Privacy policy

Dashlets is a project by Atomian. The legal entity responsible for this service and its dedicated privacy contact must be confirmed before this policy is finalized. You can currently direct an enquiry to Atomian through its website.

For account administration, billing and service security, the service operator generally acts as a controller. For personal data your organization submits in prompts, files and workspace content, your organization generally decides the purpose of processing and the service operator acts on its instructions. These roles depend on the actual processing and must be documented in the applicable agreement. Contact Atomian about a data-processing agreement before using the service with personal data requiring one.

Account and workspace data include your email address, display name, account identifier, workspace name and slug, role and dashboard access. Authentication processes your sign-in credentials and session information.

Task data include Dashlet titles, configured prompts, selected models, form fields, submitted text, document or image contents and filenames, supplied URLs, questions, generated outputs, run timestamps and reported credit usage. Completed runs save their inputs and outputs in history. An uploaded file sent as part of an input may therefore be included in saved run data, not only used momentarily for inference.

Billing data include the plan, trial and subscription status, billing-period information, Stripe customer and subscription identifiers, and top-up purchase records. Stripe collects payment details in its checkout; Dashlets does not collect full payment card numbers in its own forms.

Hosting, authentication and processing services may generate technical information such as IP addresses, request identifiers, device or browser information and error logs for delivery, security and troubleshooting. The final policy must specify the logging and retention actually configured for those services.

Data is used to authenticate users, maintain workspaces and permissions, run configured AI tasks, display history, measure usage, process subscriptions and top-ups, respond to requests and protect the service.

Where GDPR applies, processing necessary for an individual’s service contract relies on contractual necessity; applicable billing and compliance records rely on legal obligations; proportionate security, troubleshooting and business-account administration may rely on legitimate interests, balanced against individual rights. Customer-controlled task data is processed on the customer’s documented instructions and lawful basis, not on a blanket consent inferred from using a tool.

Optional marketing or non-essential tracking, if introduced, requires the appropriate separate legal basis and consent where required. Acknowledging this notice is not consent to marketing, advertising, model training or unnecessary tracking.

Dashlet run history may be private or shared according to the creator’s settings and access permissions. Shared history can expose submitted inputs and outputs to other authorized users. Your organization controls its membership and access settings. Check with its owner before submitting information you do not want shared.

The app uses Lovable Cloud for account, database and hosting services and Stripe for payments. Running a task sends its prompt, configuration, submitted inputs, selected model and web-search setting to Atomian’s processing service. The request also includes user, workspace, dashboard and Dashlet identifiers and a request identifier. File and image inputs can include their full contents encoded for transmission.

The processing service may forward data to the AI provider used for the selected model. Web-search tools may send queries to Tavily; URL analysis involves retrieving content from the supplied website. Those providers receive the data necessary for the relevant task. The active models, downstream processors, locations and contractual safeguards must be confirmed with Atomian; these drafts do not promise zero retention or that providers never use data for model training.

Data may also need to be disclosed to meet a lawful requirement or investigate a security incident. This policy does not authorize unrelated advertising disclosure or sale of task content. Provider arrangements must be reviewed before confidential or regulated material is submitted.

Hosting, payment and AI processing may take place outside your country, including outside the European Economic Area. No EU-only data-residency guarantee has been established for this service.

Where required by applicable law, international transfers need a valid mechanism, such as an adequacy decision or standard contractual clauses with any necessary supplementary safeguards. Atomian must confirm the actual processing locations, recipients and transfer mechanisms before this notice is finalized. Request those details before submitting data with residency restrictions.

The current app saves completed run inputs and outputs; it does not define an automatic deletion schedule for run history. Account, workspace and subscription records are also stored. Viewing a limited number of recent runs is not a retention limit.

A fixed retention schedule for task data, uploaded content, logs, backups and closed accounts has not yet been approved. The final policy must establish periods based on service necessity, customer instructions, security needs and legal recordkeeping. This draft does not claim immediate erasure on cancellation or indefinite availability.

Contact Atomian to request deletion or clarify retention. The request may require identity and workspace authorization checks, and legally required records or limited backup copies may be treated separately. For personal data controlled by your organization, contact its owner or privacy contact first.

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests and withdraw consent where processing relies on consent. Rights are subject to legal conditions, and withdrawing consent does not affect earlier lawful processing.

Send a request through Atomian’s website, identifying Dashlets and your workspace. Do not include passwords, complete payment details or unnecessary sensitive documents. Atomian may need proportionate information to verify identity. Requests must be handled within applicable statutory deadlines. You may also complain to your competent data-protection authority.

If your organization controls the information in a workspace, its response may be required; the service operator should assist according to its agreement and legal obligations.

The service uses authenticated accounts and workspace permissions to restrict access. No system is risk-free. Protect your credentials, review shared-history settings, sign out on shared devices and report suspected exposure promptly. Persistent sign-in is designed for convenience and is not a guarantee that a session will never expire.

Dashlets is intended for adult organizational users, not services directed to children. Do not submit children’s data without verifying the lawful basis and appropriate arrangements with Atomian.

Changes to this notice will be dated and material changes should be communicated where required. The Cookie policy explains browser storage used for sign-in and any future optional tracking.