Privacy Policy

1. Who we are

Atlas is a personal assistant for your email, calendar, notes, lists and reminders, provided by Nord Atlas (“we”, “us”), based in Romania. Nord Atlas is the controller of the personal data described in this policy under the EU General Data Protection Regulation (GDPR).

Contact us about privacy at privacy@nordatlas.io. We haven’t appointed a data protection officer; this address reaches the people responsible for data protection at Nord Atlas.

This policy covers the Atlas website and web app at https://nordatlas.io, including voice mode, and the emails we send. Our Terms of Service explain the rules for using Atlas.

2. Information we collect

Your account

• Your email address and name, and your profile photo if you sign in with Google.
• If you use an email address and password: your password, stored by our authentication provider only in hashed form, and the one-time codes we email you to confirm sign-ins (stored hashed, valid for 10 minutes).
• Invitation details: the email address invited, who invited it, and when the invitation was sent, accepted or expired.
• Account activity: when you signed up, last signed in and were last active in Atlas, and records of verified sign-ins.
• Your settings, such as time zone, voice and language, dashboard layout, Inbox Review and briefing schedules.

Your Google account data (with your permission)

When you connect Google, Atlas receives access tokens that let it work with your Gmail, Google Calendar and Google Contacts. We store these tokens encrypted. Atlas reads your email, calendar and contacts from Google when a feature needs them and doesn’t keep a copy of your mailbox, calendar or contacts. What Atlas does store is described in How Atlas uses your Google data.

Content you create or share in Atlas

• Notes, folders, lists, list items, reminders and briefings.
• Your conversations with Atlas in chat, including the words of voice calls, and titles Atlas gives them. Atlas’s replies can mention what it looked up to answer; the emails and events it read aren’t stored with them.
• Memories: short facts about you, your preferences, people and projects that you ask Atlas to remember or that Atlas picks up from your chats. You can see, export, forget and delete them in Settings.
• Email drafts Atlas prepares, emails you schedule (including attachments) and calendar changes Atlas proposes.
• Share links for notes and lists, their optional password (stored hashed), view counts, and the email addresses you send notes to.

Voice

When you use voice mode or dictation, the audio from your microphone and the resulting text. The words of each voice call are saved to your chat history; the audio isn’t. See Voice features and ElevenLabs.

Notifications

When you turn notifications on for a device, your browser gives Atlas an address at its push service (Apple’s, Google’s, Mozilla’s or Microsoft’s) and two keys for that device, and Atlas keeps them with a name for it, such as “Chrome on Mac”. Atlas notifies you about new email, about reminders as they come due and about meetings shortly before they start, as you choose in Settings. A reminder’s notification shows its title and the first line of its notes. What notifications about new email and meetings read and keep is in How Atlas uses your Google data.

Information about other people

Your emails, calendar events, notes and contacts naturally contain information about other people, such as senders, recipients and meeting guests. Atlas processes it only to provide the features you use, for example to summarise an email or find the address of someone you want to write to.

Technical information

• Standard request data processed by our hosting providers when your browser or device connects to Atlas, such as IP address, browser type and the time of the request.
• Error reports: when you choose to report a problem, and automatically when a voice action fails, the error message and technical details, the Atlas page it happened on (its address without any search words), your browser and device type, and your account.
• Records of the emails we send you (address, type of email, delivery status) and of addresses that bounced, complained or unsubscribed.

Payments

When paid plans are available, our payment provider will collect your payment details. We won’t receive or store your full card number; we’ll receive details such as your plan, payment status and billing country. We’ll name the payment provider in this policy before paid plans start.

When you contact us

Your messages to us and our replies.

3. How we use information and our legal bases

We use personal data only for these purposes, on these legal bases under Article 6 GDPR:

Where we rely on legitimate interests, we’ve balanced them against your rights, and you can object (see Your rights and choices). We don’t send marketing emails. If we ever want to, we’ll ask for your consent first.

Atlas uses automated processing, for example to sort your inbox by what needs attention or to decide which facts from a chat are worth remembering. None of it produces legal or similarly significant effects on you, and you can always review, change or undo the results.

4. How Atlas uses your Google data

Atlas asks for access to your Google account on Google’s consent screen and uses it only for features you can see and use in Atlas.

