← Ataski · Trust & security · DPA · Subprocessors

This is the canonical English version. Native translations for DE / ES / FR / PT / RU are pending counsel sign-off.

Privacy Policy

Last updated: 2026-10-08 Effective: 2026-06-19

This is the platform-wide Privacy Policy for Ataski (ataski.com). It describes how Ataski handles personal data across the entire service. It supplements, and cross-references but does not replace, the Terms of Service, the Data Processing Addendum, the Sub-Processors disclosure, the Data Retention Policy, and the AI Disclosure Statement.

This document is not legal advice. It reflects Ataski's operating practices for the benefit of customers, prospects, and the users whose data our customers process through the Service.

1. Who we are and what this policy covers

Ataski operates ataski.com and the Ataski platform — a subscription catalogue of AI workers ("AI employees") that perform business tasks for our customers, including sales outreach, customer support, renewals, meeting coordination, and financial reporting. Each AI worker runs under a defined capability matrix and is supervised for quality.

This Privacy Policy explains:

What personal data we collect and process, and in what role (controller vs. processor / Service Provider).
How we handle data we receive from Google APIs and Microsoft Graph, including the limited-use commitments those platforms require (see §6 and §7 — read these first if you are evaluating our Google or Microsoft connectors).
Who our sub-processors are.
How we handle data with large language models (LLMs).
How long we keep data and how to exercise your rights.

Our service is business-to-business. It is not directed to, and we do not knowingly collect personal data from, children (see §16).

2. Controller vs. processor — which hat we wear

Ataski processes personal data in two distinct capacities. Knowing which applies is essential to understanding your rights and ours.

2.1 Ataski as processor / Service Provider (the common case)

For the personal data our customers route through the Service — their prospects, leads, end-customers, contract counterparties, meeting participants, and the contents of emails, documents, and records they ask an AI worker to act on — the customer is the controller and Ataski is the processor (GDPR Article 28) / Service Provider (CCPA/CPRA §1798.140(ag)). We process this data only on the customer's documented instructions, which are the Master Services Agreement, this Privacy Policy, the Data Processing Addendum, and the configuration the customer sets in the Ataski dashboard (campaign targeting, mailbox/calendar connections, capability-matrix scope, PII-handling mode).

As a Service Provider, Ataski is not a data broker under CCPA §1798.140 or any state Data Broker Registration law. We do not aggregate, sell, or charge for access to contact personal information. Contact records stay within each customer's Row-Level-Security (RLS) tenant scope. Only non-personal firmographic information (company name, industry, public business-registry facts) may be cached across tenants.

If you are a data subject of one of our customers' campaigns (for example, you received outreach), the customer is your first point of contact as controller. Ataski will assist that customer, and we also operate a direct opt-out path; §13.4 describes it and how deletion works.

2.2 Ataski as controller

For the personal data we collect to operate our own business — your account and identity information, billing details, support correspondence with us, website analytics, and security/operational logs — Ataski is the controller. This policy is your direct notice for that processing.

3. The personal data we collect

3.1 Account and identity data (Ataski as controller)

Name, work email, and organisation affiliation, captured at sign-up and authentication via our auth provider (WorkOS).
Role assignment within your workspace (for example, workspace owner, finance lead, or operator).
Authentication events and session metadata.

3.2 Customer-connected and customer-uploaded business data (Ataski as processor)

Depending on which AI workers a customer enables, this can include:

Connected mailbox data — when a customer connects Gmail or Outlook, the data exposed by the specific scopes granted (see §6 and §7). We send outreach as the customer's own connected mailbox (bring-your-own-mailbox); we never send a customer's outreach from a shared Ataski domain.
Connected calendar data — free/busy availability from Google Calendar, and read-only calendar access from Microsoft 365 (see §6 and §7). Ataski does not request write access to any calendar: when a meeting is agreed, the invite is created from your own calendar.
CRM and accounting data — deal, contact, company, and financial data from connected systems (for example, HubSpot, Salesforce, Pipedrive, Zoho, QuickBooks, Xero, 1C via its OData interface, and Stripe), accessed under the customer's own OAuth grant, API key, or self-supplied endpoint credential. Reads are the default; where a customer enables a write-back feature (for example, Salesforce activity write-back, or the Financial Analyst's Google Sheets and Excel add-ins writing the model into the spreadsheet the customer opens them in, see §6.5 and §7.2), the write is limited to that target.
Uploaded documents — contracts and other files a customer uploads or connects (for example, via Google Drive, OneDrive, or DocuSign) for roles such as AI Contract Intelligence.
Meeting content — transcripts the customer uploads, or (when re-enabled with per-participant consent) live-meeting audio/transcripts captured by a meeting bot. See the AI Disclosure Statement for the consent and recording-disclosure rules.

