Privacy Policy

This policy explains what personal data Atria (“we”, “us”) collects when you use Atria, why we collect it, and what rights you have over it. For the purposes of data protection law, Atria is the controller of that data.

1. What we collect

• Account data — your name and email address, and a securely hashed password. We never store your password in readable form.
• Your content — the projects, tabs, notes and files you choose to upload, together with their filenames, sizes and types.
• Subscription data — your current plan, and the customer and subscription identifiers issued by our payment provider.
• Technical data — server logs containing IP address, browser type and timestamps, generated automatically when you use the Service and used for security and debugging.

We do not collect special category data, and we ask that you do not upload it.

2. Why we use it, and our legal bases

• To provide the Service — storing and displaying your content, and operating your account. Legal basis: performance of a contract.
• To process subscriptions and prevent fraudulent payments. Legal basis: performance of a contract, and legitimate interests.
• To keep the Service secure, diagnose faults, and prevent abuse. Legal basis: legitimate interests.
• To send service messages about your account, such as billing or security notices. Legal basis: performance of a contract.

We do not sell your personal data, we do not use your content for advertising, and we do not use it to train machine-learning models.

3. Payments

Payments are processed by Lemon Squeezy, which acts as our Merchant of Record and is the seller of record for your purchase. Your card details are entered on and handled entirely by Lemon Squeezy and never reach our servers.

We receive only your plan, its status, and the customer and subscription identifiers needed to match a subscription to your account. Lemon Squeezy processes your data as an independent controller under its own privacy policy, which governs the billing information you provide to it.

4. Who we share data with

We share data only with the providers needed to run the Service, each under contract and only to the extent required:

• Hosting and application delivery — to serve the application.
• Database, authentication and file storage — to hold your account and your uploaded content.
• Lemon Squeezy — to take payments and manage subscriptions.

We may also disclose data where legally required, or to establish or defend legal claims.

5. Where your data is held

Your data may be processed outside your country, including in the United States and the European Union. Where data is transferred internationally we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

6. Security

Access to your projects and files is restricted to your account and enforced at the database and storage layer, not only in the interface. Files are served through short-lived signed links rather than public URLs, and traffic is encrypted in transit. No system is perfectly secure, and we cannot guarantee absolute security.

7. Retention and deletion

We keep your account data and content for as long as your account exists. Deleting a project removes it and its files. Deleting your account — which you can do yourself at any time from your settings — permanently removes your projects, notes and uploaded files. Deletion is immediate and cannot be undone.

Limited records, such as billing and tax records held by our payment provider, may be retained where law requires it.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the processing of your personal data, to object to processing carried out on the basis of legitimate interests, and to withdraw consent where processing relies on it.

You can exercise most of these directly: your name is editable, and your content and account are deletable, from your settings. For anything else contact atria.support@gmail.com. You also have the right to complain to your local data protection authority.

9. Cookies

We use only the cookies necessary to keep you signed in and to keep the Service secure. We do not use advertising or third-party tracking cookies, so no cookie consent banner is required.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact atria.support@gmail.com and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified to account holders by email or within the Service before taking effect, and the date above will be updated.

12. Contact

For any privacy question, or to exercise your rights, write to atria.support@gmail.com. Atria is established in Israel.