What Atlas can access

What Atlas stores

• Your Google access tokens, encrypted, so Atlas can work while you use it and for scheduled features.
• Email summaries you, your dashboard or your notifications request: the message ID, subject, sender and summary, for 6 months.
• The IDs and Gmail labels of new emails as they arrive, so each is handled once, for 7 days. Gmail tells Atlas about new email through Google Cloud Pub/Sub. No sender, subject or words of the email are kept.
• Inbox Review results for emails from the last 7 days: sender, subject, a short excerpt, Atlas’s summary, priority, suggested action, any commitment it found, and a suggested reply, for 30 days after the email arrived.
• Short samples of emails you sent (up to 8 excerpts), so suggested replies match how you write. They’re refreshed weekly while Inbox Review is on, and deleted after 30 days without a refresh.
• For emails you label “atlas”: the subject, sender, a short excerpt and the events found in them.
• Emails you schedule, including attachments, until they’re sent. Email drafts and proposed calendar changes Atlas prepares in chat, for 30 days after their last change.
• Atlas’s replies in chat, which can mention details of emails it looked up. A briefing is prepared shortly before it’s sent and cleared once it’s emailed to you.

Notifications about new email and meetings

On devices where you turn notifications on, Atlas reads a new email’s sender, subject, first lines and labels from Gmail as it arrives, to decide whether to notify you and whether on its own or together with others, as you chose in Settings. With Summaries on, Google’s Gemini model writes the one-line summary the notification shows, which is kept like other summaries. Atlas doesn’t keep the rest.

With meeting notifications on, Atlas checks your calendar every few minutes for events starting within the hour, and keeps only their IDs and start times, until a day after they start. Shortly before one starts, Atlas reads it again, and the notification shows its title, time and place. Events you’ve declined, all-day events, focus time and out of office don’t notify.

Each notification is encrypted for your device before it leaves Atlas, so the push service carrying it can’t read it. Your device shows it as its settings say, which can include the lock screen.

What Atlas doesn’t do with Google data

• It doesn’t sell it, or transfer it to advertising platforms, data brokers or information resellers.
• It doesn’t use it to serve, target or measure ads, or to decide creditworthiness or eligibility for loans.
• It doesn’t use it to create, train or improve AI or machine learning models, other than the features Atlas personalises for you, such as your memories and writing samples.
• It doesn’t transfer it to others except the service providers in Who we share information with that process it to provide Atlas’s features, or where needed for security or to comply with the law, or as part of a merger, acquisition or sale of assets with your prior consent.
• No person at Nord Atlas reads your Google data unless you ask us to (for example to help with a support request about specific emails), it’s needed for security purposes such as investigating abuse, it’s required by law, or it has been aggregated and made anonymous for internal operations.

Atlas’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Atlas also follows the Google Workspace API User Data and Developer Policy.

Ending access

You can disconnect Google in Atlas Settings at any time. Atlas then asks Google to end its access and deletes your stored tokens. You can also remove Atlas in your Google Account settings. Information Atlas already stored, such as summaries and Inbox Review results, stays until its time is up (see How long we keep information) or you delete it or your account.

5. AI processing

Atlas’s AI features run through the Lovable AI Gateway, provided by Lovable, which sends requests to Google’s Gemini models. For each task, only the information needed is sent: for example the email to summarise, the events and emails needed to answer a question, your notes, reminders and memories, your name, and writing samples for a suggested reply. Some briefings also look things up on the web through Google Search, using search terms based on the briefing you set up and what Atlas remembers about you, such as your city. Voice does the same when you ask it about something current, such as the news or the weather, searching with your question as it understood it. When you plan a trip in chat, Atlas searches Google for places to stay, eat and visit, including what people recommend on Reddit, using the destination, the kind of trip and its dates; if a booking in your email shows where you’re staying, that hotel’s name may be used too. Otherwise your emails aren’t used in these searches.

Lovable processes this data on our behalf. We’ve opted out of Lovable using our data to train its models, and turned off the request viewer in our Lovable account, so the content of AI requests, which can include email text, can’t be opened from it. We don’t use your data to train AI models, and we don’t sell it or use it for advertising. AI output can be wrong, so Atlas asks you to confirm important actions.

6. Voice features and ElevenLabs

Voice mode and dictation are provided by ElevenLabs. They use your microphone only while you’re using them, after your browser asks for permission. In voice mode you’re talking with an AI, not a person, and the call is recorded as described below.

• Dictation in chat sends the audio of what you say to ElevenLabs, which turns it into text.
• Voice mode streams your voice to ElevenLabs’ conversational AI platform, which understands what you say, decides what Atlas should do, and speaks the reply. To help it, Atlas gives it your name, your local time and time zone, and the information Atlas looks up during the conversation, such as calendar events, parts of emails (up to 1,500 characters each), notes, lists, reminders, memories and contacts.
• Voice previews in Settings send only a fixed sample sentence to ElevenLabs.