3.3 Contact data processed inside the AI workers (Ataski as processor)

The recipient/prospect data a customer's roles act on — names, work email addresses, job titles, employer, public professional URLs, and engagement signals — held strictly within the customer's RLS tenant scope. Where a customer's campaign requires identifying additional prospects, Ataski uses a compose pattern rather than buying contact lists from email-finder/data-broker vendors: public company and professional profile data from LinkedIn (name, job title, employer, profile URL, location — never an email or phone number), obtained through Apify under Ataski's own account and without any LinkedIn login, plus the company's own website; a business email address inferred from the company's address format; and deliverability verification. See the Sub-Processors disclosure for the exact data vendors and what each sees.

3.4 Usage, billing, and operational data

Billing — subscription status and payment details handled by Stripe; Ataski does not store full card numbers.
Product analytics — PostHog receives only a small set of server-side events about sign-up, activation and onboarding milestones, keyed by the workspace id (or, for a sample viewed before sign-up, a random request id) and carrying only ids, counts and elapsed times — never a name, an email address or the content you work with. We send no page views and no session recordings, and no PostHog script runs on any page of the site or the app.
Logs and telemetry — structured application logs (correlation id, tenant id, task id, model used, cost, latency), an append-only audit log of every action, error traces (Bugsink, with PII off by default), LLM traces (Langfuse), and uptime metadata (Better Stack).

3.5 Website chat and advertising measurement (Ataski as controller)

Website chat — the chat on our marketing pages collects the messages you type and, if you choose to leave it, your email address so we can reply after you close the page. Messages are answered by an AI assistant (an Anthropic Claude model, see §5) and, when you ask for a person or the assistant cannot answer, by Ataski staff. We use them only to answer you and to improve our support.
Advertising measurement — the Google Ads conversion tag described in §15.1, used for conversion measurement only.
Website visit statistics — on our public marketing pages we collect cookieless visit statistics (pages viewed, time on page, scroll depth and clicks, with the referring site, ad campaign, device type and browser language) under a hashed identifier that rotates daily, setting no cookies and storing neither your IP address nor anything in your browser, and we keep them for 180 days.

3.6 Special categories

By design, Ataski does not seek special-category data (GDPR Article 9). Every role's capability matrix refuses medical, biometric, genetic, religious, political, sexual-orientation, or trade-union data on intake. For AI Contract Intelligence, a deterministic preflight scanner can detect and (per the customer's selected mode) redact or block high-sensitivity categories before any document content is sent to an LLM sub-processor — see §9 and the Data Processing Addendum.

4. How and why we use personal data (purposes and legal bases)

We use personal data only for the purposes for which it was provided (purpose limitation), and we collect only what each role needs (data minimisation).

Purpose	Capacity	GDPR/UK GDPR legal basis (where applicable)
Providing the AI-worker features the customer enabled (draft/send outreach, read availability, book meetings, classify inbound, extract document data, generate financial narratives)	Processor	Customer's lawful basis as controller; Ataski acts on Art. 28 instructions
Creating and securing customer accounts; authentication	Controller	Contract (Art. 6(1)(b)); legitimate interests in security (Art. 6(1)(f))
Billing and tax	Controller	Contract; legal obligation (Art. 6(1)(c))
Product analytics, debugging, and service improvement	Controller	Legitimate interests (Art. 6(1)(f))
Answering website-chat messages (§3.5)	Controller	Legitimate interests; steps at your request before a contract (Art. 6(1)(b))
Measuring ad conversions with the Google Ads tag (§15.1) — no remarketing, no personalised ads	Controller	Legitimate interests; in the EEA, UK and Switzerland the tag runs with advertising storage and ad user data denied
Security, abuse prevention, audit, and incident response	Controller / Processor	Legitimate interests; legal obligation
Responding to data-subject and consumer requests	Controller / Processor	Legal obligation

We do not use personal data for automated decisions producing legal or similarly significant effects on individuals without the customer's controller-side determination.

