Privacy Policy

Last updated: 2026-09-22

Who we are (controller)

What data we collect

• The PDF document you upload
• Your email address
• Technical data (IP address, browser/user-agent, timestamps)

Why we process it (purpose & legal basis)

We process your data solely to perform the document verification you request and to contact you with the result. Legal basis: your consent (given when you upload) and our legitimate interest in operating and securing the service.

How long we keep it

Uploaded files and the associated personal data are automatically deleted within 30 days of upload. After verification we retain only the minimum needed to answer follow-up questions, within that 30-day window.

Who we share it with

We do not sell or share your data with third parties. Uploaded documents are never used to train any models. We use an internal messaging channel only for our own operational notifications.

How we protect it

Files are transmitted over HTTPS and stored on access-controlled infrastructure, never exposed at a public URL. Access is limited to the operator. Verification itself is automated — no person reads your document to prepare the report.

Your rights

Under the GDPR and applicable data-protection law, you have the right to:

• Access your personal data
• Rectification of inaccurate data
• Erasure of your data ("right to be forgotten")
• Restriction of processing
• Object to processing
• Data portability

To exercise any right, email [email protected]. You also have the right to lodge a complaint with your local data-protection supervisory authority.

California residents — CCPA notice

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights regarding your personal information.

Under the CCPA you have the right to: (1) know what personal information we collect and how it is used; (2) request deletion of your personal information; (3) opt out of any future sale of your personal information (there is currently none); and (4) non-discrimination for exercising these rights. To exercise any CCPA right, email [email protected] with the subject line "CCPA Request".

International transfers

The operator is established in Ukraine. Personal data of EU/EEA residents is processed in accordance with the GDPR. An EU representative under Art. 27 GDPR will be designated where required — this point is pending legal confirmation.

South Africa (POPIA)

This section applies to personal information about people in South Africa, including everything submitted through the South Africa section of this site (atomara.io/za/). It is written for the Protection of Personal Information Act 4 of 2013 (POPIA) and adds to the rest of this policy; where the two differ for a South African data subject, this section applies.

Responsible party and Information Officer

What the South Africa request form collects

• Your name, work email address and, if you give it, a phone (WhatsApp) number
• Your company, the kind of organisation you are (for example landlord or lender), the plan you are interested in and, on the extended form, expected documents per month, whether you need an API or integration and the name of that system
• Your message, if you write one, and the guide you asked for, if any
• Your POPIA consent and the time you gave it
• How you reached us: campaign (UTM) parameters, the page you first landed on, the referring website, the page you sent the form from and, only if you allowed analytics cookies, the Google Analytics client identifier
• Technical data: your country as derived from your IP address, your browser's language setting, your IP address and browser user agent (used to stop spam and abuse), and the time of the request

Why we use it and on what basis

We use this information only to answer your request: to contact you about access, pricing or a trial, to send you the material you asked for, to see which pages and campaigns bring requests, and to keep the form free of spam and abuse. We rely on your consent, given with the tick box on the form (section 11(1)(a) of POPIA), and on the processing being necessary to take the steps you asked for before any agreement is concluded (section 11(1)(b)). You can withdraw your consent at any time by writing to the Information Officer; this does not affect processing that took place before. We will not use your details for unrelated direct marketing without your separate consent.

Who receives it

Your request is stored in our database and copied to the spreadsheet or CRM service we use to track requests. Our team is notified by email and in a private work chat, and our reply reaches you through our email delivery provider. We do not sell your information or share it with anyone for their own purposes.

How long we keep it

Request data is kept for 12 months from the date you send it. After 12 months it is automatically deleted or anonymised: your name, contact details, company, message and technical identifiers are removed, and only figures that identify nobody (for example how many requests concerned a given plan) remain. Documents you upload for a check are deleted within 30 days of upload, as described above.

Transfers outside South Africa (section 72)

We are based in Ukraine and our servers are outside South Africa, so what you submit is transferred out of South Africa and processed abroad. Some of our service providers (email delivery, website delivery and security, and analytics if you allow it) may process it in other countries, including the European Union and the United States. We make these transfers because they are necessary to answer the request you made (section 72(1)(c) and (d)) and with your consent (section 72(1)(b)), and we apply the safeguards in this policy wherever the information is processed.

Security

Information is sent over HTTPS and stored on access-controlled infrastructure; access is limited to the operator. If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 of POPIA requires.

Your rights

• Ask whether we hold personal information about you and request a copy of it (section 23)
• Ask us to correct or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained (section 24)
• Object to the processing of your personal information (section 11(3)) and withdraw your consent at any time
• Object to direct marketing
• Complain to the Information Regulator

Cookies and analytics

Analytics and advertising measurement on the South Africa section work exactly as described under Cookies below: they run only after you allow them in the cookie banner. The request form works whether or not you allow them.

Cookies

Cookies that the site needs to work (your session, security, and the cookie choice you made) are always set. Analytics tools (Google Analytics, PostHog and, where enabled, Microsoft Clarity) and Google Ads measurement stay switched off until you allow them in the cookie banner, and you can change that choice at any time with the cookie settings button. Forms and uploads work whether or not you allow them.

Changes & contact

We post any updates to this policy on this page with a new "last updated" date. Questions: [email protected].