Privacy Policy

Atomtrix is the public brand and service name of a commerce intelligence platform. Our website is https://atomtrix.com and this notice is available at https://atomtrix.com/privacy. For privacy questions and requests, contact info@atomtrix.com.

The legal entity operating Atomtrix has not yet been confirmed. This draft does not identify a legal controller or publish a registered street address. The legal operator and any legally required representative or data protection contact must be confirmed before finalizing the notice.

For account administration, service security and our own business operations, the Atomtrix operator acts as a data controller. When a business customer supplies personal data through its workspace, Atomtrix generally processes that data on the customer’s instructions as a processor. The customer remains responsible for its lawful basis and notices to its customers and staff. Owner confirmation required: validate these roles and the applicable data processing agreement.

Registration collects an email address and password, with email confirmation handled through Supabase Authentication. The service processes account and session identifiers, optional profile display names, workspace names, membership roles and invitation email addresses. Subscription management uses billing and subscription references and status. Support messages include the information you choose to send.

Imports and connected platforms may supply order and refund records, products, inventory, prices, customer or retailer identifiers, advertising account and campaign identifiers, performance metrics, and associated currencies, timestamps and source information. The exact fields depend on the integration, permissions and selections you authorize. Please provide only data needed for your business use and avoid unnecessary sensitive personal information.

Operational records include connection status, import and synchronization outcomes, audit events and Slack delivery metadata. Any additional onboarding fields, production logs and special-category processing require owner review.

The repository contains connectors for Google Sheets, Google Analytics 4, WooCommerce, Centra Ecommerce and Wholesale, Squarespace Commerce, Shopify and PayPal Zettle, plus Google Ads, Meta (Facebook and Instagram Ads), Pinterest Ads, TikTok Ads and Snapchat Ads. Customers choose the accounts and sources to authorize. Implemented code does not establish external API approval, live merchant verification or availability to every workspace. Other names in the connection catalog may be placeholders.

Google Sheets reads selected worksheets for imports and manual resynchronization; GA4 reads analytics reports. Commerce connectors read supported orders or sales, products, inventory and refunds, with provider-specific limitations. Advertising connectors primarily read reporting data rather than manage campaigns. Available metrics and attributed values vary by provider; missing values remain missing. Attributed advertising revenue is separate from actual commerce revenue. Meta separates Facebook and Instagram using publisher placement.

Slack is a reporting and notification destination. If authorized, Atomtrix sends selected reports and notifications to channels you configure; it is not an advertising data source. Reports may contain workspace business information visible to members of the chosen Slack channel. Review channel membership and report contents before enabling delivery.

Authorized workspace administrators manage connections and account selections; other workspace roles have access according to their permissions. You can disconnect an integration in Atomtrix and revoke authorization in the provider’s settings. Disconnecting stops future use of that connection; it does not automatically erase previously imported records or reports already delivered to Slack. Request deletion separately. Each provider also processes data under its own privacy notice.

OAuth authorization lets providers issue access or refresh tokens without requiring you to share the provider password with Atomtrix. Some commerce integrations use API credentials instead. Credentials and tokens are handled server-side and stored encrypted using the connector infrastructure. Tokens may expire, be refreshed where supported, or require renewed authorization.

The connector code encrypts stored credentials with AES-256-GCM and binds encrypted values to workspace and provider context. Server authorization and Supabase row-level security restrict workspace data. Owners and Admins manage integrations; Members synchronize where permitted, and Viewers have read-only access. These controls do not replace operational protection of encryption keys, privileged service credentials and administrator access.

Operational key rotation, access review, incident handling, monitoring and backup protections remain subject to owner review. No certification or compliance guarantee is claimed.

Where the GDPR applies, we identify a lawful basis for each controller processing purpose. Providing and administering a requested account or service may be necessary to perform a contract with you (Article 6(1)(b)). For business users acting on behalf of an organization, service administration and support may instead rely on legitimate interests (Article 6(1)(f)), subject to a balancing assessment.

