Privacy Policy

This Privacy Policy applies to information that identifies, relates to, describes, can reasonably be associated with, or can reasonably be linked to an identified or identifiable person (“Personal Information,” “personal data,” or similar terms under applicable law).

This Privacy Policy does not replace any separate written agreement between Atlensa and a customer, including any master services agreement, software-as-a-service agreement, order form, data processing addendum, business associate-style agreement if ever applicable, confidentiality agreement, letter of intent, pilot agreement, beta agreement, or other written contract. If there is a conflict between this Privacy Policy and a written customer agreement about Customer Content or business-confidential information, the written customer agreement will control to the extent of the conflict.

When a customer, user, or authorized representative uploads, submits, imports, generates, or stores files, reports, field data, prompts, comments, annotations, source documents, or other materials through the Services, that information is ‘Customer Content’ and is referred to as ‘Customer Data’ in our Terms of Service.

Customer Content may include, without limitation:

1. Environmental Assessments, Biological Assessments, Phase I ESAs, wetland delineation reports, draft reports, final reports, appendices, exhibits, maps, figures, tables, agency forms, permit applications, site plans, and supporting documentation.
2. Field data, soil borings, hydrology notes, vegetation surveys, wetland data sheets, field observations, GPS points, geospatial coordinates, photographs, maps, parcel information, property information, site descriptions, project descriptions, and environmental observations.
3. Agency comments, regulatory correspondence, reviewer notes, consultant notes, client comments, internal QA/QC notes, checklists, permitting timelines, regulatory requirements, and resubmission materials.
4. Phase I ESA materials, NEPA-related materials, EIS or EA materials, endangered species-related materials, habitat review materials, compliance materials, and other environmental deliverables if those products are made available.
5. Prompts, instructions, edits, redlines, user feedback, model outputs, generated text, generated summaries, inconsistency flags, compliance flags, and system-generated drafts.
6. Business-confidential information belonging to a customer, the customer’s client, a project owner, developer, consultant, agency, or other third party.

Atlensa generally processes Customer Content to provide the Services to the relevant customer and its authorized users. Customer Content may contain Personal Information, but the customer is usually responsible for deciding what Customer Content is submitted to the Services and for obtaining any required permissions, consents, notices, and rights.

Depending on the context, Atlensa may act as a “controller,” “business,” or similar role for information such as account information, website information, billing information, marketing information, support information, and usage analytics.

Atlensa may act as a “processor,” “service provider,” “contractor,” or similar role when processing Customer Content on behalf of a business customer under a written agreement. In that case, we process Customer Content according to the customer’s instructions, the relevant agreement, and applicable law.

The Services are intended for business and professional use by environmental consultants, engineering firms, permitting professionals, project owners, developers, agencies, and related organizations. The Services are not intended for personal, household, consumer, children’s, medical, patient-care, credit, employment-screening, insurance-underwriting, or tenant-screening purposes unless Atlensa expressly agrees in a separate written agreement.

We may collect information used to create, manage, authenticate, secure, and support accounts, including:

1. Name.
2. Business email address.
3. Business phone number.
4. Job title.
5. Employer, company, agency, or organization.
6. Department, role, permissions, and workspace membership.
7. Username, authentication identifiers, single sign-on identifiers, multi-factor authentication settings, access tokens, and authentication records maintained by Supabase Auth. Passwords are not stored by Atlensa in any form; credential storage, hashing, and verification are handled by Supabase Auth.
8. Profile settings, preferences, notification settings, and communication preferences.
9. Workspace, tenant, organization, team, or project identifiers.
10. Other information you or your organization provide during onboarding, early access, beta access, pilot setup, or support.

We collect Customer Content that users submit, upload, generate, import, or make available through the Services. This may include reports, draft documents, supporting documents, field data, site data, maps, correspondence, comments, instructions, prompts, annotations, model outputs, reviews, edits, and related materials.

Customer Content may include Personal Information about users, employees, consultants, client representatives, property owners, reviewers, agency staff, contractors, project stakeholders, or other people appearing in project materials. It may also include property-level information, location information, geospatial coordinates, signatures, professional licenses, business contact details, or other sensitive business information.

