Atom

Privacy policy

Last updated: 26 July 2026

This Privacy policy explains how Qwixl Ltd collects, uses, stores, and shares personal data when you use atom.qwixl.com, hosted Atom accounts, and related services. Last updated: 26 July 2026. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018. Self-hosted deployments that you operate on your own infrastructure are generally outside our control — you act as the data controller for those instances.

1. Who we are

Atom is operated by Qwixl Ltd (“we”, “us”, “our”), a company registered in England and Wales. Our registered office is in the United Kingdom; company registration and registered-office details are available on request and via Companies House.

For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), Qwixl Ltd is the data controller for personal data processed through the hosted Atom service and this website, except where you self-host and determine your own processing purposes and means.

Contact for privacy matters: legal@qwixl.com or support@qwixl.com.

2. Scope

This policy applies to:

  • The marketing website at atom.qwixl.com and subdomains we operate (including the app shell at /app/);
  • Hosted Atom accounts under paid Standard and BYOK plans;
  • Account registration, authentication, billing (via Stripe), and control-plane services; and
  • Support and operational communications relating to the above.

It does not govern:

  • Self-hosted Atom agents you run on your own servers (you are responsible for your deployment’s privacy notices);
  • Third-party LLM providers you connect (OpenAI, Anthropic, Ollama, etc.) — their policies apply to model inference;
  • Other users’ agents or businesses you interact with via the agent web; or
  • Open-source software you download and run independently (see the Apache 2.0 licence).

3. Information we collect

3.1 Account and identity data

  • Email address and password (stored via our authentication provider);
  • Public handle (e.g. @you) and account type (user, business, developer);
  • Profile metadata you choose to provide.

3.2 Billing data

  • Subscription plan, billing status, and Stripe customer / subscription identifiers;
  • Payment method details are processed by Stripe; we do not store full card numbers on our servers.

3.3 Agent and service configuration

  • LLM API keys and optional provider settings you supply for hosted agents;
  • Agent connection URLs, tokens, and provisioning status for hosted accounts;
  • Preferences stored in your account (e.g. theme, provider selection).

3.4 Agent store and coordination data (hosted)

When you use a hosted agent, we store data necessary to operate your agent on our infrastructure, which may include:

  • Owner store entries (profile, memory categories you approve, contacts);
  • Inbox and outbound coordination objects (scheduling proposals, messages, commerce intents);
  • Attestation and approval logs generated by shell confirmation chrome;
  • Encrypted session metadata for agent-to-agent (A2A) communication.

3.5 Technical and usage data

  • IP address, browser type, device identifiers, and request timestamps;
  • Server and application logs (errors, latency, abuse signals);
  • Aggregated usage metrics for reliability and capacity planning.

3.6 Communications

  • Messages you send to us (support requests, security reports, product feedback).

3.7 What we do not do

  • We do not sell your personal data or conversation content to advertisers;
  • We do not use your hosted agent store to train foundation models owned by Qwixl (we do not operate such models);
  • We do not execute consequential actions on your behalf without shell-owned confirmation chrome.

4. How we use information

We use personal data to:

  • Create and manage your account and hosted agent;
  • Authenticate you and secure access to the service;
  • Process payments and subscriptions via Stripe and provision hosted access after successful Checkout;
  • Route chat requests to your configured LLM provider via your agent backend;
  • Deliver, maintain, and improve Atom features;
  • Detect, prevent, and respond to abuse, fraud, and security incidents;
  • Comply with legal obligations and enforce our Terms of use;
  • Communicate service updates and (with consent where required) product news.

5. Legal bases (UK GDPR)

We rely on the following legal bases under the UK General Data Protection Regulation and Data Protection Act 2018:

  • Contract — processing necessary to provide the hosted service and account you request;
  • Legitimate interests — security, abuse prevention, service improvement, and internal analytics, balanced against your rights;
  • Legal obligation — where we must retain or disclose data to comply with law (including tax and accounting records);
  • Consent — where required (e.g. non-essential cookies or optional marketing). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

6. Sharing and processors

We share personal data only as needed to operate the service. Current processors and categories of recipients include:

  • Supabase — authentication and account database (identity, handle, hosted-agent metadata);
  • DigitalOcean — control plane, per-owner agent containers, and persistent volumes;
  • Vercel — hosted shell and public registry front-end;
  • Stripe — payment processing for hosted Standard/BYOK plans and related charges;
  • Owner-chosen LLM providers — OpenAI, Anthropic, OpenRouter, or other endpoints you configure (prompts and tool results under their terms);
  • Microsoft — when you connect Microsoft 365 / Graph (see section 8); Microsoft processes data under its terms for the scopes you grant.

We may also share data with professional advisers and competent authorities where necessary. We require processors to handle data only on our instructions and under appropriate contractual safeguards. We do not permit processors to use your data for their own marketing.

7. LLM and third-party AI providers

When you enable live LLM chat, your agent sends prompts and context to the model endpoint you configure. That provider processes data under its own terms and privacy policy. We do not control how OpenAI, Anthropic, Google, Groq, OpenRouter, or self-hosted inference servers handle prompts.

On hosted accounts, your LLM API key is stored on your provisioned agent server (not in the browser) and used solely to authenticate requests to your chosen provider. You may rotate or remove the key in Settings.

Agent-to-agent coordination (scheduling, commerce objects, encrypted MLS sessions) does not require sending those payloads to your LLM provider unless your agent explicitly summarises them for you in chat.

No Qwixl model training: we do not use your hosted agent store, chat content, or Microsoft organisational payloads to train foundation models owned by Qwixl. We do not operate such models today.

