Privacy Policy

ATOM SCALE handles two different categories of data, and they work differently under this policy:

• Account data — information about the people who actually sign in and use ATOM SCALE: your work email, password, business name, role, and how you use the product. We are directly responsible for this data, as a data controller.
• Business data— the operational information a business enters to run its own operations: its customers' names and phone numbers, staff records, orders, deliveries, credit balances, uploaded photos and documents, and similar records. This data belongs to the business using ATOM SCALE. We process it on that business's instructions, as a data processor — the business itself is responsible for having a lawful basis to collect it from its own customers and staff.

If you're an employee, customer, or contact of a business that uses ATOM SCALE, and you have a question about your own data, your first point of contact is that business — we don't have a direct relationship with you and can't act on our own authority to change records that belong to their account.

We collect the following, concretely — not "usage data" in the abstract:

• To create and run your account: email address, password (stored hashed, never in plain text), business name, your role and position, and team members you invite.
• Records you or your team enter: customer names, contact details, and locations; product catalogs and pricing; orders and sales; delivery and driver assignments; credit balances and payment history; purchasing and inventory records; and, depending on which modules your business uses, consultation notes, measurements, land or property documents, and similar records specific to your industry.
• Files you upload: job photos, receipts, and documents attached to the records above.
• An activity log:who created or changed a given record, and when — this exists so an admin can see what happened in their own account; it doesn't leave that account.
• Technical data: IP address, browser and device type, and pages visited, collected automatically when you use the site.

We do not collect payment card numbers, government ID numbers, or biometric data ourselves. Where a business records a customer's measurements for its own operational use (for example, in the tailoring module), that's business data under Section 1 — entered and controlled by that business, not by us.

ATOM SCALE's Purchasing module analyzes a business's own historical purchase volume and current stock to recommend how much of a product to reorder. To be specific about what this is and isn't:

• It's a statistical calculation over a business's own numbers — not a conversational AI, chatbot, or assistant.
• It only ever looks at product and order volumes. It doesn't use anyone's personal data, and it doesn't score, rank, or make any decision about an individual person.
• Every recommendation is a suggestion. A human reviews it and decides whether to place an order — nothing is purchased or acted on automatically.

We don't currently offer a generative-AI or chat feature anywhere in the product. If that changes, we'll update this section — including how it works, what data it uses, and how it responds if a conversation touches on self-harm or a similar safety concern — before it ships, not after.

• To provide, maintain, and secure the platform itself.
• To authenticate you, keep your session working, and send account-related messages — password resets, invites, and similar notices.
• To generate the reports, dashboards, and recommendations a business asks the product to compute from its own data.
• To fix bugs, understand how features are used in aggregate, and improve the product.
• To meet legal, tax, and accounting obligations.

We do not sell personal data or business data, and we do not use business data to train any model shared across other customers' accounts.

We share data with a short list of infrastructure providers who process it on our behalf, under their own confidentiality and security obligations — never with data brokers or advertisers:

• Supabase — our database, authentication, and file storage provider. Every uploaded file is stored in a private bucket; nothing is publicly readable by default.
• Resend — delivers transactional email (password resets, invites, renewal reminders) from updates.atomhq.work.
• Vercel — hosts the application and serves its pages.
• Analytics providers(e.g. Google Analytics) — planned for the marketing site at atomhq.work, to understand aggregate traffic. We'll update this section when that goes live.

We may also disclose data if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of ATOM SCALE, our customers, or the public.

We use a session cookie to keep you signed in — that's the only cookie required for the app to work. Your theme preference (light/dark) is saved in your browser's local storage, not sent to us. Once analytics is added to the marketing site, it will set its own cookie, disclosed at that time.

We keep account and business data for as long as a business's account is active, plus a reasonable period after closure for legal, tax, and dispute purposes.

Most records in ATOM SCALE (products, customers, staff) are deactivated rather than permanently deleted when removed — this is deliberate: financial and stock records reference them, and erasing a record mid-history would break the audit trail those numbers depend on. Deactivated records stop appearing in day-to-day use but remain in the account's own history.

Uploaded files are different — where an in-app delete control exists, deleting the record permanently removes the underlying file from storage, not just the reference to it. We're still closing this out consistently across every module that accepts uploads; where a delete control doesn't exist yet, contact us and we'll remove the file by hand.

To close an account entirely or request deletion of your own account data, contact us at the address in Section 13.

• Every file upload is stored in a private bucket — never a public one — and is only ever accessible through a short-lived, permission-checked link generated at the moment you view it.
• Access to a business's data is scoped by row-level security tied to that business's own account — one business's data is never visible to another's.
• Passwords are hashed, never stored or logged in plain text.

No system is perfectly secure, and we can't guarantee data will never be exposed by circumstances outside our control — but we design for the assumption that it must not be reachable by default, and treat any gap from that as something to fix immediately.

Subject to applicable law — including Nigeria's Data Protection Act 2023 for users in Nigeria, and equivalent protections elsewhere — you can ask us to:

• Tell you what data we hold about you.
• Correct inaccurate data.
• Delete your account data, subject to Section 7.
• Export your data in a portable format.

If your data was entered into ATOM SCALE by a business you're a customer, contact, or employee of, we'll generally direct that request to them first, since they control that record — see Section 1.

ATOM SCALE is built for businesses operating in Nigeria and across Africa, and our infrastructure providers may process and store data outside the country you're in. Where that happens, we rely on those providers' own safeguards for cross-border transfer.

ATOM SCALE is business software, not directed at children. We don't knowingly collect data from anyone under 18. If you believe a child's data has reached us, contact us and we'll remove it.

If we make a material change to how we handle data, we'll update the date at the top of this page and, where the change is significant, notify account admins directly before it takes effect.

Questions about this policy, or a request under Section 9, can go to support@atomhq.work.