Privacy Policy

Effective August 19, 2026

This Privacy Policy explains what information Atlaro ("we," "us," or "our," operated by Jessica Pelletier) collects when you use Atlaro (the "Service"), why we collect it, and how you can control it. It applies to everyone who uses the Service — workers and admins alike.

1. Information We Collect

We collect information in three ways: what you give us directly, what your organisation enters about its own work, and a small amount collected automatically.

Account information

• Name and email address, provided at signup or invite;
• Password (we never see it in plain text — it is hashed and managed by our authentication provider, Supabase);
• Profile photo, if you choose to upload one.

Organisation and job data

Once you or your organisation start using Atlaro, we store the data you enter to run the product: organisation name and trade, job details (including, if you choose to enter them, a client's name, phone number, and billing address), job categories, time entries, notes, and job photos. This data belongs to your organisation — see Section 5 of our Terms of Service for how we handle it.

Payment information

If you subscribe to a paid plan, payment is handled entirely by our payment processor, Stripe. We never receive or store your full card number — Stripe shares with us only what we need to manage your subscription (for example, the last four digits of your card and your billing status).

Information collected automatically

We use a small, essential authentication cookie to keep you signed in. We also use Vercel Analytics for basic, privacy-respecting usage statistics (such as which pages are visited) — it does not use cookies and does not track you individually across sites.

2. How We Use Information

• To provide and operate the Service — your account, your organisation's jobs, time tracking, and team features;
• To process payments and manage subscriptions;
• To send transactional emails — account verification, sign-in links, team invites, and important notices about your account. We do not send marketing email without your consent;
• To maintain the security and integrity of the Service;
• To understand overall product usage so we can improve Atlaro.

We do not sell your personal information, and we do not use your data to train third-party AI models.

3. Who We Share Information With

We share information only with the service providers we rely on to run Atlaro (our "sub-processors"), and only as needed to provide the Service:

• Supabase — database, authentication, and file storage;
• Stripe — payment processing and subscription billing;
• Resend — transactional email delivery;
• Vercel — application hosting and privacy-respecting analytics.

Within your own organisation, other admins and workers can see the data relevant to their role, as described in the app (for example, admins see all jobs and team timesheets; workers see their own entries and the jobs they're assigned to). We do not share your data with other organisations you're not a member of, or with any third party for their own marketing purposes. We may disclose information if required by law, or to protect the rights, safety, or property of Atlaro or others.

Some of these providers may process data on servers located outside Canada (including in the United States). By using the Service, you consent to this transfer.

4. Data Retention

We keep your data for as long as your account or organisation is active. Some records — like time entries and notes — use "soft deletion," meaning a deleted item is hidden from the app but kept briefly for audit purposes before permanent removal. If an organisation admin deletes the organisation, all of that organisation's data is permanently and immediately removed and cannot be recovered.

5. Your Rights

You can review and update most of your account information directly in the app (name, password, profile photo). For anything else — accessing a copy of your data, correcting it, or requesting deletion of your account — email us at hello@atlaro.appand we'll take care of it directly. If you're a worker and want your data removed from an organisation, note that job and time-entry records may need to be retained by the organisation's admin for their own business and accounting purposes.

6. Security

We use industry-standard measures to protect your data, including encryption in transit, database-level access controls that restrict data to your own organisation, and secure authentication. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable steps to protect your information and will notify you if we become aware of a breach affecting your data, as required by law.

7. Children's Privacy

Atlaro is intended for business use by adults. It is not directed at children, and we do not knowingly collect information from anyone under 18.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you (for example, by email or an in-app notice) before they take effect.

9. Contact

Questions about this Privacy Policy or your data? Email hello@atlaro.app.