Atom Beta

Privacy policy

Last updated: 6 July 2026 · Beta

Atom is built around owner-controlled data. This policy explains how Qwixl collects, uses, stores, and shares personal data when you use atom.qwixl.com, hosted Atom accounts, and related services. Self-hosted deployments that you operate on your own infrastructure are generally outside our control — you act as the data controller for those instances.

1. Who we are

Atom is operated by Qwixl (“we”, “us”, “our”), based in the United Kingdom. We provide the Atom shell, hosted agent infrastructure (during beta), module registry, and related developer tools.

For the purposes of UK data protection law, Qwixl is the data controller for personal data processed through the hosted Atom service and this website, except where you self-host and determine your own processing purposes.

2. Scope

This policy applies to:

  • The marketing website at atom.qwixl.com and subdomains we operate (including the app shell at /app/);
  • Hosted Atom accounts provisioned by Qwixl during beta;
  • Account registration, authentication, and control-plane services; and
  • Support and operational communications relating to the above.

It does not govern:

  • Self-hosted Atom agents you run on your own servers (you are responsible for your deployment’s privacy notices);
  • Third-party LLM providers you connect (OpenAI, Anthropic, Ollama, etc.) — their policies apply to model inference;
  • Other users’ agents or businesses you interact with via the agent web; or
  • Open-source software you download and run independently (see the Apache 2.0 license).

3. Information we collect

3.1 Account and identity data

  • Email address and password (stored via our authentication provider);
  • Public handle (e.g. @you) and account type (user, business, developer);
  • Profile metadata you choose to provide.

3.2 Agent and service configuration

  • LLM API keys and optional provider settings you supply for hosted agents;
  • Agent connection URLs, tokens, and provisioning status for hosted accounts;
  • Preferences stored in your account (e.g. theme, provider selection).

3.3 Agent store and coordination data (hosted)

When you use a hosted agent, we store data necessary to operate your agent on our infrastructure, which may include:

  • Owner store entries (profile, memory categories you approve, contacts);
  • Inbox and outbound coordination objects (scheduling proposals, messages, commerce intents);
  • Attestation and approval logs generated by shell confirmation chrome;
  • Encrypted session metadata for agent-to-agent (A2A) communication.

3.4 Technical and usage data

  • IP address, browser type, device identifiers, and request timestamps;
  • Server and application logs (errors, latency, abuse signals);
  • Aggregated usage metrics for reliability and capacity planning.

3.5 Communications

  • Messages you send to us (support requests, security reports, beta feedback).

3.6 What we do not do

  • We do not sell your personal data or conversation content to advertisers;
  • We do not use your hosted agent store to train foundation models owned by Qwixl (we do not operate such models);
  • We do not execute consequential actions on your behalf without shell-owned confirmation chrome.

4. How we use information

We use personal data to:

  • Create and manage your account and hosted agent;
  • Authenticate you and secure access to the service;
  • Route chat requests to your configured LLM provider via your agent backend;
  • Deliver, maintain, and improve Atom features;
  • Detect, prevent, and respond to abuse, fraud, and security incidents;
  • Comply with legal obligations and enforce our Terms of use;
  • Communicate service updates, beta notices, and (with consent where required) product news.

5. Legal bases (UK GDPR)

We rely on the following legal bases under the UK General Data Protection Regulation and Data Protection Act 2018:

  • Contract — processing necessary to provide the hosted service you sign up for;
  • Legitimate interests — security, abuse prevention, service improvement, and internal analytics, balanced against your rights;
  • Legal obligation — where we must retain or disclose data to comply with law;
  • Consent — where required (e.g. non-essential cookies or optional marketing). You may withdraw consent at any time.

6. Sharing and processors

We share personal data only as needed to operate the service:

  • Infrastructure providers — hosting, databases, and deployment platforms (e.g. cloud compute, object storage);
  • Authentication providers — account sign-up and login services;
  • Payment processors — if and when paid plans launch (not during free beta);
  • Professional advisers — lawyers, accountants, insurers where necessary;
  • Authorities — when required by law or to protect rights and safety.

We require processors to handle data only on our instructions and under appropriate contractual safeguards. We do not permit processors to use your data for their own marketing.

7. LLM and third-party AI providers

When you enable live LLM chat, your agent sends prompts and context to the model endpoint you configure. That provider processes data under its own terms and privacy policy. We do not control how OpenAI, Anthropic, Google, Groq, or self-hosted inference servers handle prompts.

On hosted accounts, your LLM API key is stored on your provisioned agent server (not in the browser) and used solely to authenticate requests to your chosen provider. You may rotate or remove the key in Settings.

Agent-to-agent coordination (scheduling, commerce objects, encrypted MLS sessions) does not require sending those payloads to your LLM provider unless your agent explicitly summarizes them for you in chat.

8. Hosted vs self-hosted

Hosted (Qwixl-operated)

We process and store your agent data on infrastructure we manage. You may export your agent store and migrate to self-hosting from Settings. Export formats and procedures are documented in the product and on GitHub.

Self-hosted (you-operated)

If you run atom agent start or Docker on your own hardware, you are the data controller for that deployment. Data stays on your systems unless you connect to external peers or cloud LLMs. The shell may still connect to atom.qwixl.com for registry modules or discovery if you configure it to do so.

9. Cookies and local storage

We use:

  • Strictly necessary storage — session tokens, authentication state, security flags;
  • Functional storage — theme preference, local dev settings;
  • Analytics — if introduced, we will update this policy and request consent where required.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent login or hosted agent access.

10. International transfers

Qwixl is based in the United Kingdom. Some processors may store or process data in the United States or other countries. Where personal data is transferred outside the UK, we use appropriate safeguards such as the UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses, or adequacy regulations, as applicable.

11. Retention

We retain personal data only as long as necessary:

  • Account data — for the life of your account plus a reasonable period after deletion for backups and legal compliance;
  • Agent store and logs — while your hosted agent is active; deleted or anonymized within 90 days of account closure unless law requires longer retention;
  • Security and abuse logs — typically up to 12 months;
  • Support correspondence — up to 24 months after resolution.

Retention periods may be adjusted during beta as we refine operational practices. Material changes will be reflected in this policy.

12. Security

We implement technical and organizational measures appropriate to the risk, including encryption in transit (TLS), access controls, isolated hosted agent containers, and secret handling practices that avoid storing LLM keys in browser storage on production hosts.

No system is perfectly secure. Report vulnerabilities responsibly via GitHub Security Advisories or support@qwixl.com. We will investigate and respond in good faith.

13. Your rights

Under UK data protection law, you have the right to:

  • Access a copy of personal data we hold about you;
  • Rectify inaccurate data;
  • Erase data in certain circumstances (“right to be forgotten”);
  • Restrict or object to processing in certain circumstances;
  • Data portability for data processed by automated means under contract or consent;
  • Withdraw consent where processing is consent-based;
  • Not be subject to solely automated decisions with legal or similarly significant effects (Atom does not make such decisions about you).

To exercise rights, email support@qwixl.com. We may need to verify your identity. We respond within one month, extendable where permitted by law.

14. Children

Atom is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it promptly.

15. Changes to this policy

We may update this policy as the product, law, or our processing practices change. We will post the revised version on this page with an updated date. For material changes affecting hosted users, we will provide notice in-product or by email where appropriate.

16. Complaints

If you have concerns about our use of personal data, contact us first at support@qwixl.com. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

17. Contact

Privacy and data enquiries: support@qwixl.com

General contact: hello@qwixl.com

Qwixl — Atom, United Kingdom