ElevenLabs processes this data as our service provider. Voice conversations, including audio and transcripts, are kept by ElevenLabs for up to 30 days under our settings and then deleted. We don’t allow ElevenLabs to use Atlas voice data to train its models. Atlas saves the words of each call, yours and its own, to your chat history, where you can delete them; it doesn’t save the audio. Neither we nor ElevenLabs use your voice to identify you. ElevenLabs stores data in the United States (see International transfers). You can read the ElevenLabs Privacy Policy.

Your voice may pick up other people nearby. Please make sure they’re aware before you use voice mode around them.

7. Who we share information with

We don’t sell personal data or share it for advertising. We share it only as described here.

Service providers

These companies process personal data on our behalf, under contracts that restrict them to providing their services to us:

Others you interact with through Atlas

• People you email, share with or meet. Emails you send reach their recipients. People with a share link can see the shared note or list. When Atlas creates or changes a calendar event, Google may notify its guests.
• Email senders. When you open an email, images in it load from the sender’s servers, which may tell the sender you opened it, as with other email apps. If you unsubscribe through Atlas, the sender receives the unsubscribe request.
• Your browser’s push service. Notifications reach your devices through the push service your browser uses (Apple’s, Google’s, Mozilla’s or Microsoft’s). Atlas encrypts each one for your device, so the service can’t read it; it sees your device’s address and when a notification is sent.

Legal reasons and business changes

We may disclose information if the law requires it, to respond to valid requests from authorities, to protect the rights, safety and security of our users, the public or Nord Atlas, or to enforce our Terms. If Nord Atlas is involved in a merger, acquisition or sale of assets, personal data may transfer to the new owner under this policy, and we’ll tell you before that happens.

8. International transfers

Some of our providers process personal data outside the European Economic Area, mainly in the United States. When they do, we rely on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified companies, or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for more information about these safeguards at privacy@nordatlas.io.

9. How long we keep information

We keep personal data only as long as needed for the purposes above:

Deleting your account

To delete your account, email privacy@nordatlas.io from the address on your account. We’ll delete it within 30 days: we ask Google to end Atlas’s access, and delete your account and the data listed above, except records we must keep by law or to establish, exercise or defend legal claims. Copies in our providers’ backups are overwritten on their regular cycles. Deleting your account doesn’t delete emails or events in your Google account.

10. How we protect information

• Connections to Atlas are encrypted in transit (HTTPS).
• Google access tokens are encrypted at rest with AES-256-GCM.
• Database rules keep each user’s data separate, and privileged access happens only on our servers.
• Accounts not linked to Google confirm each sign-in with an emailed code; access to Atlas is by invitation.
• To run Atlas, a small number of authorised administrators can see account details (name, email address, sign-up, sign-in and last activity times, how you sign in, and whether Google is connected, with its address and the Google services allowed), the names, schedules and errors of your briefings, error reports, problems delivering emails we send you, invitations and the waitlist. Atlas’s tools don’t show them your emails, calendar, notes, chats, memories or Inbox Review results, and direct access to our systems is limited to maintenance, security and legal needs.

No system is perfectly secure. If a personal data breach affects you, we’ll notify you and the supervisory authority as the law requires.

11. Your rights and choices

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• rectify inaccurate data;
• erase your data;
• restrict how we process it;
• data portability: receive data you gave us in a machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent where we rely on it, without affecting earlier processing.

To use these rights, email privacy@nordatlas.io. We’ll respond within one month (extendable by two months for complex requests, in which case we’ll tell you why) and may ask you to confirm your identity. It’s free unless a request is clearly unfounded or excessive.

Controls in Atlas

• Disconnect Google in Settings, or remove access in your Google Account.
• Delete notes, lists, reminders, briefings and chats; see, export, forget and delete memories in Settings.
• Turn Inbox Review, its email, and dashboard summaries on or off.
• Turn notifications on or off for each device, choose how new email notifies you, and turn notifications about reminders and meetings on or off.
• Remove or expire share links.
• Block microphone access in your browser settings.

Complaints

Please contact us first so we can try to help. You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, www.dataprotection.ro.

12. Cookies and storage on your device

Atlas doesn’t use advertising or analytics cookies or trackers. It stores only what it needs to work on your device, so it doesn’t ask for cookie consent:

On a shared computer, sign out when you’re done. You can clear this storage at any time in your browser settings.

13. Children

Atlas is only for people aged 18 and over. We don’t knowingly collect personal data from anyone younger. If you believe someone under 18 is using Atlas, contact privacy@nordatlas.io and we’ll delete the account.

14. Changes to this policy

We’ll update this policy when our practices, providers or the law change, and change the date at the top. If a change is material, we’ll tell you by email or in Atlas before it takes effect, and where the law requires your consent, we’ll ask for it.

15. Contact

Nord Atlas
Privacy questions and requests: privacy@nordatlas.io
Other legal questions: legal@nordatlas.io