Because Atlensa provides AI-enabled workflows, we may collect and process:

1. Prompts, commands, queries, instructions, and user requests.
2. Uploaded files and extracted text, tables, figures, metadata, or document structure.
3. Generated drafts, summaries, analysis, inconsistency flags, compliance checks, answers, comments, suggested edits, and other AI outputs.
4. User edits, accept/reject decisions, feedback, ratings, annotations, comments, and review history.
5. Model configuration, workflow state, tool calls, retrieval results, citations, references, confidence indicators, validation results, and processing logs.
6. Information about how users interact with AI-generated outputs, including whether outputs were reviewed, revised, exported, or finalized.

We may automatically collect information about how users access and use the Services, including:

1. IP address.
2. Device identifiers.
3. Browser type and version.
4. Operating system.
5. Referring and exit pages.
6. Pages viewed, features used, buttons clicked, searches run, workflows started, workflows completed, and time spent.
7. Dates and times of access.
8. Authentication logs, access logs, audit logs, and administrative logs.
9. Error logs, crash logs, latency information, performance metrics, API usage, token usage, processing volumes, file sizes, and system diagnostics.
10. Approximate location inferred from IP address.
11. Cookie identifiers and similar tracking identifiers.
12. Security signals, suspicious activity indicators, abuse indicators, and fraud-prevention signals.

When you visit our website or interact with our online materials, we may collect information through cookies, pixels, SDKs, local storage, server logs, analytics tools, advertising technologies, and similar technologies.

This may include information about your browser, device, pages visited, referring website, campaign source, search terms, clicks, form submissions, session activity, and approximate location. We may use this information to operate the website, understand interest in Atlensa, improve content, measure campaigns, prevent abuse, and, where permitted, conduct marketing and retargeting.

We may collect billing and commercial information, including:

1. Billing contact name and email.
2. Billing address.
3. Subscription plan, seat count, usage tier, contract terms, purchase history, order forms, invoices, payment status, and renewal information.
4. Tax information, transaction identifiers, payment processor identifiers, and payment confirmation information.
5. Communications about pricing, early access, pilots, contracts, procurement, security reviews, and vendor onboarding.

Subscription payments are intended to be handled through Stripe’s hosted payment processing components. Cardholder data will not pass through Atlensa’s servers, and Atlensa does not intend to store full payment card numbers.

We may collect information when you communicate with us, including:

1. Emails, call notes, meeting notes, chat messages, support tickets, form submissions, demo requests, and survey responses.
2. Information shared in customer discovery interviews, product validation calls, prototype demos, sales calls, onboarding calls, and support calls.
3. Feedback, feature requests, bug reports, testimonials, references, quotes, and product suggestions.
4. Recordings or transcripts of calls or meetings, if disclosed or permitted by law.
5. Information needed to respond to your request, provide support, troubleshoot issues, or improve the Services.

If a customer or user connects Atlensa to a third-party service, imports data from a third-party service, uses single sign-on, enables an integration, or authorizes Atlensa to access another system, we may collect information made available through that integration.

Examples may include cloud storage files, email attachments, project management records, document management systems, permitting portals, regulatory databases, GIS systems, CRM systems, authentication providers, data rooms, or other business systems. The information collected depends on the permissions granted and the configuration selected by the customer or user.

We may collect information from public or third-party sources to operate, improve, or expand the Services. This may include:

1. Public agency websites, regulatory materials, statutes, rules, ordinances, guidance documents, manuals, regional supplements, checklists, permit forms, and other public regulatory information.
2. Public records, meeting materials, agendas, minutes, public comments, agency correspondence, public project materials, and public filings.
3. Business directories, professional profiles, company websites, public contact information, and market research sources.
4. Information provided by customers, partners, advisors, consultants, contractors, or other third parties.
5. Data used to maintain regulatory knowledge bases, compliance logic, citations, retrieval systems, and product functionality.

Public or third-party source information may contain Personal Information, including names, business contact details, professional roles, public comments, or agency contact information.

If you apply for a job, contractor role, advisor role, partnership, or similar relationship with Atlensa, we may collect information such as your resume, work history, education, portfolio, references, interview notes, compensation expectations, work authorization, background information where lawful, and communications with us.

We use information to:

1. Create, authenticate, and manage user accounts.
2. Provide access to workspaces, projects, files, workflows, dashboards, APIs, and integrations.
3. Ingest, process, parse, extract, classify, organize, and store Customer Content.
4. Generate draft reports, report sections, summaries, tables, checklists, comments, flags, and other outputs.
5. Detect inconsistencies, missing information, contradictions, errors, mismatched values, and other QA/QC issues.
6. Check report content against regulatory, jurisdictional, or customer-defined requirements.
7. Maintain regulatory references, retrieval systems, compliance databases, and product logic.
8. Support review, editing, approval, export, download, sharing, and finalization workflows.
9. Provide customer support, troubleshooting, training, onboarding, implementation, and account management.
10. Process nonpublic Customer Content to provide, maintain, secure, support, and troubleshoot the Services and to investigate security incidents, subject to Section 3.3.
11. Send service-related communications, including security notices, administrative messages, product updates, and support responses.

