Skip to content
Atlaso

Privacy Policy

Last updated: 2026-07-25

This policy explains what Atlaso collects, why, and who processes it on our behalf. The Service is operated from the United Kingdom, and BC-TECH LONDON LTD (registered in England and Wales, company no. 09652493), 10 Watsons House, 120 Nutall Street, London, N1 5LL, United Kingdom is the data controller for the personal data described here. Reach us through our contact page for any request under this policy. We aim to collect as little personal data as possible and we do not sell it.

What we collect

Account data: your email address, an optional name, and authentication records (a hashed password: email and password is the only way to sign in). Product data: the apps, storefronts, and keywords you choose to track, so we can build your history. Newsletter data: your email address, if you are on the monthly newsletter list. Payment data: when you start a subscription or trial, we store a Stripe customer and subscription identifier and your plan status; your card details are handled entirely by Stripe and we never see or store your card number. Checkout also collects the billing address we need to work out the right sales tax, and a VAT or tax registration number if you enter one. Both are held by Stripe against your customer record, not in our own database, and they appear on the invoices we are required to keep. Messages you send us: if you use the contact form, the name, email, and message you submit, which reach us as an email. Technical data: your IP address and basic request metadata, used to rate-limit public forms, detect abuse, and diagnose errors. We do not build advertising or behavioural profiles.

How we use it, and on what basis

Under UK GDPR our legal bases are:

  • Contract: operating the Service, authenticating you, building your rank and keyword history, processing subscriptions and payments, and emailing you about your account or its security.
  • Legitimate interests: keeping the Service secure and available, preventing abuse, understanding aggregate usage so we can improve the product, and sending account holders our own monthly product newsletter (every issue carries a one-click unsubscribe, and unsubscribing does not affect your account).
  • Consent: the newsletter, where you subscribed from a signup form rather than by opening an account. Withdraw it at any time from any newsletter email.
  • Legal obligation: keeping the accounting and tax records we are required to keep.

Chart, review, and keyword data is sourced from Apple's endpoints and describes apps, not you. It is not your personal data.

AI features

Some optional features (review-insight summaries and keyword assistance) send text to a large-language-model provider (Groq, or a model routed through the Vercel AI Gateway) to produce a summary. What we send is public App Store review text and the keywords or app names being analysed; we do not send your name, email, or account identifiers, and we select providers whose API terms exclude training on submitted content.

Processors we rely on

We share the minimum necessary data with a small set of service providers who process it on our behalf: Turso (database hosting for your account and tracking data), Vercel (application hosting, plus privacy-friendly aggregate analytics and performance metrics), Stripe (payment processing), Resend (transactional and newsletter email), Sentry (server-side error monitoring), Groq / the Vercel AI Gateway (the optional AI features above). We do not sell your data or share it for advertising.

Some of these providers process data outside the UK, including in the United States. Where that happens we rely on the transfer safeguards in their data-processing terms (the UK International Data Transfer Addendum, or EU standard contractual clauses).

Cookies

We use a first-party session cookie to keep you signed in. Vercel Analytics and Speed Insights collect aggregate, cookieless usage and performance data. We do not use third-party advertising or cross-site tracking cookies.

Retention

We keep your account and tracking data for as long as your account is active, and delete it within 30 days of you closing your account, except records we must keep for legal or accounting reasons (subscription and payment records, kept for six years). Newsletter subscriptions are kept until you unsubscribe. Contact-form messages reach us as email and are kept as long as needed to deal with your query. Rate-limiting records hold an IP-derived key for hours, not days, and are pruned automatically. Chart, rank, and keyword history about apps is not personal data and is retained on its own schedule.

Your rights

Under UK GDPR you have the right to access, correct, export, delete, or restrict your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. Use our contact page and we will respond within one month. If you are not satisfied with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Children

Atlaso is a tool for app developers and publishers. It is not directed at children and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this policy from time to time. The “last updated” date above always reflects the current version, and we will email account holders before a material change takes effect.

Contact

Privacy questions or requests? Contact us.