5. AI / LLM handling

Ataski runs its LLM work on one provider, Anthropic: an Anthropic Claude model as the worker and, for high-stakes tasks, a separate Anthropic Claude model as an independent adversarial reviewer. We do not use Google Gemini or any Google LLM, and no customer data is routed to Google for model inference. When the worker and the reviewer disagree on a high-stakes task, the task is routed to an internal operator inbox — there is no tiebreaker model.

Key commitments:

We process LLM inputs/outputs only to provide the feature the customer enabled.
Our LLM provider operates under its standard API terms: prompts and completions are not used to train its models, and provider-side retention (held for abuse monitoring) is limited to at most 30 days. See the Sub-Processors disclosure for the provider's entry.
Ataski does not use customer personal data — and specifically does not use any data obtained through Google APIs or Microsoft Graph — to develop, improve, or train generalised or non-personalised AI/ML models. Any improvement of our own extractor evaluation suites uses tenant-scoped feedback that is stripped of tenant/user identifiers before promotion, reviewed individually (see §9).
Enterprise customers may bring their own Anthropic API key; in that case their LLM calls run through their key and Ataski's invoice excludes that LLM cost.

6. Google API Services — User Data and Limited Use

This section governs all data Ataski accesses through Google APIs (Gmail, Google Calendar, Google Drive, Google Sheets).

Ataski's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6.1 Scopes we request and the reason for each

We request only the narrowest scopes needed for a feature you explicitly enable, and only after you grant consent through Google's OAuth screen. Access is per-connection and can be revoked at any time from your Google Account.

Google scope	Why we request it	What it lets us do
`https://www.googleapis.com/auth/gmail.send`	Send the outreach you instruct, from your own connected Gmail mailbox (bring-your-own-mailbox).	Send a message you (or your supervised AI worker) have prepared. This scope is send-only; it does not grant any ability to read your mailbox.
`https://www.googleapis.com/auth/gmail.readonly` and/or `https://www.googleapis.com/auth/gmail.metadata`	Deduplicate prospects already in your inbox so we don't double-contact them — only when you enable inbox dedup.	We query thread metadata (thread ids and From/To/Subject headers) to detect an existing conversation. We do not read message bodies for this feature.
`https://www.googleapis.com/auth/gmail.compose` and/or `https://www.googleapis.com/auth/gmail.modify`	Create a draft in your Gmail Drafts folder when you choose "save to drafts" instead of auto-send.	Create a draft you then review and send yourself.
`https://www.googleapis.com/auth/calendar.freebusy`	Read your availability to propose meeting times in outreach.	Read busy/free intervals only — never event titles, attendees, or descriptions. Cannot create or modify any event.
`https://www.googleapis.com/auth/drive.readonly`	Ingest the contract/financial documents you point us to, for the document-reading roles.	List and download the specific files you authorise. We do not modify your Drive.

This table is the complete list of Google scopes Ataski's server-side connector requests. Ataski does not request Google Calendar write access (when a meeting is agreed, you create the invite from your own calendar) and does not request a Google Sheets or Drive write scope. The Google Sheets add-on is a separate surface with its own, narrower scopes, described in §6.5.

6.2 What Google user data we access

The Gmail message we send on your instruction (and the draft we create where enabled); Gmail thread metadata for dedup where enabled; calendar free/busy intervals; the specific Drive files you authorise; and, through the Sheets add-on (§6.5), the sheets it maintains in the spreadsheet you open it in.

6.3 Limited Use commitments

For all data received from Google APIs, Ataski commits that we:

Use it only to provide or improve the user-facing features you have enabled.
Do not transfer it to others except (a) as necessary to provide or improve those user-facing features, (b) with your consent, (c) for security purposes (e.g., investigating abuse), (d) to comply with applicable law, or (e) as part of a merger, acquisition, or sale of assets, with notice to you.
Do not use it to develop, improve, or train generalised or non-personalised AI and/or ML models. We do not send Google user data to any LLM for model training, and our worker/supervisor LLM providers operate under no-training terms.
Do not sell it, and do not use or transfer it for serving advertisements.
Do not allow humans to read Google user data, except: (a) with your affirmative agreement for specific messages; (b) where necessary for security purposes (such as investigating a bug or abuse); (c) to comply with applicable law; or (d) where the data has been aggregated and anonymised and is used solely for internal operations. Routine processing is automated.

