Version: 2026-09-27.
1. Parties and roles
- Processor: AtlyTech s.r.o., IČO 29944627, DIČ CZ29944627, registered office Dandova 2619/13, Horní Počernice, 193 00 Praha 9, registered at Městský soud v Praze, oddíl C, vložka 454920 ("AtlyTech", "we").
- Controller: the customer who determines the purposes and instructs AtlyChat to process personal data of other people ("Customer", "you"). This includes business or professional use, the inference API, connected mail, calendar and Drive, and groups or the workbench when they contain other people's data.
- This Data Processing Agreement (DPA) applies when AtlyChat processes personal data on your behalf to provide AtlyChat.
- When a person uses AtlyChat only for themselves, that person is the data subject and AtlyTech is the controller. That relationship is described in the privacy notice at /legal/privacy, not in this DPA.
2. Subject matter and duration
AtlyChat processes Customer personal data on the Customer's instructions to provide conversations, voice, images, video, files, memory, assistants, projects, groups, the workbench, connected mail, calendar and Drive, the optional Atly Office connection, and the inference API. Processing continues for the term of the service relationship and for a reasonable closure window after termination or an account-deletion request, unless a longer period is required by law.
3. Nature and purpose of processing
Nature: infrastructure operation, storage, retrieval, analysis, transcription, summarisation, drafting, image and video generation, logging, and transmission to the sub-processors listed below as needed to run the product.
Purpose: deliver AtlyChat on the Customer's instructions. AtlyTech does not train or fine-tune foundation models on Customer content.
4. Types of personal data
Depending on what the Customer uses, processing may include:
- Account data: name, email, authentication identifiers, locale, and preferences.
- Conversation content and files the Customer submits, including memory, assistant and project instructions, group messages, and workbench documents.
- Connector content when the Customer connects a service: Gmail (read, drafts, and send), Outlook mail, Seznam mail (IMAP/SMTP), Google Calendar, and Google Drive. Drive writes, and the public path of choosing a specific file, run only after the Customer confirms in the thread where a write is requested.
- Optional Atly Office connection: data AtlyChat reads or acts on in the Customer's Atly account, on the Customer's instruction. Company communications inside Atly remain under the Atly agreement at https://atly.work/legal/dpa.
- Inference API prompts and completions (
POST /v1/chat/completions) on the same account and credit ledger as the web app. - Billing identifiers. Payment cards are handled by Stripe and are not stored in AtlyChat.
AtlyChat does not seek special categories of data. The Customer must not intentionally submit special-category data unless the Customer has a lawful basis and instructs AtlyTech accordingly.
Sending mail, creating a calendar event, and changing Drive run only after the Customer confirms in the chat.
5. Categories of data subjects
- The Customer and people the Customer invites into a group.
- People appearing in connected mail, calendars, files, group messages, workbench documents, or inference API payloads.
6. Customer instructions
AtlyTech processes personal data only on documented Customer instructions: use of the product, connected integrations, confirmation of a write in the thread, and written instructions (including support requests). AtlyTech informs the Customer if an instruction appears to infringe the GDPR and may refuse an unlawful instruction.
7. Confidentiality
Persons authorised to process personal data are bound by confidentiality obligations (contractual and/or statutory).
8. Security measures (summary)
Technical and organisational measures include, as implemented in the product:
- HTTPS for the application and TLS for live integrations.
- Password hashing with argon2id for password-based accounts.
- Encryption of connector and Atly Office tokens at rest (AES-256-GCM).
- Isolation so each account sees only its own data.
- Confirmation in the thread before mail is sent, a calendar event is created, or Drive is changed.
- Account deletion removes the account and the stored chats and files.
9. Sub-processors
The Customer authorises AtlyTech to use the following sub-processors, as configured for the service:
- Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) for hosting, the database, and file storage.
- Together AI for model inference, including text and, where the product offers them, image, video, and voice.
- Stripe for subscription billing and top-ups. Payment cards are handled by Stripe. AtlyChat does not store card numbers.
- Cloudflare (Turnstile) for bot protection on sign-up, sign-in, and password reset. Cloudflare receives the visitor IP, user agent, and browser signals for the challenge. It does not receive conversation content. Provider transfer tools (for example standard contractual clauses) apply under Cloudflare's terms.
- Transactional email for account messages such as verification and password reset.
- Google, when the Customer signs in with Google or connects Gmail, Google Calendar, or Google Drive.
- Microsoft, when the Customer signs in with Microsoft or connects Outlook.
- Seznam, when the Customer connects Seznam mail.
- Sentry (Functional Software, Inc.) for application error diagnostics. Personal data in error payloads is scrubbed before transmission. Provider transfer tools (for example standard contractual clauses) may apply depending on the Sentry organisation region.
AtlyTech informs Customers of a material sub-processor change by a product notice or a documentation update, with reasonable advance notice where feasible. Continued use after that notice is acceptance.
10. International transfers
Where a sub-processor processes data outside the EEA, the transfer relies on that provider's transfer mechanism (for example standard contractual clauses or an adequacy decision) as stated in that provider's terms. The Customer should review those terms for the Customer's region.
11. Assistance to the controller
Taking into account the nature of the processing, AtlyTech assists the Customer with:
- Responses to data-subject requests (access, rectification, erasure, restriction, portability, objection), to the extent the data is in the product, including export, account deletion, and disconnecting an integration.
- Notice of a personal-data breach affecting Customer data in AtlyChat, without undue delay after AtlyTech becomes aware of it.
- A data-protection impact assessment or prior consultation, by providing this DPA and a description of the product on request.
12. Retention, return, and deletion
- The Customer may disconnect an integration in the product. Data from that connection then follows the product's cleanup for the connection.
- Files the Customer uploads stay for as long as the account keeps them.
- On termination or a written deletion request, AtlyTech deletes the account and Customer personal data in AtlyChat storage within a reasonable period, except data AtlyTech must keep under law or for dispute and security logs. Retained logs are minimised and access-controlled.
13. Audits
On a reasonable written request, and no more than once a year unless a breach investigation requires otherwise, AtlyTech makes available the information needed to demonstrate compliance with Article 28 (this DPA and a security summary). An on-site audit needs agreement on scope, timing, and confidentiality. The Customer bears the external auditor's cost unless a material breach by AtlyTech is confirmed.
14. AI annex
- No training: Customer personal data is not used to train or fine-tune third-party foundation models. Inference runs through the Together AI API.
- Confirmation: sending mail, creating a calendar event, and changing Drive run only after the Customer confirms in the chat.
- The inference API uses the same account and credit ledger as the web application.
15. Liability
Liability under this DPA follows the Terms.
Public page: /legal/dpa. Related: /legal/privacy, /legal/terms, /legal/cookies.