We use information to understand, develop, improve, test, and secure the Services, including to:

1. Debug issues, monitor performance, and improve reliability.
2. Improve user experience, workflow design, extraction quality, report quality, retrieval quality, citation quality, compliance-checking quality, and AI output quality.
3. Develop new features, products, modules, integrations, and workflows.
4. Evaluate usage patterns, adoption, feature performance, and product-market fit.
5. Test prototypes, pilots, beta products, and early-access features.
6. Conduct quality assurance, safety testing, red teaming, evaluation, and abuse monitoring.
7. Train personnel and improve support processes.
8. Protect accounts, Customer Content, systems, users, customers, and Atlensa against unauthorized access, misuse, fraud, spam, security incidents, and unlawful activity.

Atlensa may use AI systems, machine learning models, large language models, document extraction tools, retrieval-augmented generation systems, embeddings, classification systems, OCR tools, and related technologies to provide the Services.

Notwithstanding any other provision of this Privacy Policy, Atlensa may process raw or identifiable Customer Content only as reasonably necessary to provide, maintain, secure, support, and troubleshoot the Services; generate and deliver outputs; investigate security incidents; comply with law and legal process; and enforce agreements. Atlensa personnel do not read client documents as a matter of course. Access to production Customer Content is limited to personnel who require it to operate the Services and is used for support and incident investigation. If a support case requires Atlensa personnel to access a specific document, Atlensa will notify the customer.

Atlensa does not use raw or identifiable Customer Content to train or fine-tune AI models and does not permit third-party AI providers to do so.

Atlensa may derive and use de-identified, anonymized, aggregated, or statistical learnings from use of the Services for product improvement, benchmarking, analytics, research, model evaluation, safety testing, performance measurement, and business purposes, provided that such information does not identify a customer, user, client, project, property owner, or individual.

Atlensa may also use feedback, suggestions, comments, ideas, corrections, examples, ratings, bug reports, and similar input provided by users to improve the Services, without obligation to provide compensation, unless a separate written agreement states otherwise.

We may use information to:

1. Respond to inquiries, demo requests, support requests, and sales communications.
2. Provide product updates, newsletters, educational materials, event invitations, and marketing communications.
3. Personalize website content, emails, demos, sales outreach, and customer communications.
4. Conduct customer discovery, problem validation, prototype testing, product research, surveys, and user interviews.
5. Manage pilots, early-access programs, waitlists, letters of intent, references, testimonials, and case studies.
6. Measure marketing performance, campaign effectiveness, and website engagement.
7. Identify prospective customers, partners, advisors, investors, and users.
8. Administer promotions, events, webinars, and community programs.

You may opt out of marketing emails by using the unsubscribe link in the email or contacting us. We may still send non-marketing messages, such as security, legal, billing, support, and account-related notices.

We may use information to:

1. Comply with applicable laws, regulations, industry obligations, sanctions, export controls, subpoenas, court orders, lawful government requests, and legal process.
2. Enforce agreements, policies, and terms.
3. Protect rights, property, safety, security, confidentiality, and integrity of Atlensa, customers, users, employees, contractors, advisors, partners, and others.
4. Investigate, prevent, or respond to fraud, misuse, unauthorized access, security incidents, intellectual property infringement, confidentiality breaches, or other harmful activity.
5. Maintain business, tax, accounting, audit, legal, insurance, corporate governance, and compliance records.

We may disclose information to vendors, contractors, service providers, and subprocessors that help us provide, operate, secure, improve, or market the Services. These may include providers of:

1. Cloud hosting, cloud infrastructure, databases, storage, networking, and content delivery.
2. AI model services, large language model APIs, embedding models, OCR, document parsing, data extraction, transcription, translation, and machine learning infrastructure.
3. Analytics, product analytics, observability, logging, performance monitoring, and error tracking, including through PostHog. Usage events may be keyed to an account’s email address. When a review fails, a diagnostic error report may include a truncated excerpt of the output, which may contain text derived from Customer Content. Such information is retained under PostHog’s error-tracking retention settings and used only to diagnose platform faults.
4. Authentication, single sign-on, identity management, access control, and security tools.
5. Email, communications, support, ticketing, CRM, customer success, sales, and marketing systems.
6. Payment processing, billing, subscription management, accounting, and tax tools.
7. File conversion, document generation, e-signature, PDF generation, spreadsheet processing, and related business tools.
8. Legal, compliance, audit, insurance, professional advisory, and administrative services.