6.4 Verification and revocation

Several of the scopes above (including the Gmail and Drive scopes) are classified by Google as "restricted" or "sensitive" and are subject to Google's verification and, where applicable, a security assessment. Until verification is complete, restricted features are limited or disabled. You can review and revoke Ataski's access at any time at Google Account → Security → Third-party access. Revocation stops further access; data already processed to deliver a feature is retained and deleted per §12.

6.5 The Ataski FP&A add-on for Google Sheets

The Sheets add-on is a separate surface from the server-side Google connector described in §6.1. It is a Google Sheets add-on, built on Apps Script, that runs inside the spreadsheet you open it in, under scopes you grant to the add-on itself when you install it, and it talks to no server other than Ataski's own API. It is not a Drive client: it cannot list, open, or read any other file in your Google account.

The scopes it requests — the complete set. These four are exactly the scopes in the add-on's manifest. The add-on requests no others, and none of them is a "restricted" or "sensitive" Google scope.

Add-on scope	Why the add-on needs it	What it lets the add-on do — and what it does not
`https://www.googleapis.com/auth/spreadsheets.currentonly`	To show your Ataski plan in the spreadsheet as a working model, and to read back the numbers you type into it.	Create and maintain the workbook Ataski builds from your plan — twenty sheets — in the spreadsheet the add-on is open in, and read the values in them. Nineteen are the ones you read: the model itself (your own plan lines, the cells you may edit and the spreadsheet formulas over them), the dashboard, the instruction, the cash statement, the scenarios, the balance sheet, the actuals from your books, the metrics, four breakdowns, the month close, the group, the checks, what has changed, the log, the reference lists and the seasonality. The twentieth is the hidden `_Ataski Sync`, which holds the bookkeeping that tells an edit of yours from a number we published. The tab names are written in the language of your Ataski workspace. Where a spreadsheet still carries a sheet from an earlier version of the add-on (`Ataski Drivers`, `Ataski Model` or `Ataski Cash`), the add-on writes one note on it saying it is no longer synced, and then leaves it alone. The add-on reads no other sheet in that file and no other spreadsheet at all, and it holds no Drive access.
`https://www.googleapis.com/auth/script.external_request`	To reach Ataski, which is where your plan lives.	Make HTTPS calls only to Ataski's own hosts — `https://ataski.com/` and `https://app.ataski.com/`, the two entries in the add-on manifest's URL whitelist. There is no third-party endpoint, no analytics beacon and no advertising call anywhere in the add-on.
`https://www.googleapis.com/auth/script.container.ui`	To put the add-on's controls where you can reach them.	Draw the Ataski menu and the connection sidebar inside the spreadsheet. No document content is read through this scope.
`https://www.googleapis.com/auth/script.scriptapp`	To run the optional automatic sync, if you switch it on.	Create and delete the add-on's own two triggers in that document: an installable `onEdit` trigger that sends the cell you just typed, and an hourly time trigger that brings back what changed in Ataski. Both are created only when you tick keep in sync automatically, and both are deleted the moment you untick it. The add-on creates no other trigger and can neither see nor modify any other script.

What leaves the spreadsheet. Only the cells the add-on wrote itself and you then changed: the plan line's own code, which input, scenario or month it is, the number you typed, and the sync bookkeeping for those cells (the per-cell version and the value both sides last agreed on). A cell holding a formula is not sent — the add-on leaves formulas alone in both directions. A closed month from your books carries no edit key at all and is never sent, and neither is any sheet the add-on publishes read-only. Nothing else in the file is read or uploaded: not sheets of your own, not the file name, not your collaborators. Any field that is not a plan cell is refused server-side, and nothing the add-on sends is ever written to your accounting system — the plan lives in Ataski, and your books stay where they are.

What we do not collect through the add-on. No Google account password; no Google OAuth refresh token; no Drive file list; no spreadsheet other than the one you opened the add-on in; and nothing in that spreadsheet outside the sheets the add-on maintains there.

