Privacy Policy

AtlasBrokers ("we", "us", or "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform, including the AtlasBrokers website, workspace tools, AI-powered features, and related services (collectively, the "Service"). By using the Service, you consent to the practices described in this policy. We operate under Canadian federal and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

We collect the following categories of information:

• Account Information — Name, email address, password (hashed), and profile details you provide when creating an account.
• Workspace Data — CRM contacts, leads, deals, documents, campaigns, and other business data you store within your workspace.
• Usage Information — Pages visited, features used, timestamps, interactions with AI agents, and workflow activity logs.
• Device & Technical Data — IP address, browser type, operating system, device identifiers, and referral URLs.
• Cookies & Tracking — We use essential cookies for authentication and session management. Analytics cookies help us understand usage patterns (see Cookies section).

We use the information we collect for the following purposes:

• Provide & Improve the Service — To operate, maintain, and enhance the AtlasBrokers platform, including workspace tools, CRM, and analytics.
• Process Transactions — To process subscription payments, manage billing, and issue invoices through our payment processor (Stripe).
• Communications — To send transactional emails (password resets, billing receipts), product updates, and optional marketing communications you can opt out of.
• Personalization — To customize your experience, including AI-generated recommendations, workspace defaults, and dashboard layouts.
• AI Features — To power AI agents, predictive analytics, lead scoring, email drafting, and other AI-assisted features within your workspace.
• Analytics & Research — To analyze usage patterns, generate aggregate insights, and improve our product. All analytics data is anonymized.

AtlasBrokers uses artificial intelligence to enhance your workflow. Here is how your data is handled in the context of AI:

• AI processing is scoped to your workspace data only. AI agents cannot access data from other workspaces or users.
• Your data is never used to train our AI models. AI features operate using your workspace data in real-time and do not retain data after processing.
• AI-generated outputs (email drafts, lead scores, analytics) are produced in real-time and stored within your workspace under your control.
• You can disable AI features at any time from your workspace settings. Disabling AI does not affect your existing data.

We do not sell your personal information. We may share data in the following limited circumstances:

• Service Providers — We share data with trusted third-party providers who help us operate the Service (e.g., Stripe for payments, Neon for database hosting, Resend for email delivery). These providers are contractually required to protect your data.
• Legal Requirements — We may disclose data if required by law, regulation, legal process, or government request, including to comply with Canadian privacy laws.
• Business Transfers — In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such change.

We implement industry-standard security measures to protect your data:

• Encryption — All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Database connections use SSL.
• Regular Audits — We conduct regular security reviews, vulnerability assessments, and dependency audits.
• Access Controls — Role-based access controls (RBAC) limit data access to authorized workspace members. All access is logged.
• Infrastructure — Our infrastructure is hosted on Vercel and Neon (PostgreSQL), both of which maintain SOC 2 Type II compliance.

Under Canadian privacy law (PIPEDA) and applicable provincial legislation, you have the following rights:

• Access — Request a copy of the personal information we hold about you.
• Correction — Request correction of inaccurate or incomplete personal information.
• Deletion — Request deletion of your personal information, subject to legal retention requirements.
• Data Export — Export your workspace data at any time from your workspace settings.
• Opt-Out — Opt out of marketing communications at any time by clicking the unsubscribe link or updating your notification preferences.
• Canadian Residents — Canadian residents have additional rights under PIPEDA, including the right to challenge compliance and file a complaint with the Office of the Privacy Commissioner of Canada.

We retain your data only as long as necessary to provide the Service and fulfill our obligations:

• Account Data — Retained for as long as your account is active. You can delete your account at any time.
• After Deletion — When you delete your account, we remove your personal data within 30 days. Some data may be retained longer for legal or compliance purposes.
• Backups — Encrypted backups are retained for up to 90 days for disaster recovery purposes, after which they are permanently deleted.
• Audit Logs — Security and audit logs are retained for 12 months and then automatically purged.

We use cookies and similar technologies for the following purposes:

• Essential Cookies — Required for authentication, session management, and security. These cannot be disabled.
• Analytics Cookies — Used to understand how users interact with the Service (e.g., PostHog). These are anonymized and do not track you across other websites.
• Managing Cookies — You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features.

AtlasBrokers is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes your acceptance of the revised policy.

If you have any questions about this Privacy Policy or your personal data, please contact us: