Loading…
Loading…
Pricing · Privacy & data · Terms · Contact
Effective September 17, 2026 · Version 2026-09-17
This Data Processing Addendum (“DPA”) describes how Adelphos processes personal data on behalf of a customer who uses Atlas. It is incorporated into, and forms part of, the Terms of Service for every business customer to whom a data-protection law applies - including the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended, and comparable U.S. state privacy laws. No signature is needed for it to apply; it takes effect when you accept the Terms. Where this DPA and the Terms conflict about the processing of personal data, this DPA controls.
If your procurement process needs a countersigned copy, see Section 18. If you are an individual using Atlas for yourself rather than on behalf of an organization, this DPA does not change anything for you - the Privacy Policy describes how we handle your data.
This DPA is between you, the customer (“Customer”), and the business that operates Atlas under the Adelphos brand (“Adelphos,” “we,” “us”). If your records require the full registered legal name and address of the contracting entity, write to legal@iatlas.live and we will provide it.
“Data Protection Law” means any privacy or data-protection law that applies to the processing under this DPA. “Customer Personal Data” means personal data contained in Your Content (as the Terms define it) that we process on Customer’s behalf. “controller,” “processor,” “data subject,” “personal data,” “personal data breach,” and “processing” have the meanings given in the GDPR, and “business,” “service provider,” “sell,” and “share” the meanings given in the CCPA, in each case as applicable.
We are a processor (and a service provider) for Customer Personal Data. That is the contact records, business cards, voice notes, transcripts, notes, pasted text, and research findings that Customer puts into Atlas. Customer is the controller (and the business) for that data: Customer decides what to collect, why, and how long to keep it, and Customer is responsible for having a lawful basis to do so and for the notices and rights owed to the people the records describe.
We are a controller for a narrow set of other data: the account email used for sign-in and the authentication records around it; billing and transaction records; security, audit, and request logs; and records of which version of our policies an account accepted. We process that data for our own purposes - operating, securing, billing for, and defending the Service - and the Privacy Policy describes it. This DPA does not apply to it.
Where Customer is an organization with multiple members, the organization is the controller, and its administrators and members act on its behalf. Where a member chooses to share their contact book with colleagues, that sharing is an instruction from Customer and is not a disclosure by us to any third party.
Subject matter and nature: hosting, storing, structuring, transcribing, analyzing, retrieving, transmitting, and deleting Customer Personal Data in order to provide Atlas. Purpose: providing the Service described in the Terms, and nothing else. Duration: for as long as Customer’s account is open, and then for the period described in Section 13.
Categories of data subjects: Customer’s own personnel who use the Service, and the business contacts, prospects, and other individuals whose details Customer records in it. Categories of personal data: name, employer and job title, business contact details, the image of a business card, voice recordings and their transcripts, meeting and relationship notes written by Customer, publicly sourced information about a person’s employer, and correspondence drafts. Special categories: the Service is not designed for and must not be used to process special-category data under GDPR Article 9, or data about criminal convictions and offenses. Because notes and voice recordings are free-form, Customer is responsible for not entering such data.
We will process Customer Personal Data only on Customer’s documented instructions, including with regard to international transfers. The Terms, this DPA, and Customer’s own configuration and use of the Service’s features - enabling research, connecting a CRM, granting external-write consent, approving a specific change, inviting a colleague - are Customer’s complete documented instructions. Any other processing requires Customer’s written agreement.
We will tell Customer if, in our opinion, an instruction infringes Data Protection Law, and we may suspend that instruction until it is resolved. If the law requires us to process Customer Personal Data other than on Customer’s instructions, we will inform Customer before doing so unless that law forbids it on important grounds of public interest. If we receive a legally binding demand from a public authority for Customer Personal Data, we will, where legally permitted, notify Customer promptly, redirect the authority to Customer, and challenge a demand that appears unlawful or overbroad.
We will not: sell or share Customer Personal Data as those terms are defined under the CCPA; retain, use, or disclose it for any purpose other than performing the Service, or outside the direct business relationship between us and Customer; combine it with personal data we receive from anyone else, except as needed to perform a service permitted by the CCPA; or use it to train, fine-tune, or improve any AI or machine-learning model, whether ours or a third party’s. We accept the restrictions of CCPA § 1798.100(d) and § 1798.140(ag), and we will notify Customer if we determine we can no longer meet them.
We limit access to Customer Personal Data to personnel who need it to operate or support the Service. Every person we authorize is bound by a written duty of confidentiality or an appropriate statutory obligation, which survives the end of their engagement. We train those with access on their obligations under this DPA.
We implement appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, taking into account the state of the art, the cost of implementation, and the risks involved. Those measures currently include:
We may update these measures as the Service and the threat landscape evolve, provided the updates do not materially reduce the overall level of protection. This list, together with Section 4, serves as the description of technical and organizational measures required by Data Protection Law and by the transfer mechanism in Section 15. Report a suspected vulnerability to security@iatlas.live.
Customer gives general written authorization for us to engage subprocessors. We impose on each subprocessor, by written contract, data-protection obligations no less protective than those in this DPA, and we remain fully liable to Customer for each subprocessor’s performance. The subprocessors we currently engage are:
A note on connected CRMs. A CRM that Customer chooses to connect is listed above for transparency, but it is not really our subprocessor: it acts under Customer’s own agreement with that provider, on Customer’s instruction, and we access it only with credentials Customer supplies. Customer can disconnect it at any time from Settings.