Protecting the service, preventing abuse and maintaining reliability may rely on legitimate interests. Keeping records required by applicable law relies on legal obligation (Article 6(1)(c)). Optional marketing and non-essential cookies or analytics rely on consent (Article 6(1)(a)) where required; consent can be withdrawn without affecting prior lawful processing.

For workspace data processed on a customer’s behalf, the customer determines the lawful basis and Atomtrix follows the agreed processing instructions. Authorizing an integration is a technical permission and is not, by itself, consent on behalf of everyone whose personal data appears in that source.

Owner confirmation required: approve the purpose-by-purpose lawful basis assessment, legitimate interest assessments and any consent mechanisms before publication.

The implementation uses Vercel for application hosting, Supabase for database and authentication services, and Stripe for membership checkout and subscription management. Stripe checkout handles payment entry; Atomtrix stores customer and subscription references and billing status. Connected platforms supply authorized data and Slack receives configured reports and notifications. The full deployed provider inventory and contractual roles require owner confirmation.

Personal data may be processed outside your country depending on the configured services and connected platforms. Where GDPR transfer rules apply, an appropriate transfer mechanism and any required supplementary measures must be assessed and documented; this policy does not assert that a particular safeguard or hosting region has been verified.

Owner confirmation required: confirm the operator’s current provider and subprocessor list, processing and backup locations, contracts, international transfer mechanisms (including any applicable standard contractual clauses or adequacy decisions), and how customers can obtain details.

No general retention schedule has been verified. The Slack scheduler includes cleanup of terminal delivery records older than 90 days when scheduling runs; this is a code-level rule, not a guaranteed deletion deadline. OAuth state records expire and are cleaned by connector routines. Account data, imported records, audit history and backups have no verified universal deletion schedule.

Send deletion or privacy requests to info@atomtrix.com. The inspected account interface does not offer self-service account deletion, and this notice does not promise automated deletion. Requests require operational review and may require identity or authority verification. For data in a business customer’s workspace, contact that business first; Atomtrix can assist subject to its instructions and applicable obligations.

Disconnection differs from account deletion. Google and Slack disconnect routines remove stored credentials; Slack also removes delivery preferences and cancels pending deliveries. Previously imported commerce and advertising records, historical delivery metadata and messages already posted to Slack are not automatically erased. Provider access can also be revoked in the provider’s settings.

Retention for other records, manual deletion procedures, backup expiry and legally required retention remain unconfirmed.

Where applicable, you may request access to your personal data, correction, erasure, restriction of processing or data portability, and object to processing based on legitimate interests, including direct marketing. You may withdraw consent at any time where processing relies on consent. Rights are subject to the conditions and exceptions in applicable law.

To exercise applicable rights, email info@atomtrix.com. Requests for customer-controlled workspace data may need to be directed to that customer. You may complain to a competent supervisory authority, including where you live or work or where an alleged infringement occurred.

The operator must confirm the rights request procedure and any applicable supervisory authority or representative. No jurisdiction is assumed.

The application uses host-only authentication cookies configured as HttpOnly, SameSite=Lax and Secure for HTTPS or production. Sessions are not shared with the public marketing deployment. Workspace selection and OAuth authorization also use necessary cookies.

No website analytics SDK, advertising tracking script or non-essential cookie-consent interface was found in the inspected application and marketing code. This is a repository finding, not an audit of deployed headers, provider telemetry or scripts injected outside the repository. Customer-connected GA4 reporting is separate from visitor tracking on Atomtrix.

The owner must confirm the deployed cookie and storage inventory, durations, platform-level telemetry and any consent requirements. Before introducing optional tracking, assess notice and consent controls. Browser storage restrictions can affect essential account functions.

We may update this notice when the service or processing practices change. The published notice should show its effective date and explain material changes where appropriate.

Contact info@atomtrix.com with privacy questions or requests. The legal operator’s identity, effective date and outstanding legal and operational assessments remain unconfirmed. This page remains a draft until mandatory details are resolved.