Subprocessor Information: A current list of material subprocessors is available upon request by contacting admin@atlensa.com. Enterprise customers may receive subprocessor notice rights, objection rights, or both under a separate written agreement, data processing addendum, or other applicable contract.

As of the Last Updated date, Atlensa runs AI model inference through Amazon Bedrock in U.S. AWS regions under Atlensa’s AWS account. Atlensa transmits extracted document text, rendered page images, review instructions, and project context to Anthropic models hosted through Amazon Bedrock. Atlensa does not transmit original PDF files to the model service and does not call a model provider’s public API directly.

Amazon Bedrock does not use inputs or outputs to train models or share them with third-party model providers. Prompts and completions are not retained by Bedrock after a request is served, except for encrypted, short-lived prompt caching measured in minutes. Atlensa may change AI models or providers, but will not use or permit the use of raw or identifiable Customer Content to train or fine-tune AI models. Atlensa will update this Privacy Policy and provide any notice required by applicable law or agreement if its AI-provider, retention, or training practices materially change.

If your account is associated with a customer organization, workspace, team, project, or enterprise account, information may be visible to that organization and its administrators or authorized users. For example, administrators may be able to access user accounts, usage logs, audit logs, project records, Customer Content, outputs, permissions, billing information, and support communications associated with the organization.

Your organization may control access to Customer Content and may be responsible for its own privacy and security practices.

We may disclose information to third parties when a customer or user directs us to do so, including through integrations, exports, downloads, sharing features, APIs, connected services, agency submission workflows, document management systems, or other configured workflows.

Atlensa is not responsible for how third parties process information after it is exported, submitted, shared, downloaded, or transferred at the direction of a customer or user, except as required by applicable law or a separate written agreement.

We may disclose information to lawyers, auditors, accountants, consultants, insurers, banks, advisors, investors, and other professional parties as reasonably necessary for business, legal, compliance, financing, accounting, insurance, security, corporate governance, and risk-management purposes. However, we will not disclose nonpublic Customer Content to investors, potential investors, financing sources, acquirers, potential acquirers, or other corporate transaction parties except in aggregated, de-identified, or anonymized form, unless disclosure of limited Customer Content is reasonably necessary for legal, security, compliance, audit, diligence, financing, transaction, or risk-management purposes and the recipient is subject to confidentiality obligations reasonably protective of the Customer Content.

We may disclose information if we believe in good faith that disclosure is necessary or appropriate to comply with law, respond to legal process, enforce agreements, protect rights, prevent harm, investigate security incidents, prevent fraud, or protect the safety, security, confidentiality, or integrity of Atlensa, customers, users, or others.

We may disclose, transfer, or assign information in connection with an actual or potential merger, acquisition, financing, investment, reorganization, bankruptcy, receivership, sale of assets, corporate restructuring, due diligence process, or similar transaction.

For nonpublic Customer Content, we will use aggregated, de-identified, or anonymized information where reasonably practicable. We will disclose identifiable nonpublic Customer Content in connection with a corporate transaction only where reasonably necessary for legal, security, compliance, audit, diligence, financing, transaction, or risk-management purposes and subject to confidentiality obligations reasonably protective of the Customer Content.

We may disclose information to current or future affiliates, subsidiaries, parent companies, or commonly controlled entities for purposes consistent with this Privacy Policy.

We may disclose aggregated, de-identified, anonymized, statistical, or benchmarking information that does not identify a customer, user, client, project, property owner, or individual. For example, we may disclose aggregate usage trends, performance metrics, industry insights, product statistics, or benchmark data, provided such information does not reveal Customer Content or Personal Information.

Atlensa does not sell Customer Content. Atlensa does not use Customer Content for third-party advertising. Atlensa does not disclose Customer Content to data brokers for resale.

Atlensa does not intend to sell Personal Information as “sale” is commonly understood. Some privacy laws define “sale” or “sharing” broadly to include certain advertising or analytics disclosures. If Atlensa engages in activities that applicable law treats as a sale, sharing, or targeted advertising, Atlensa will provide any required notices and opt-out mechanisms.