8. Microsoft 365 and Graph data

Atom may offer an optional Microsoft Graph connector (calendar, mail, and tasks) so your agent can read Microsoft 365 data you authorise. This section describes how that data is handled when the connector is enabled. Until you connect Microsoft, we do not receive Graph payloads from your tenant.

8.1 Categories and purposes

  • OAuth tokens — refresh and access tokens needed to call Graph on your behalf;
  • Graph read results — calendar events, messages, or tasks returned for a specific agent turn or connector invoke;
  • Connection metadata — which Microsoft account/tenant you linked, scopes granted, and disconnect status.

Purposes: provide the features you request in Chat and related surfaces; enforce approval chrome for consequential writes; security, abuse prevention, and support.

8.2 Custody and minimisation

  • Microsoft refresh tokens are stored only in the encrypted agent connector vault — not returned to the browser shell, modules, or model context as reusable credentials;
  • Atom is a connector, not a warehouse: we prefer just-in-time Graph reads over bulk copies of your mailbox or calendar;
  • Short-lived invoke caches (minutes, server-capped) may hold recent read results and expire automatically;
  • Minimum tool results may be sent to your chosen LLM provider to answer your request; that provider’s policy applies to those payloads.

8.3 No training on Microsoft organisational data

Qwixl does not use Microsoft organisational data (mail, calendar, tasks, or related Graph payloads) to train or fine-tune models. Owner-selected LLM providers process only what is sent for a turn under their terms and DPAs.

8.4 Disconnect and deletion

When you disconnect Microsoft Graph (once available in product):

  • We revoke the refresh token at Microsoft where the API allows;
  • We delete OAuth slots from the encrypted vault and clear related invoke cache entries;
  • Residual copies in encrypted backups age out within the backup window below.

8.5 Transfers

Graph calls go to Microsoft endpoints. Hosted agent runtime and vault storage for tokens run on Qwixl infrastructure (see processors above). International transfer safeguards in section 11 apply where personal data leaves the UK.

9. Hosted vs self-hosted

Hosted (Qwixl-operated)

We process and store your agent data on infrastructure we manage under paid Standard and BYOK plans. You may export your agent store and migrate to self-hosting from Settings. Export formats and procedures are documented in the product and on GitHub.

Self-hosted (you-operated)

If you run atom agent start or Docker on your own hardware, you are the data controller for that deployment. Data stays on your systems unless you connect to external peers or cloud LLMs. The shell may still connect to atom.qwixl.com for registry modules or discovery if you configure it to do so. Self-hosted use does not incur a Qwixl hosting fee.

10. Cookies and local storage

We use:

  • Strictly necessary storage — session tokens, authentication state, security flags, and (where applicable) checkout/session continuity;
  • Functional storage — theme preference, local preferences;
  • Analytics — if introduced, we will update this policy and request consent where required under PECR / UK GDPR.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent login or hosted agent access.

11. International transfers

Qwixl Ltd is based in the United Kingdom. Some processors may store or process data in the United States or other countries. Where personal data is transferred outside the UK, we use appropriate safeguards such as the UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses, or adequacy regulations, as applicable.

12. Retention

We retain personal data only as long as necessary for the purposes above:

  • Account profile and handle — for the life of your account;
  • Hosted agent store and operational data — while your hosted agent is active; deleted or anonymised within 90 days of account closure unless law requires longer retention;
  • Billing and tax records — as required by law (typically up to 6 years for certain financial records);
  • Control-plane abuse and signup metadata — typically up to 90 days;
  • Microsoft OAuth tokens — until you disconnect Microsoft or delete the account;
  • Graph invoke cache — minutes (server-capped; not a durable warehouse);
  • Encrypted infrastructure backups — rolling window of up to 35 days (target), after which aged data is not indefinitely restorable;
  • Support correspondence — up to 24 months after resolution.

Material changes to retention practices will be reflected in this policy.

13. Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS), access controls, isolated hosted agent containers, encrypted connector vaults for provider credentials, and secret handling practices that avoid storing LLM keys in browser storage on production hosts. Chat and connector reads on hosted accounts use short-lived scoped session tokens where implemented, reducing reliance on long-lived admin credentials in the browser.

No system is perfectly secure. Report vulnerabilities responsibly via GitHub Security Advisories or support@qwixl.com. We will investigate and respond in good faith.

14. Your rights

Under UK data protection law, you have the right to:

  • Access a copy of personal data we hold about you;
  • Rectify inaccurate data;
  • Erase data in certain circumstances (“right to be forgotten”);
  • Restrict or object to processing in certain circumstances;
  • Data portability for data processed by automated means under contract or consent;
  • Withdraw consent where processing is consent-based;
  • Disconnect Microsoft Graph and request deletion of related tokens and cached Graph results;
  • Export your agent data via the encrypted export bundle in Settings (where available);
  • Not be subject to solely automated decisions with legal or similarly significant effects (Atom does not make such decisions about you).

To exercise rights, email legal@qwixl.com or support@qwixl.com. We may need to verify your identity. We respond within one month, extendable where permitted by law.

15. Children

Atom is for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it promptly.

16. Changes to this policy

We may update this policy as the product, law, or our processing practices change. We will post the revised version on this page with an updated date. For material changes affecting hosted users, we will provide notice in-product or by email where appropriate.

17. Complaints (ICO)

If you have concerns about our use of personal data, contact us first at legal@qwixl.com or support@qwixl.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

18. Contact

Privacy and data enquiries: legal@qwixl.com

Support: support@qwixl.com

Qwixl Ltd — Atom, United Kingdom (registered office details available on request / Companies House)