Privacy policy

Last updated [[date this is published]]

This policy explains what information Atomic Lab collects, why, who helps us process it, how long we keep it, and the rights you have. We've tried to make it say exactly what the service does.

Who we are

Atomic Lab is run by [[legal name of the business]] ("we", "us"), [[postal address]]. We're the controller of the personal information described here. You can contact us about anything in this policy at [[contact email]].

What we collect, and why

Information	Why we use it	Legal basis
Your account: your email address and name.	To sign you in (by emailed link; there are no passwords), and to show your name to people you work with.	Contract
Sessions: when you signed in, and your browser's user agent.	To keep you signed in, and so you can see and sign out the devices on your account.	Contract
What you create: workspaces, boards and their history, cards, and images you upload.	To provide the service. People in your workspace, and people you share a board with, can see it.	Contract
Billing: your plan, number of seats, billing period, and Stripe's customer and subscription references.	To run paid plans. Stripe handles your card details; we never see or store them.	Contract; legal obligation (tax records)
Page views: the page (without ids, links or anything you typed), the website that sent you (its name only), campaign tags in the link, your device type and browser family.	To understand how people find and use Atomic Lab. To count unique visitors without cookies, we use a code made from your IP address and browser with a secret that changes every day, so you can't be followed from one day to the next. Your IP address isn't stored. If your browser sends Do Not Track or Global Privacy Control, no page views are recorded.	Legitimate interests
Where you came from when you signed up: the referring website and campaign tags.	To understand which channels bring people to Atomic Lab.	Legitimate interests
Activity: the days you use Atomic Lab, and when you or your workspace were last active.	To understand how the service is used, and to find unused free workspaces (see "How long we keep it").	Legitimate interests
Error reports: technical details of errors, the page they happened on, and your browser family. They don't say who you are.	To find and fix problems.	Legitimate interests

We send emails about your account and billing (sign-in links, invitations, trial and payment notices). We don't send marketing emails, show adverts, sell your information, or use third-party analytics.

Boards made without an account are saved only in your browser. They aren't sent to us unless you sign up and choose to move them into your account.

Cookies and browser storage

We use one cookie, sid, which keeps you signed in. It's strictly necessary, so it doesn't need your consent. Atomic Lab also keeps a few preferences in your browser's storage (such as the workspace you last used) and, if you draw without an account, your boards. There are no advertising or tracking cookies, and no third-party scripts.

Who helps us

These companies process information for us, under contracts that require them to protect it and use it only to provide their service:

[[hosting provider]] runs our servers, in [[country where the servers are]].
Stripe processes payments for paid plans. See Stripe's privacy policy.
Resend sends our emails.

Some of these providers process information outside the UK. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum.

We may also disclose information if the law requires it, or to protect people or the service from harm.

How long we keep it

Your account and what you create	Until you delete them, or your account
Free workspaces nobody has used	Deleted after 365 days unused. Members are emailed 30 and 7 days before, and signing in keeps it.
Deleted boards	30 days in the workspace's trash, then deleted
Page views	13 months
Error reports	90 days
Database backups	30 days, so deleted information lingers in backups for up to 30 days
Billing records	As long as the law requires (normally 6 years)

Your rights

You can:

see and copy your information: download it from your account page, or ask us;
correct it: change your name and email on your account page;
delete it: delete your account from your account page, or ask us;
object to or restrict how we use it, where we rely on legitimate interests;
complain to the Information Commissioner's Office, at ico.org.uk. We'd appreciate the chance to put things right first.

To exercise any of these, email [[contact email]]. We'll reply within a month.

Keeping it safe

Everything travels over HTTPS. We store only hashes of sign-in links and session codes, so they're useless if copied from our database. Access to the servers is restricted, and the database is backed up daily.

Children

Atomic Lab isn't meant for children under 13, and we don't knowingly collect their information.

Changes to this policy

If we change this policy, we'll update this page. If a change matters, we'll email account holders before it takes effect.