AtalayaOnly what people publish professionally.

Privacy

Privacy notice (Atalaya)

What the platform processes, where it is hosted, and how a tenant is erased. This is Atalaya's own notice (PRD §10 L-7) and it travels with every communication.

What it processes

  • Public professional data about companies and people, always with a source URL and a date.
  • The brand sheets you write and upload: the project context is always your own text.
  • The content pieces generated, approved and published, and their measured engagement.
  • No special categories are processed: health, religion, politics, sexuality, family, geolocation and breaches are discarded by pattern before the model.

Where it is hosted

  • The services and the tenant data live on servers we own in the EU (Germany). No third-party cloud holds that data.
  • Each tenant has its own database; isolation is selected from the authentication context, never from client-supplied input.
  • This public site is static and served from our own edge on the same EU servers as the app. It holds no tenant data.
  • The language model is called over an API and only drafts; every text entering it passes a security inspection first. If the model goes down, Atalaya keeps working: it just stops drafting.

How a tenant is erased

  • The right to erasure (GDPR art. 17) runs as one ordered transaction: the tenant's rows go first, then its data-encryption key. Per-tenant encryption is not live yet, so the key step is a documented no-op today — the rows are the deletion.
  • Retention: 12 months without interaction means erasure (PRD §10 L-3).
  • You can exercise access (art. 15) and erasure (art. 17) through the privacy channel. A request is accepted straight away (HTTP 202) and confirmed by email later; that confirmation link ships with the mailer (T-025), so until then you can also write to privacidad@atalaya.page. The answer is identical whether or not the datum exists, so the platform never reveals who is on it.

Rights: access (art. 15), portability (art. 20) and erasure (art. 17). Legal basis: legitimate interest for B2B, assessed case by case.