Notice of changes, and your right to object. We will give Customer at least 30 days’ notice, by email to the account address, before we add or replace a subprocessor that processes Customer Personal Data. Customer may object on reasonable data-protection grounds within those 30 days by writing to legal@iatlas.live. We will then work with Customer in good faith to find a workable alternative - for example, a different provider or a configuration that excludes Customer’s data. If we cannot, Customer may terminate the affected part of the Service and receive a pro-rata refund of fees prepaid for the unused period. Where a change is urgent - because a provider fails or a security issue requires an immediate switch - we may make it first and notify Customer without undue delay, and the objection right still applies.
The Service is built so that Customer can handle most requests directly: Customer can search, correct, export, and delete any record from within the app, and export everything from Settings. Taking into account the nature of the processing, we will assist Customer with appropriate technical and organizational measures, insofar as possible, in fulfilling Customer’s obligation to respond to requests to exercise rights of access, rectification, erasure, restriction, portability, or objection.
If we receive a request directly from a data subject about Customer Personal Data, we will not respond to it substantively. We will promptly tell that person to contact Customer, and we will notify Customer of the request, unless the law forbids it. Contact legal@iatlas.live for assistance with a request you cannot satisfy through the app.
Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to Customer with data-protection impact assessments and any prior consultation with a supervisory authority, and with Customer’s obligations regarding security and breach notification. This page, the Privacy Policy, and answers to a reasonable security questionnaire are ordinarily sufficient for that purpose.
We will notify Customer of a personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, and in any event within 72 hours. The notification will describe, to the extent known at the time: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures we have taken or propose to take to address it and to mitigate its effects; and a contact point for more information. Where we cannot provide all of that at once, we will provide it in phases without further undue delay.
We will cooperate with Customer and take the reasonable steps Customer directs to assist in investigating and remediating the breach. Our notification is not an acknowledgment of fault or liability. Customer is responsible for any notification it owes to a supervisory authority or to data subjects, since Customer is the controller.
Customer may export Customer Personal Data at any time during the term from Settings. When the Service ends, we will, at Customer’s choice, delete or return Customer Personal Data, and delete existing copies, unless the law requires us to keep it. In practice: if Customer deletes the account in Settings, deletion begins immediately; otherwise, Customer Personal Data stays available for export for 30 days after the end date and is then deleted from our live systems.
Two limits, stated plainly rather than glossed over. Encrypted backups are kept on a rolling schedule, so deleted data can persist in a backup until that backup expires on its own cycle; backups are not used to restore individual deleted records and are restored only wholesale after a system failure, and Customer Personal Data in a backup remains subject to this DPA until it expires. And we retain the limited records described in Section 3 where the law requires. Transaction records are retained as long as tax and accounting law requires, typically seven years. Voice audio is treated more aggressively than the rest, during the term as well as after it. Deleted once you approve the transcript, unless you choose to keep the recording.
We will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor Customer mandates. To keep this workable for both sides, Customer will first accept the documentation we can provide - this DPA, the Privacy Policy, our subprocessor list, our responses to a reasonable security questionnaire, and any third-party reports or certifications we hold.
If that is genuinely insufficient to satisfy an obligation under Data Protection Law, Customer may conduct an audit on at least 30 days’ written notice, no more than once in any 12-month period (or more often where a supervisory authority requires it or following a confirmed personal data breach), during business hours, without unreasonably disrupting the Service, subject to confidentiality, and at Customer’s expense. An auditor must not be a competitor of ours. No audit may extend to another customer’s data or to the systems or premises of a subprocessor beyond the information that subprocessor makes available to us.
We and our subprocessors process Customer Personal Data in the United States. Where Customer Personal Data protected by EU, UK, or Swiss law is transferred to us in a country that has not received an adequacy decision, that transfer takes place under the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference and apply as follows:
If the Standard Contractual Clauses are invalidated or replaced, or if another lawful transfer mechanism becomes available and appropriate, the parties will cooperate in good faith to put that mechanism in place without undue delay. Nothing in this section applies to a transfer Customer itself directs - for example, to a CRM Customer connects - which is governed by Customer’s own agreement with that provider.
Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms of Service, including the carve-outs stated there. This DPA does not limit any right a data subject has directly against either party under Data Protection Law or under the Standard Contractual Clauses.
This DPA forms part of the Terms and takes effect when Customer accepts them. It continues for as long as we process Customer Personal Data, and the provisions that by their nature should survive do survive. In the event of a conflict, the order of precedence is: the Standard Contractual Clauses first, then this DPA, then the Terms. Except where the Standard Contractual Clauses or Data Protection Law require otherwise, this DPA is governed by the law of the State of Texas, United States, and disputes are resolved as the Terms provide. We will change the version and effective date above when we update this DPA, and will give notice of a material change as the Terms require.
This DPA is already binding without a signature - accepting the Terms is enough, and no action is needed for it to apply. If your procurement or compliance process nonetheless requires an executed copy, email legal@iatlas.live from the address on your account with your organization’s full legal name, registered address, the name and title of your signatory, and their email address. We will return a copy of this DPA, including the Standard Contractual Clauses with the annexes completed, executed on our side, for your countersignature. Tell us in the same message if you need us to complete a security questionnaire or a vendor form, and we will.
Data-protection and DPA questions: legal@iatlas.live. Security incidents and vulnerabilities: security@iatlas.live. Anything else: hello@iatlas.live. See also the Terms of Service and the Privacy Policy.