How you connect — nothing is typed into the spreadsheet. Pressing Sign in to Ataski makes the add-on ask our server for a six-digit code, which it prints beside a link. You open that link in the browser where you are already signed in to Ataski and press Allow on a card naming the same code. Ataski then issues its own per-user access key, valid for 7 days, for the workspace of the person who approved it, and hands it to the add-on once. The key is stored in your own Apps Script user properties, is never displayed and never typed, and is sent to Ataski only in the Authorization header. The pairing code lives 10 minutes and is single-use. You can revoke every key your workspace has issued, at any time, from Financial Analyst → Excel & Sheets in Ataski; and you can remove the add-on's Google authorisation at any time at Google Account → Security → Third-party access.

Where the data goes and how long we keep it. The plan cells the add-on sends are Customer Data under §2.2. They are stored in Ataski's own database under the row-level tenant isolation described in §11, are visible only to your workspace, and are retained and deleted per §12 — deleted after offboarding, with the automated sweep starting no earlier than day 30 and completing within 48 hours. They are disclosed to no one outside the sub-processors listed in §8; they are never sold; they are never used for advertising; and they are never used to develop, improve or train generalised or non-personalised AI or ML models. The Limited Use commitments in §6.3 — including the rule on human access in §6.3(5) — apply in full to everything the add-on sends us. Routine processing is automated.

What the add-on cannot do. It cannot approve a forecast, cannot write to your accounting system, cannot read another spreadsheet, and cannot act at all once you disconnect it: removing the key in the sidebar, or revoking keys in Ataski, stops it immediately.

7. Microsoft 365 — the Graph connector and the Excel add-in

7.1 Microsoft Graph — equivalent limited-use posture

When you connect Microsoft 365 / Outlook, Ataski accesses Microsoft Graph under a single Ataski-registered application, requesting only:

Microsoft Graph permission	Why we request it
`Mail.Send`	Send the outreach and reminders you approve, from your own connected Outlook mailbox.
`Mail.Read`	Detect replies to the messages Ataski sent for you, so a thread can pause or be routed to you.
`Calendars.Read`	Read your calendar to find your availability for proposing meeting times and, where you enable meeting auto-join, the upcoming meetings with a meeting link and their invitees. Read-only.
`Files.Read.All`	Ingest the OneDrive documents you point us to, for the document-reading roles.
`offline_access`	Keep the connection alive with a refresh token. Grants no data access by itself.

This table is the complete list of Graph permissions Ataski requests. Ataski does not request calendar write access (Calendars.ReadWrite) or Mail.ReadWrite.

For all data received through Microsoft Graph, Ataski applies the same limited-use posture described in §6.3: we use it only to provide the feature you enabled; we do not sell it; we do not use it to train generalised/non-personalised AI/ML models; we do not allow humans to read it except with your consent, for security, to comply with law, or in aggregated/anonymised form for internal operations; and we transfer it only as needed to provide the feature, with your consent, for security/legal reasons, or in a merger with notice. Our use complies with the Microsoft APIs Terms of Use and Microsoft's data-handling requirements. You may revoke Ataski's access from your Microsoft account at any time.

7.2 The Ataski FP&A add-in for Excel

The Excel add-in is not a Microsoft Graph client and holds no Graph permission. It is an Office.js task pane that runs inside the workbook you open it in, under the single Office permission ReadWriteDocument, and it communicates only with Ataski's own API.

What it reads: the plan values in the sheets the add-in itself created, and the workbook's own sync metadata. A cell holding a formula is left alone.
What it writes: only sheets it creates and owns, in the workbook you have open — the workbook Ataski builds from your plan, twenty sheets. Nineteen are the ones you read: your plan as a working model (editable input cells and live formulas over them), the dashboard, the instruction, the cash statement, the scenarios, the balance sheet, the actuals from your books, the metrics, four breakdowns, the month close, the group, the checks, what has changed, the log, the reference lists and the seasonality. The twentieth is the hidden _Ataski Sync, which records which cell carries which value. It clears and rewrites a sheet only if the add-in created that sheet itself; a sheet of your own beside them is left untouched, as is a sheet from an earlier version of the add-in, which gets one note saying it is no longer synced.
What leaves the workbook: the plan values you edited, sent to Ataski so the model can be recomputed. Any field that is not a plan cell is refused server-side, and a closed month from your books carries no edit key at all and never travels. The rest of the workbook is never uploaded, and Microsoft never receives your workbook data — the task pane is served from ataski.com, and the Microsoft store distributes only the add-in's manifest.
What it cannot do: approve a forecast, or write to your accounting system. Where the same number moved both in the workbook and in Ataski, nothing is overwritten either way: the workbook keeps yours, the cell names both numbers, and a person settles it in the Ataski web app.
How you connect: the same device pairing as the Sheets add-on, and nothing is pasted into the workbook. Press Sign in to Ataski; the pane shows a six-digit code beside a link; you approve that code in Ataski, in the browser where you are already signed in; Ataski issues a 7-day per-user access key for the approving workspace and hands it to the pane once. The key is kept in that workbook's own add-in settings, is never displayed and never typed, and travels only in the Authorization header. The add-in never sees or stores a Microsoft credential. Disconnecting in the pane, or revoking keys in Ataski, ends access immediately.

Data the add-in sends us is Customer Data under §2.2: it is stored in Ataski's own database under the tenant isolation of §11, is retained and deleted per §12, is disclosed to no one outside the sub-processors in §8, is never sold, and is never used to develop, improve or train generalised or non-personalised AI or ML models.

8. Sub-processors

Ataski engages a limited set of third parties to process Customer Data on our behalf. The canonical, current list — with each vendor's legal entity, purpose, data categories accessed, location, and DPA link — is published at https://ataski.com/legal/subprocessors.

By category, our sub-processors are:

Hosting & infrastructure / database — Hetzner (compute), Neon (Postgres), Cloudflare (DNS and R2 object storage).
Authentication — WorkOS.
Email delivery — ActiveCampaign/Postmark (transactional + inbound).
LLM / AI — Anthropic (Claude worker and independent reviewer). No Google/Gemini.
Meetings — Recall.ai (meeting bot identity + transcription).
Contact-data providers (PAYG only) — Bright Data, Perplexity, ZeroBounce, Apify.
Billing — Stripe.
Observability & operations — Langfuse, Bugsink, PostHog, Better Stack.

Other recipients (Ataski as controller). Google LLC receives the data its Google Ads tag collects on our marketing pages, for conversion measurement only (§15.1). Google is not a sub-processor of Customer Data: the tag does not run on the pages where you work with your data, apart from the single sign-up and purchase reports described in §15.1, which carry no Customer Data.

Customer bring-your-own connectors (for example Gmail, Outlook, Salesforce, HubSpot, Pipedrive, Slack, QuickBooks, Xero, 1C via OData, the Google Sheets and Excel add-ins, or Apollo) are accessed only under the customer's own credential. Ataski is not a sub-processor for those — the customer's relationship with each is direct.

Customers receive 30 days' advance notice (in-app banner + email to the workspace admin) before a new sub-processor goes live, and may object during that window, as described in the DPA and the Sub-Processors page.

9. AI Contract Intelligence — document PII handling

For the AI Contract Intelligence role, a deterministic preflight scanner runs locally on Ataski's host (no external service) and detects 12 categories of personal data in uploaded contracts. Each customer selects a per-tenant PII-handling mode at https://app.ataski.com/app/settings#pii-policy:

detect_only (default) — the document text is sent to the LLM sub-processor; detected categories are recorded on the append-only extraction audit row.
redact_selected — selected categories are replaced with a visible [REDACTED-<category>] sentinel before any text leaves Ataski for the LLM.
block_high_sensitivity — if SSN, credit-card, bank-routing, health-condition, or biometric data is detected, the extraction refuses and no document bytes leave Ataski for any sub-processor.

Scanned image-only PDFs are OCR'd locally (open-source Tesseract on the Ataski host); image bytes never leave Ataski — only the OCR'd text follows the selected mode. Full detail, including the closed category set and customer-instruction status, is in the Data Processing Addendum and the Data Retention Policy.

Customer corrections submitted via the dashboard feedback control are stored in the customer's RLS scope and used to improve our extractor evaluation suite; any correction promoted into a regression test is stripped of tenant/user identifiers first and reviewed individually, and corrections are deleted on the standard offboarding schedule (§12).