Depending on your interaction with Atlensa, we may collect the following categories of Personal Information:

1. Identifiers: name, business email, business phone number, IP address, account identifiers, device identifiers, cookie identifiers, and similar identifiers.
2. Customer records information: billing address, account information, payment-related information, and commercial contact information.
3. Commercial information: products or services purchased, obtained, considered, used, or discussed; subscription details; invoice information; account history; and customer relationship information.
4. Internet or network activity information: browsing activity, website interactions, usage logs, feature usage, access logs, search activity, workflow activity, and diagnostic information.
5. Geolocation information: approximate location from IP address and, if submitted in Customer Content, site-level geospatial data, GPS points, coordinates, maps, or project location data.
6. Professional or employment-related information: job title, employer, department, professional role, business contact details, professional background, resume information, and relationship to a customer or prospect.
7. Education information: if provided in recruiting, advisor, contractor, or professional background materials.
8. Audio, electronic, visual, or similar information: meeting recordings, call recordings, transcripts, uploaded photos, site photographs, diagrams, maps, screenshots, or support materials where provided or permitted.
9. Inferences: preferences, interests, product usage patterns, likelihood of interest in products, account health, and similar business or product analytics.
10. Sensitive Personal Information: only where provided or generated in the relevant context, such as account login credentials, precise geolocation contained in uploaded site data, government identification information if improperly uploaded, or other sensitive information appearing in Customer Content. Atlensa does not request sensitive Personal Information unless necessary for a specific authorized purpose.

We may collect Personal Information from:

1. You.
2. Your employer, organization, administrator, or other authorized users.
3. Customer Content.
4. Your device, browser, and use of the Services.
5. Cookies and similar technologies.
6. Service providers and integrations.
7. Public sources, government sources, regulatory sources, and third-party data sources.
8. Business partners, advisors, customers, prospects, referrals, and event organizers.
9. Recruiting sources, references, and professional networks.

We may collect, use, and disclose Personal Information for the purposes described in this Privacy Policy, including to provide the Services, process Customer Content, operate AI workflows, manage accounts, provide support, improve products, secure systems, communicate with users, market products, manage contracts, comply with law, enforce agreements, and protect rights.

We may disclose the categories of Personal Information listed above to the categories of recipients described in Section 5, including service providers, subprocessors, AI providers, customer organizations, administrators, integrations, professional advisors, affiliates, legal authorities, and parties involved in corporate transactions.

Atlensa does not sell Customer Content. Atlensa does not sell Personal Information for money.

Atlensa does not use Customer Content for cross-context behavioral advertising or targeted advertising.

If Atlensa uses advertising or analytics technologies in a way that applicable law treats as a “sale,” “sharing,” or “targeted advertising,” Atlensa will provide required notices and opt-out mechanisms. You may contact admin@atlensa.com to opt out where applicable.

Atlensa does not use or disclose Sensitive Personal Information for purposes other than those permitted by applicable law, such as providing the Services, maintaining account security, preventing fraud, ensuring physical safety, short-term transient use, performing services requested by the customer or user, or other permitted business purposes.

Atlensa does not intentionally use Sensitive Personal Information to infer characteristics about individuals unless expressly disclosed and permitted by law.

We retain each category of Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, as described in Section 7.

Depending on your state of residence and the applicability of state privacy law, you may have rights to know, access, correct, delete, obtain a copy, opt out, limit certain uses of sensitive information, or appeal a denied request. To exercise rights, contact admin@atlensa.com.

Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require proof of authorization and may require you to verify your identity directly with us.

For Personal Information that Atlensa processes as a controller, the controller is:

Atlensa, Inc.
admin@atlensa.com

Where Atlensa processes Customer Content on behalf of a customer, the customer may be the controller and Atlensa may be the processor. In that case, privacy requests relating to Customer Content should generally be directed to the customer.

Atlensa processes Personal Information for the purposes and legal bases described in Sections 3 and 4.

Atlensa may disclose Personal Information to the recipients described in Section 5.

Atlensa may transfer Personal Information outside the EEA, UK, or Switzerland as described in Section 11.

Atlensa retains Personal Information as described in Section 7.

Subject to applicable limitations, you may have rights to access, rectify, erase, restrict, object, port, withdraw consent, and lodge a complaint with a supervisory authority. Contact admin@atlensa.com to exercise rights.