Privacy Policy

This policy covers Datacoves, Inc.’s use of your Personal Information collected by the Atlas application, the Atlas marketing site, and the MCP connector — together “Atlas” — operated by Datacoves, Inc. Atlas is separate from the Datacoves platform. This privacy policy only governs Atlas, and not the Datacoves platform.

Where your organization has signed a data processing agreement with us covering Atlas, that agreement controls for the data it covers, and this policy explains the same processing in plain language. For your account and identity data, Datacoves is the controller. For the content your organization puts into Atlas, your organization is the controller and Datacoves processes it on the organization's instructions, as described in our Terms.

Atlas is built and operated by Datacoves, Inc., a Delaware corporation with offices at 612 Lynwood St., Thousand Oaks, CA 91360, United States.

For Atlas privacy questions and data-subject requests, please contact privacy@datacoves.com. For Atlas product and account support, please contact support@datacoves.com.

“Personal Information” is information that uniquely identifies you or can identify you by combining it with other data. The legal name and definition of personal information differ from jurisdiction to jurisdiction, but for purposes of this Privacy Policy, we refer to that information as Personal Information. When you use Atlas, we collect the following Personal Information from you:

• Account and identity: your email address, display name, avatar, your identity provider's subject identifier, your group and role memberships, and sign-in and session records.
• Connected accounts: when you connect an account from another service to Atlas, the identifiers that service returns (such as your email address and account ID), the permissions you granted, and the credentials Atlas needs to act for you, stored encrypted.
• Audit records: who did what and when, in a tamper-evident append-only log.
• Marketing site and contact form: what you type into the form, plus ordinary server request logs.

• To provide Atlas to your organization and to authenticate you.
• To keep the service secure and available: abuse and fraud investigation, rate limiting, and incident response.
• To support you: diagnosing problems you or your admins report.
• To improve reliability and performance, from aggregated, metadata-only signals.
• To meter and bill under your order form.
• To meet legal obligations and respond to lawful requests.
• To send service notices, which we always send because they are how the service reaches you, and product email, which goes only to people who subscribe per category (with the ability to unsubscribe).

We do not use your Personal Information to train models, to build advertising profiles, or to enrich any dataset we sell.

Where the GDPR or a comparable law applies, we rely on performance of a contract (providing Atlas to your organization and to you as one of its users); legitimate interests (security, abuse prevention, reliability and metadata-only analytics); consent (optional product email, withdrawable at any time); and legal obligation (tax, accounting and lawful requests).

When you use the MCP Connector to connect an outside AI assistant, each call carries an OAuth token bound to one organization, and Atlas re-checks your permissions every time. What crosses: your search text and the governed Knowledge Base content you can already read, plus, if you approve conversation access, the assistant's question posted into an Atlas conversation. What never crosses: warehouse data, credentials, content outside your access, or any change to the knowledge itself. Atlas records that a read happened; it does not store the assistant's side of your conversation.

Atlas sets one cookie: the signed session cookie that keeps you logged in. It is strictly necessary, and there are no advertising, cross-site tracking or profiling cookies.

The Atlas marketing site currently runs no third-party analytics or advertising tags and sets no cookies of its own.

We do not sell Personal Information and do not share it for cross-context behavioral advertising, so there is no ad-tracking opt-out to offer. We honor Global Privacy Control and Do Not Track signals as a matter of course, because we do not track you across sites in the first place.

If that ever changes — for example if we start paid advertising — we will publish a cookie notice and, in the EEA, UK and Switzerland, ask for consent before setting anything non-essential.

We may share your Personal Information with our Sub-processors and other third party service providers to secure, maintain or improve Atlas or our other services. If we do so, we will only provide the information necessary for the service provider to perform the services and require the party to use the information for no other or further purposes, not to share the information, and to return or delete the information upon completion.

For the Datacoves-hosted Atlas service, these providers process Personal Information for us:

• Fly.io — application hosting, databases and isolated compute, United States.
• Amazon Web Services — file storage and AI services, such as embeddings for knowledge base search. United States.
• SendGrid — transactional email: sign-in codes, invitations and notifications.
• Sentry — scrubbed error traces and request metadata, for diagnosing failures.
• Your organization's chosen model provider — currently Anthropic or OpenAI — reached under your organization's own credential.

When you or another Authorized User asks Atlas to act in a system your organization has connected, Atlas sends that system what the action requires, under the credential supplied for it. Those systems act at your organization’s direction and under their own terms. They are not our sub-processors.

A self-hosted Atlas deployment has whatever list its operator configures, and Datacoves is not in that path at all. Where your organization has a data processing agreement with us, notice of sub-processor changes is governed by it; the current list is always available from privacy@datacoves.com.

