Privacy Policy

Atlas AI ("Atlas AI", "we", "us") operates the Atlas AI platform at www.atlasaibiz.com. For any privacy question or request, contact us at support@atlasaibiz.com.

• Account information — your name, email address, phone number and password credentials, provided when you create an account.
• Business information — the business, branch, location, category, website and keyword details you enter during onboarding or in the application.
• Google Business Profile data — described in section 3 below, accessed only after you explicitly connect a Google account.
• Billing information — subscription status, plan, invoices and payment identifiers. Card and UPI details are handled by our payment processor and are not collected or stored by Atlas AI.
• Usage and marketing attribution — basic campaign parameters (such as UTM values) stored in your browser, and in-application activity records used to operate features such as notifications and reporting.

Atlas AI accesses Google user data only when you choose to connect a Google account and grant consent through Google's own OAuth consent screen.

Scopes we request

• https://www.googleapis.com/auth/business.manage — to read your Google Business Profile locations, profile details, reviews and posts, and to publish replies and posts that you approve.
• openid and email — to identify which Google account is connected.

How we use this data

• Displaying your Google Business Profile locations, profile details and profile health inside your Atlas AI workspace.
• Showing your reviews and helping you draft and publish replies that you approve.
• Creating, scheduling and publishing Google Posts that you approve.
• Producing the performance, SEO and reputation reporting you see in the dashboard.

Storage and security of Google data

• Your Google authorization is completed using OAuth 2.0 with PKCE (S256). The code verifier never leaves our server, and the OAuth state value is stored only as a one-way SHA-256 hash.
• Google access and refresh tokens are encrypted with AES-GCM using a server-side key before they are written to our database. They are stored as ciphertext with a separate initialisation vector and authentication tag, are never stored in plain text, and are never sent to your browser.
• Google API calls are made from our server. The Google client secret, redirect URI and encryption key exist only in server-side configuration and are excluded from the code delivered to browsers.
• Google-derived records, such as your linked locations and profile details, are stored in our database under your account and protected by database-level Row Level Security so that only members of your account can read them.

Limited Use

Atlas AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not sell Google user data, we do not use it for advertising, and we do not use it to train generalized artificial intelligence or machine learning models. We use it only to provide and improve the user-facing features described above.

Revoking access and deletion

• You can disconnect your Google account at any time from Settings → Integrations in Atlas AI. When you do, we attempt to revoke the token with Google and remove the stored connection and its encrypted tokens from our database.
• You can also revoke Atlas AI's access directly from your Google Account permissions page at myaccount.google.com/permissions.
• To request deletion of your Atlas AI account and its associated Google-derived data, email support@atlasaibiz.com.

Some Atlas AI features generate suggested content. When you use AI review replies or AI post generation, the relevant text — such as the review content and your business details — is sent to a third-party AI model provider through the Lovable AI gateway (currently a Google Gemini model) so that a draft can be returned to you. Drafts are suggestions; they are published to Google only when you approve them or when you have explicitly enabled an automation rule. We do not use Google user data to train generalized AI models.

• Google — Google Business Profile APIs, used as described above.
• Our application and database hosting providers, which store your account and business data.
• Razorpay — payment processing for subscriptions. Payment instrument details are handled by Razorpay, not by Atlas AI.
• DataForSEO — used to retrieve keyword ranking and local search visibility data for the keywords and locations you configure.
• Messaging and email providers — used to send review requests and service emails where you have configured or enabled them.

We do not sell your personal information or your Google user data. We share data with these providers only to the extent required to deliver the service you have asked for.

• Row Level Security is enabled on every application table in our database, and access policies restrict records to the account and branches you belong to.
• Google OAuth tokens are encrypted at the application level with AES-GCM, as described in section 3.
• Secrets such as API keys and encryption keys are held in server-side configuration and are not included in browser code.
• Access to features is checked on the server based on your role and account membership, not only in the interface.
• All traffic to www.atlasaibiz.com is served over HTTPS.

No system can be guaranteed to be completely secure. We describe here the controls that are actually implemented; we make no certification, audit or compliance claims beyond them.

We retain your account and business data for as long as your account is active, and for as long as needed to meet legal, tax and accounting obligations relating to your subscription. When you disconnect a Google account, the stored connection and its encrypted tokens are removed. When you ask us to delete your account, we delete or anonymise the associated data except where retention is legally required.

• Access and correct your account, business and branch details from within the application.
• Disconnect your Google account at any time from Settings → Integrations.
• Turn off automation features, such as automatic replies or scheduled posts, in their settings.
• Request a copy of, correction to, or deletion of your data by emailing support@atlasaibiz.com.

Atlas AI is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under the age of 18.

We may update this policy as the product changes. When we do, we will update the "last updated" date at the top of this page. Material changes affecting how Google user data is handled will be reflected here before they take effect.

Questions about this policy or your data? Email support@atlasaibiz.com.