Who else sees your data

The members of a workspace see that workspace's data. When you take part in a brand's program as a creator, that brand sees your profile, your content and its results. We do not sell personal data and do not share it for advertising. We may disclose data if the law requires it, or to a buyer if Atlas is sold, under the same protections.

7. International transfers

Some of our providers are based in, or reach data from, countries outside the European Economic Area, including the United States. Those transfers rely on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

8. How long we keep data

We keep account and workspace data for as long as the account or workspace is active. After a workspace or account is closed we delete or anonymise its data within 90 days, except what we must keep longer by law, such as invoices. Connected-account tokens are deleted as soon as the account is disconnected.

9. Security

Data is encrypted in transit (HTTPS) and at rest. Access tokens for LinkedIn and Google are also encrypted individually before storage. Access inside Atlas is limited by workspace and by role, and only the staff who need it to run the service can reach production data.

10. Your rights

You can ask to access, correct, delete or export your personal data, to restrict or object to how it is used, and to withdraw any consent you gave. Write to contact@atlasgtm.ai and we will answer within one month. If you were contacted through a brand's workspace, we will pass your request to that brand and act on it with them.

You can also complain to the French data protection authority, the CNIL (cnil.fr), or to the authority where you live.

11. Changes to this policy

If we change this policy we will update the effective date above, and tell account holders by email or in the app before a material change takes effect.