10. AI disclosure in customer communications

Ataski never hides that a recipient is interacting with an AI-assisted system. AI-drafted outreach is reviewed under the customer's supervision and carries disclosure consistent with applicable law (e.g., California SB 1001 bot disclosure and CCPA notice-at-collection for California recipients), plus one-click unsubscribe and a suppression mechanism. Meeting recording, when enabled, carries participant-consent capture and an AI-presence announcement. The controlling rules are in the AI Disclosure Statement.

11. Security and multi-tenant isolation

Tenant isolation — every customer-data table is protected by Postgres Row-Level Security; queries are automatically scoped to the requesting tenant. Cross-tenant aggregation of personal data is prohibited by code path.
Encryption — data is encrypted in transit (TLS 1.2+) and at rest (Neon-managed AES-256 for the database; server-side encryption for R2 file storage). Connected-account OAuth tokens are stored encrypted.
Access control & audit — least-privilege access, SSO via WorkOS, and an append-only audit log of every administrative action, LLM call, and external API/data-vendor call, retained per the Data Retention Policy.
Cost guardrails — per-tenant daily caps and global kill switches limit blast radius from a compromised credential or runaway loop.

A current security overview is published at https://ataski.com/trust — the controls there are generated from the running code, so the page cannot claim more than the system does. Personal-data breaches are notified to affected customers without undue delay and within 72 hours of Ataski becoming aware, per the DPA.

12. Data retention and deletion

We keep personal data only as long as needed for the purpose it was collected, then delete it. Full periods are in the Data Retention Policy. Key timelines:

Customer Data (CRM, outreach history, drafts, documents, transcripts, contact records) is retained while the subscription is active and automatically deleted after offboarding: the automated sweep starts no earlier than day 30 after the subscription ends and completes within 48 hours. During that 30-day window the data remains exportable via /api/export (admin: /app/settings/export.json); a reminder is sent at day 7 and day 23.
Opt-out register — the global opt-out register (a hash of the opted-out email address, which is the lookup key, plus the reason and source, recorded so a contact who opted out is never re-contacted by any workspace) is retained indefinitely as a legal obligation (CAN-SPAM / CCPA). The address itself is stored alongside the hash until 90 days after the opt-out is processed, then removed. Tenant-scoped suppression data is deleted with the workspace in the offboarding sweep.
Audit records are retained for 24 months. After that a daily job removes the personal data from each expired record in place — the acting user reference and the free-form detail are cleared — while keeping the de-identified record of what happened, which we are required to keep for accountability and security. Audit records are deleted outright with the workspace 30 days after offboarding. External-call (MCP) logs hold run metadata (tool name, hashes, cost, latency) rather than contact details; see the Data Retention Policy for their status.
Right-to-delete request logs are retained at least 7 years as compliance evidence.
Firmographic cache (non-personal) is evicted 30 days after the fact was last confirmed against its source; rows referenced only by a deleted tenant are removed in the offboarding sweep.

13. Your rights

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent where processing relies on it. Where Ataski is the controller (your account data), contact us per §17. Where Ataski is a processor (data our customers process through the Service), please contact the relevant customer (controller); Ataski will assist them per the DPA. You also have the right to lodge a complaint with your supervisory authority.

13.2 California (CCPA/CPRA) and other US state laws

California residents (and residents of states with comparable laws) have the right to know/access, delete, correct, and opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights.

Ataski does not "sell" personal information and does not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. Accordingly, Ataski acts only as a Service Provider for Customer Data and is not a data broker. The Google Ads tag on our marketing pages is configured for conversion measurement only, with remarketing and ad personalisation turned off (§15.1). We nevertheless honour a Global Privacy Control signal as an opt-out of sale or sharing — see Your Privacy Choices.

13.3 How to exercise rights against Ataski (controller data)

Email security@ataski.com. We verify requests and respond within the statutory timeline (generally 45 days under CCPA, 30 days under GDPR; extensions where permitted, with notice). Tenant administrators can also export their workspace data at any time via /app/settings/export.json.

