Atlas Cloud Privacy Policy and Data Retention

Effective date: October 26, 2026
Version: 1.2

1. Who we are

Atlas Cloud is the hosted line of Atlas, an engineering agent. It is run by Gradeum Technologies LLC ("Gradeum", "we"). This policy covers the Atlas Cloud web app, its API, chat, and the Atlas mailbox. Contact details are in section 13.

Atlas Cloud is a draft-support tool. Its output is marked as a draft, and engineering work is marked "DRAFT - PE Review Required". ATLAS is an AI - It can make mistakes.

2. Data we collect

• Account and sign-in. You sign in with Microsoft. We keep your Microsoft tenant and user identifiers and your email address. We do not receive your Microsoft password.
• Firm information. The firm name, the firm's administrator, and who was invited.
• Your content. Tasks, chat messages, emails sent to the Atlas mailbox, the data and method you give for a task, and the files in your firm's Atlas folder, which Atlas reads and writes. Output is written as new files. Atlas Cloud also holds a private storage container for each account.
• Memory. What Atlas remembers about a user, held in that user's private space (see section 8).
• Usage and credit records. Tasks run, credit used per task, the engineer decision log, and every model call, including chat turns. These are metered to the firm's credit.
• Payment records. Card details go to Stripe and are not held by us. We hold the billing contact and charge records.
• Operational logs. Logs hold codes, counts and technical events, not document text. They are kept no longer than 12 months.

3. How we use it

• To run your tasks and return results.
• To sign you in, keep each firm's account separate, and let administrators manage users.
• To meter usage and bill the firm's credit.
• To send transactional notices.
• To secure and debug the service.
• To meet legal duties.

We do not sell your data. We do not send marketing email from Atlas Cloud.

4. AI processing

To do a task, Atlas sends your task prompt and the work content it needs to AI models run by the providers listed in section 5.

Every model call goes through Gradeum's Microsoft Azure AI Foundry router, which uses models from American makers. Some models offered through Azure AI Foundry, including Anthropic's, are hosted by their maker outside Microsoft's own infrastructure.

Please note:

• The model makers whose models the router may use for customer tasks are Anthropic, OpenAI, Meta and xAI.
• We do not use your content to train our own models.
• Batch tasks: the provider may hold results for up to 29 days. Zero data retention is not in place for batch.
• We do not claim that AI processing happens only in American datacenters. See section 6.
• Documents and messages a customer attaches to a task are sent to the AI models in Gradeum's Azure AI Foundry to perform the task.

5. Subprocessors

We will update this list when it changes, and give notice of material changes.

6. Where data is stored

• Account, firm, task, credit and usage records: Azure Database for PostgreSQL, Central US.
• Atlas Cloud web app, API and worker (Azure Container Apps): Central US.
• Azure AI Foundry account: Central US. Its model deployments are Global Standard, which means Microsoft may process requests in any region. We do not claim US-only processing.
• Your files are kept in your firm's Atlas folder in Gradeum's Microsoft 365 and in the account's private storage container. Content Atlas needs for a task is sent to model providers.
• Per-account private storage container: Microsoft Azure; we will tell you the region on request.
• Model providers outside Azure: they may process data in any region, including outside the United States.
• Stripe: Stripe processes payment data in the United States and other countries under its own privacy terms.
• Operational log workspace: Microsoft Azure; we will tell you the region on request.

7. Retention

Current practice, from the record:

• Leaver memory: kept 30 days after a user leaves the firm. It can be transferred, for the fee shown on the price page, on the person's request. After that it is deleted.
• Batch results held by the model provider: up to 29 days.
• Payment records: kept by Stripe and by us as the law requires, and by us for seven years.

Retention periods:

• Account and firm records: kept while the account is active; deleted within 90 days after closure, except billing records kept as below.
• Content (tasks, chat, output, private storage, memory): kept while the account is active; deleted within 30 days after the account is closed, the same as the Terms section 8.
• Your Atlas folder: kept while the account is active; files over the folder's size limit are moved to the account's private storage; the folder is deleted within 30 days after the account is closed, the same as the Terms section 8.
• Operational logs: no longer than 12 months.
• Usage and credit records: seven years, for billing, tax and disputes.
• Engineer decision log: kept while the account is active and deleted with your content.
• Backups: deleted data is removed from backups within 35 days of account closure.

8. Who can see what

A user is an email address with one private space that no administrator can see. Firm and organisation spaces are nested. Administrators can see down the structure, never up. Each firm has its own account.

9. Security

We use sign-in through Microsoft, secrets held in a managed vault, and access scoped to the Atlas mailbox only. Data is encrypted in transit and at rest. Gradeum staff access customer data only where needed to run, support or secure the service. If we confirm a breach of your data, we will tell the firm's administrator without undue delay and within 72 hours of confirming it. No system is perfectly secure. We hold no security certifications and do not claim any.

10. Your rights

You can ask us to give you access to your data, export it, correct it, or delete it. A firm's administrator can make requests for the firm. We will answer within 45 days. Where a US state privacy law gives you further rights, we honour them as that law requires. You can also remove Atlas Cloud's access in your Microsoft tenant at any time.

11. Children

Atlas Cloud is for business use by adults. It is not for anyone under 18, and we do not knowingly collect their data.

12. Changes

We will post changes here with a new effective date. For material changes, we will notify firm administrators by email and in the app at least 30 days before the change takes effect.

13. Contact

privacy@gradeumtech.com
Notices are given by email to the contact address above.