If we are involved in a merger, acquisition, sale of assets, bankruptcy, or insolvency event, we may sell or transfer some or all of our assets, including all or a portion of your information in connection with such transaction. We will continue to ensure the confidentiality of your personal information and we will update this policy or its successor policy to reflect any changes.

We may share your information to respond to valid legal process (such as a court order or subpoena), protect the safety of any person, address suspected fraud, security, or technical issues, enforce this Privacy Policy and other terms to which you have agreed, resolve disputes and enforce our agreements with third parties, and otherwise comply with legal obligations.

We are serious about protecting the security of your Personal Information and have implemented administrative, technical, and physical safeguards to protect your Personal Information, considering the nature of the personal data and the processing, and the threats posed, but no security measures are completely secure. If you believe your Personal Information has been compromised, tell us at support@datacoves.com and we will work with you on it.

The Datacoves-hosted Atlas service runs in the United States, as do the sub-processors listed above. If you are in the EEA, the UK or Switzerland, that is an international transfer. We rely on the European Commission's standard contractual clauses, with the UK international data transfer addendum where it applies, together with supplementary technical measures — encryption in transit, encrypted credentials, and database-enforced tenant isolation — executed with your organization to transfer Personal Information from these jurisdictions to the United States.

Where data genuinely cannot leave your own boundary, Atlas can be self-hosted: your infrastructure, your model endpoint, no customer content at Datacoves. Ask us about it.

We keep account and identity data for as long as your account is active. Audit records are kept for the life of your organization's workspace, because they are the record of who agreed to what. Content your organization deletes may remain for a recovery period before it is permanently removed. Telemetry and error traces are kept for short operational windows and then expire. When an organization is erased, its data is hard-deleted, audit records included; backups roll off on their own schedule.

Depending on where you live, you may have the right to access your Personal Information, to have it corrected or deleted, to receive a portable copy, to object to or restrict certain processing, to withdraw consent, and to complain to your supervisory authority.

Send requests to privacy@datacoves.com. For workspace content we are the processor, so we will route your request to the organization that controls it and help them respond. We may need to verify your identity before acting, and we will not use what you send us for verification for anything else.

Portability is built into the product, not only into this policy: your knowledge base and artifacts export in standard, open formats. If you leave, the record leaves with you.

If you are a California resident, the California Consumer Privacy Act, as amended (“CCPA”), may apply to Personal Information we collect and process about you, including information relating to your use of Atlas.

Accordingly, to the extent applicable to our processing of your Personal Information, California employees, job applicants, independent contractors, and other California residents may exercise the rights described below, subject to applicable exceptions and limitations: the right to know, by way of this Privacy Policy and any specific inquiries you direct to us, where Personal Information we have about you comes from, what we use that information for, whether it is being disclosed or sold, and to whom it is being disclosed or sold;

1) the right to “opt-out” of Datacoves’ sale of your Personal Information to any third parties;

2) the right to request Datacoves to stop sharing your Personal Information to third parties;

3) the right, with some exceptions, to have your Personal Information deleted from Datacoves’ possession or control;

4) the right to correct inaccuracies in your Personal Information; and

5) the right to receive equal service from us even if you exercise any of your privacy rights.

CCPA Disclosures. The chart below describes the categories and sources of your Personal Information and with whom we share it.

We do not sell Personal Information, and we do not share it for cross-context behavioral advertising. We have not done either in the preceding twelve months.

For California residents, we will acknowledge requests to know, access, delete, or correct Personal Information within ten (10) business days and will respond to such requests within forty-five (45) calendar days, subject to any permitted extension of up to an additional forty-five (45) calendar days. Requests to opt out of the sale or sharing of Personal Information or to limit the use or disclosure of Sensitive Personal Information will be processed as soon as feasibly possible and no later than fifteen (15) business days after receipt, as required by applicable law.

Under California's “Shine the Light” law (Civil Code § 1798.83), we confirm that we do not disclose Personal Information to third parties for their own direct marketing.

Atlas is a workplace product. It is not directed to anyone under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us data, tell us at privacy@datacoves.com and we will delete it.

When this policy changes, we update the date at the top of the page. Your continued use of Atlas after that constitutes acceptance of the updated policy.

Privacy questions and requests: privacy@datacoves.com. Product and account support: support@datacoves.com or use the contact form.

By post: Datacoves, Inc., 612 Lynwood St., Thousand Oaks, CA 91360, United States.

If you are in the EEA, the UK or Switzerland you may also lodge a complaint with your local supervisory authority, though we would rather you gave us the chance to put it right first.