13.4 Direct opt-out / erasure for outreach recipients

If you received outreach sent through Ataski on a customer's behalf, there are two routes, and they do different things:

Opt-out (stop all email). Use the one-click unsubscribe in the message or the form at /privacy/optout. Your address is added to Ataski's global opt-out register, which outreach sending checks before an email goes out, so no Ataski customer can email you through Ataski again. Ataski also passes a deletion request to each contact-data provider whose integration supports one; none does today. The opt-out does not by itself delete what a customer holds about you in its workspace.
Deletion of your data. The customer that contacted you is the controller of what it holds about you (§2.1), so ask that customer. It verifies your request and submits it to Ataski; within 30 days (GDPR) / 45 days (CCPA) the matching outreach and support records in its workspace are deleted or redacted, your address is added to the opt-out register, and a confirmation is emailed to you. That data is also deleted under the terms of the Data Retention Policy, and with the rest of the workspace when the customer leaves Ataski.

14. International data transfers

Ataski is operated from, and primarily uses sub-processors located in or operating from, the United States and the EU (see the Sub-Processors disclosure for each entity's location). For transfers of personal data from the EEA, UK, or Switzerland to a third country, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), and on the EU-US Data Privacy Framework where the receiving sub-processor is certified. Ataski maintains a Transfer Impact Assessment covering the US destination and the listed sub-processors; a current summary is available to customers on request via security@ataski.com. Details are in the DPA.

15. Cookies, advertising measurement and your privacy choices

Ataski uses a minimal set of cookies and local storage strictly necessary to authenticate sessions and protect the service. Our product analytics run server-side and set no cookies in your browser. The website chat on our marketing pages keeps its conversation state in your browser's local storage (see §3.5). The one exception to "strictly necessary" is the Google Ads conversion tag described in §15.1. You can control cookies through your browser settings.

15.1 Google Ads conversion measurement

Our public marketing pages load the Google Ads tag, operated by Google LLC, so we can measure whether a visit that came from one of our ads led to a sign-up or a purchase. After a new sign-up, the first page of the app loads the same tag once to report that sign-up, and the purchase confirmation page does the same for a purchase. The tag reports the event with a random identifier (the new workspace's or the purchase's id, used so the event is counted only once) and, for a purchase, its value and currency. We do not send your name, email address or other contact details with it. Google receives the information its tag collects from your browser (for example, your IP address, browser details, the page address and Google's own advertising cookies) and processes it under its own terms.

We use this tag for conversion measurement only:

No remarketing and no personalised ads. The tag is configured through Google Consent Mode with ad_personalization denied in every region, so these visits are not used to build remarketing audiences or to personalise ads.
EEA, UK and Switzerland: advertising storage and ad user data are denied by default. The tag sets no advertising cookies there, and Google can only model conversions in aggregate.
Elsewhere: unless your browser sends a Global Privacy Control signal (§15.2), the tag may set Google's first-party conversion cookies (such as _gcl_au) to attribute a sign-up or purchase to an ad click.

15.2 Your Privacy Choices

Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as your request to opt out of the sale or sharing of personal information under the CCPA/CPRA and comparable US state laws. The Google Ads tag then also denies advertising storage and ad user data and runs in Google's restricted data processing mode. GPC is available in several browsers and browser extensions.
Opting out without GPC. You can block or delete cookies from googleadservices.com, googletagmanager.com and doubleclick.net in your browser settings, use a content blocker, or manage how Google uses ad data at My Ad Center. Blocking the tag does not affect your use of the Service.
Questions or requests about this processing go to the privacy contact in §17.

16. Children

The Service is a business tool intended for use by organisations and their personnel. It is not directed to children, and we do not knowingly collect personal data from anyone under 16 (or under 13 where that is the applicable threshold). If we learn we have collected such data, we will delete it.

17. Contact

Where this policy describes processing for which Ataski is the controller (§2.2), the controller is GlobalDeal Inc. (d/b/a Ataski), a Delaware C-Corporation:

GlobalDeal Inc. 1720 W Ball Rd, Ste 4B #136 Anaheim, CA 92804 United States

Privacy questions, data-subject & consumer requests, the DPA, transfer documentation and security: security@ataski.com
Security overview: see https://ataski.com/trust

Ataski will designate an EU/UK Article 27 representative and (where required) a Data Protection Officer; contact details will be added here on appointment. Until then, all privacy enquiries are handled via the address above.

18. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service, our sub-processors, or the law. Material changes are notified to customers via in-app banner and email to the workspace admin. New sub-processors carry the 30-day advance notice described in §8. The "Last updated" date at the top reflects the current version; superseded versions are retained internally for audit.