Privacy Policy

Version 1.0 | Effective 21 Nov 2024 | Last Reviewed 11 Apr 2025 | Prepared by Privacy & Compliance Office, AtomLeap.ai

Welcome to AtomLeap.ai ("we", "us", "our"). We value your trust and are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. It also outlines your rights and how you can exercise them.

We adhere to applicable data protection laws, including the Indian Digital Personal Data Protection Act (DPDPA), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), UK GDPR and other relevant global privacy regulations.

This Privacy Policy applies to all personal data collected through:

• Our website (atomleap.ai)
• Subdomains (e.g., collapse.atomleap.ai, connect.atomleap.ai, ask.atomleap.ai, blog.atomleap.ai, hrms.atomleap.ai)
• Web and mobile applications
• APIs and integrations
• Our social media channels
• Email communications and newsletter signups
• Customer support and live chat tools
• Events, webinars, and offline interactions

This policy applies regardless of the platform or device used to access our services.

• Personal Data: Any information relating to an identified or identifiable person.
• Processing: Any operation performed on personal data, such as collection, storage, use, modification, or deletion.
• Data Controller: The entity determining the purposes and means of processing personal data.
• Data Subject: The individual to whom the personal data relates.
• Processor: A third party processing personal data on behalf of AtomLeap.ai.
• Third Country: Any country outside the European Economic Area (EEA) or jurisdictions with adequacy decisions.
• Profiling: Automated processing of personal data to evaluate personal aspects related to an individual.
• Consent: Any freely given, specific, informed, and unambiguous indication of a user’s wishes.

• Full name, contact number, and email address
• Username and encrypted password
• Company name, designation, and industry
• Invoices, billing address, and payment information
• Job applications and resumes (for recruitment)
• Feedback, inquiries, and support tickets

• IP address and geolocation
• Browser type, version, and settings
• Operating system and device identifiers
• Pages viewed, time spent, and actions taken
• Referral sources (how you arrived at the site)
• Language settings and time zone

• Social login integrations (Google, LinkedIn)
• Public sources like LinkedIn or company websites
• Marketing affiliates and lead generation services
• Data enrichment providers (firmographic data)

We never knowingly collect special categories of data (e.g., biometric, health, political opinions) unless legally required.

We only process personal data where a lawful basis exists. Our processing purposes and legal bases include:

Where consent is the basis, users may withdraw consent at any time without affecting prior processing.

We use your information to:

• Register, verify, and manage user accounts
• Provide access to services and features
• Send important service announcements and legal notices
• Deliver newsletters and event updates (with opt-in)
• Provide chat, ticket, and email-based support
• Prevent fraudulent behavior and protect platform integrity
• Analyze user behavior for UX and product improvements
• Monitor system performance and fix bugs
• Personalize content, interfaces, or recommendations

We use cookies, pixels, and scripts to:

• Authenticate user sessions
• Track website usage and metrics
• Store user preferences and themes
• Deliver remarketing/retargeting ads

Refer to our Cookies Policy for details on categories, purposes, duration, and opt-out mechanisms.

We may share your data with:

• Hosting providers (e.g., AWS, DigitalOcean)
• CRM and email providers (e.g., Mailchimp, Brevo)
• Payment gateways (e.g., Razorpay, Stripe)
• Analytics and monitoring tools (e.g., Google Analytics, Sentry)
• Legal or compliance consultants
• Government agencies (only under lawful requests)

We perform due diligence and sign Data Processing Agreements (DPAs) with all third parties.

We never sell personal data to third parties.

Where we transfer data outside the EEA or UK:

• We use Standard Contractual Clauses (SCCs) approved by the EU Commission
• We assess destination countries for adequacy and vendor privacy posture
• We implement encryption and access control on exported data

Transfers to India, the United States, or other third countries comply with applicable cross-border data frameworks.

We retain personal data only as long as necessary:

• User account data: For the duration of your active relationship with us
• Support and ticketing data: 3 years after last interaction
• Payment and invoicing records: 7 years (legal obligation)
• Email marketing consent: Until withdrawn or inactive for 12 months
• Cookies and analytics data: As defined in our Cookies Policy

Users may request deletion or anonymization at any time (subject to legal exceptions).

You have rights under GDPR, CCPA, and other laws:

• Access: Request copies of personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of data, subject to exemptions
• Restriction: Request to limit processing in certain situations
• Portability: Request transfer of data to another service
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Revoke previously granted permissions
• Lodge Complaint: File a complaint with a local data protection authority

To exercise any of the above rights, email us at: privacy@atomleap.ai

We implement multiple layers of data security:

• HTTPS enforced for all communications
• AES-256 encryption for data at rest
• Periodic penetration testing and vulnerability scans
• Secure password hashing (bcrypt/argon2)
• Daily database backups and integrity checks
• Staff access control based on roles and responsibilities
• Continuous monitoring and alerting for anomalies

We follow the principle of least privilege and maintain incident response protocols.

In the event of a data breach:

• We will assess scope and risk to affected individuals
• Notify affected users and authorities within 72 hours (as per GDPR)
• Take containment, mitigation, and recovery actions

You will be informed if your data is involved and steps to protect yourself.

AtomLeap.ai does not target users under the age of 16. We do not knowingly collect data from children. If we become aware that personal data of a minor has been collected inadvertently, we will delete it promptly.

We may use automated tools for:

• Email engagement scoring
• Website behavior segmentation
• Marketing personalization

These activities do not involve automated decisions that produce legal effects or similarly significant consequences.

Our platform may include links to third-party sites (e.g., YouTube, LinkedIn, Calendly). We are not responsible for their content, terms, or privacy practices. Users are advised to read the privacy notices of those sites.

We may update this Privacy Policy due to:

• New regulations or court decisions
• Expansion of services
• Introduction of new technologies or tracking mechanisms

When changes occur:

• We will revise the "Effective Date" at the top
• Significant changes will be communicated via email or in-app notices

For any questions, requests, or complaints:

Data Protection Officer

AtomLeap.ai Email: privacy@atomleap.ai

Subject line: "Privacy Policy Inquiry"

We aim to respond within 7–10 business days.

Each processor has been assessed for compliance with applicable laws and bound by Data Processing Agreements (DPAs) wherever applicable.

This Privacy Policy is aligned with the following legal and regulatory frameworks:

• Section 4: Consent-based processing
• Section 7: Legitimate uses
• Section 9: Personal data protection duties of data fiduciaries
• Section 14: Rights of data principals
• Section 25: Cross-border transfers
• Section 27-30: Penalties and redress mechanisms

• Article 5: Principles relating to processing of personal data
• Article 6: Lawfulness of processing
• Article 7: Conditions for consent
• Article 12-23: Rights of the data subject
• Article 32: Security of processing
• Article 33-34: Notification of a personal data breach
• Article 44-49: International data transfers

• Mirrors the principles and rights set out in the EU GDPR
• Enforced by the UK Information Commissioner’s Office (ICO)

• Section 1798.100: Consumer rights to know
• Section 1798.105: Right to delete
• Section 1798.120: Right to opt out of sale
• Section 1798.130: Notice requirements and methods for consumers to exercise rights
• CPRA (2023 update): Introduced sensitive personal data category and right to correction

• ePrivacy Directive (EU Cookie Law) – Directive 2002/58/EC
• PCI-DSS – Payment Card Industry Data Security Standard for payment processors
• ISO/IEC 27001 – Information Security Management standard (for vendors and internal compliance)

These legal references inform AtomLeap.ai’s data governance policies, processing agreements, and security practices.