Privacy Policy

Last updated: 2026-09-10

This Privacy Policy explains how Atrix Digital LLC (“Atrix”, “we”, “us”) collects, uses, shares and protects personal data when you visit atrix.dev, contact us, or use our client dashboard and services.

1. Who we are

Atrix Digital LLC is a software development company with operations in the United Kingdom, the United Arab Emirates and the United States. For the purposes of UK and EU data protection law, we act as the data controller for personal data collected through this website, and as a data processor when we handle data on behalf of a client under a services agreement.

2. Personal data we collect

Data you give us

Contact and enquiry data — name, email address, phone number, company name and the content of your message when you use our contact, Get Started or Talk to Experts forms.
Account data — if you create an account, your email address, name and authentication identifiers.
Billing data — where you purchase a service, the billing details required to process payment. Full card numbers are never stored on our systems.
Recruitment data — CV, work history and any information you submit when applying through our Careers page.
Content you submit — messages and prompts you send to our AI-assisted features.

Data collected automatically

Technical data — IP address, browser type and version, device type, operating system, referring URL and timezone.
Usage data — pages visited, time on page, links clicked and navigation paths.
Cookie data — see our Cookie Policy for the full breakdown, including the language preference cookie we set when you change languages.

3. How we use your data

To respond to your enquiries and provide quotes or proposals.
To deliver, maintain and support the services you have engaged us for.
To authenticate you and secure your account.
To process payments and maintain financial records.
To assess job applications.
To improve our website and services through aggregated, non-identifying analytics.
To send service communications, and — only where you have opted in — marketing communications. You can withdraw consent at any time.
To comply with legal, tax and regulatory obligations.

4. Legal bases for processing

Where UK GDPR or EU GDPR applies, we rely on the following legal bases:

Contract — to provide services you have requested or to take steps before entering into a contract.
Legitimate interests — to run, secure and improve our business, balanced against your rights.
Consent — for marketing communications and non-essential cookies.
Legal obligation — for accounting, tax and compliance requirements.

5. Service providers

We share personal data with a limited set of processors who help us operate. Each is bound by contractual confidentiality and security obligations:

Vercel — website and application hosting, edge delivery and logs.
Better Auth — authentication and session management. This runs on our own infrastructure, so your credentials are not shared with a third-party identity provider.
Stripe — payment processing. Stripe handles card data directly under its own privacy policy; we never receive full card numbers.
Sanity — content management for our blog and marketing pages.
AI model providers — where you use our AI-assisted features, your prompts are transmitted to a model provider to generate a response.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

6. International transfers

We operate across the UK, UAE and US, and some of our providers are based outside your country of residence. Where personal data is transferred out of the UK or EEA, we rely on appropriate safeguards such as UK International Data Transfer Agreements, EU Standard Contractual Clauses, or an adequacy decision.

7. Retention

We keep personal data only as long as necessary for the purpose it was collected for. As a guide: enquiry data for up to 24 months from last contact; account and project data for the life of the engagement plus 6 years for legal and tax purposes; unsuccessful job applications for 12 months. We delete or anonymise data once these periods expire.

8. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request erasure of your data.
Object to or restrict certain processing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time, without affecting prior processing.

To exercise any of these rights, email us at hello@atrix.dev. We respond within one month. If you are unhappy with our response, you may complain to your local supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

9. Security

We apply appropriate technical and organisational measures including encryption in transit, access control on a least-privilege basis, multi-factor authentication for internal systems and regular review of our providers. No system is perfectly secure, but we take these obligations seriously and will notify you and the relevant regulator of a qualifying breach without undue delay.

10. Children

Our services are directed at businesses and are not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

11. The Atrix iPhone app

The app is a companion to a workspace you already belong to. It signs in against that workspace and reads and writes the same records the dashboard does — messages, documents, work items, products and ideas. It creates no separate account and stores no data of its own beyond what is needed to work.

What the app handles

Your name, email address and picture, as your workspace already holds them, so the app can show who wrote what.
What you write and send — messages, replies, reactions, documents, posts and any photo you attach. These belong to the workspace that owns them and are visible only to its members.
A notification token for the device, so a mention can reach your phone. It identifies the phone rather than you, and it is deleted when you sign out.

What the app does not do

There is no advertising, no analytics and no tracking. The app contains no third-party tracking or advertising software of any kind, and nothing it handles is used to follow anybody across other companies’ apps or websites.
Photos and the camera are reached only at the moment you attach a picture to a message. The app does not browse your library, and declining leaves everything else working.
The app does not read your contacts, your location, your calendar, your health data or anything else the workspace does not need.

Sample mode

The app can be opened without an account, on made-up data, from the Look around with sample data option on its first screen. In that mode it talks to nothing: no account exists, no request leaves the device for a workspace, and nothing you type is sent anywhere.

Leaving

Signing out removes the credential and the notification token from the phone and clears what had been cached on it, including any half-written message. Removing your account is described in section 8, and applies to the app and the dashboard alike.

12. Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision, and material changes will be highlighted on this page.