Privacy Policy

This Privacy Policy explains how Atlee Technologies LLP (“Atlee”, “we”, “us”), acting as a Data Fiduciary, collects, uses, shares and protects your personal data (“you” / the “Data Principal”). We comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, as they come into force, and with applicable provisions of the Information Technology Act, 2000.

1. Personal data we collect

• Information you give us — name, email, phone, company, and the contents of enquiries or project briefs you send us.
• Billing & payment records — your billing name, address and GSTIN (if any), invoices, and for each payment only its transaction reference, amount, date and status (see section 7). We never receive your full card number, CVV, UPI PIN or net-banking credentials.
• Client & portal data — account credentials and the data you submit through our client/developer portal.
• Technical & usage data — privacy-first, cookieless analytics (via self-hosted Umami), error telemetry (via self-hosted GlitchTip) and server logs, used to operate and secure our services.
• Mobile app data — for our Atlee Tech Hub app, a device push-notification token and a per-device authentication token, used only to deliver notifications and sign the device in (see section 12).
• Data we process on behalf of clients — where we build and operate software for a client, we act as a processor on their instructions; that client's own privacy policy governs end-user data.

2. Purposes of processing

We process personal data only for specified, lawful purposes: to respond to enquiries and provide quotes; to deliver, operate, monitor and support the products we build; to manage billing and comply with tax/legal obligations; to secure our systems and prevent abuse; and to communicate with you about your engagement.

3. Legal basis & consent

We process your personal data on the basis of your consent, or as necessary to perform a contract with you, or to comply with law. Where we rely on consent, you may withdraw it at any time — and doing so will be as easy as giving it — by writing to our Grievance Officer below. Withdrawal does not affect processing already carried out.

4. Data retention

We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. When the purpose is fulfilled and no legal obligation requires retention, we delete or anonymise it. In practice:

• Invoices, payment references and accounting records are kept for as long as Indian tax and LLP law require, currently up to 8 years.
• Engagement and portal data is kept for the duration of the engagement, then returned or deleted as agreed in the SOW. Encrypted backups that contain it expire on their normal rotation cycle.
• Enquiries that do not become an engagement are deleted within 24 months of our last contact with you.
• Server logs and error telemetry are kept for short, rolling periods, only as long as needed to operate and secure our services.
• If you withdraw consent or ask us to erase your data, we delete it unless the law requires us to keep it, in which case we keep only what is required, for only as long as required.

5. Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it;
• Correction & erasure of inaccurate, incomplete or no-longer-needed data;
• Grievance redressal through the mechanism below;
• Nominate another person to exercise your rights in the event of death or incapacity;
• Withdraw consent at any time.

To exercise any right, contact our Grievance Officer (section 11). We respond within 48 hours, and complete your request within the timelines required by law.

6. Sharing & processors

We do not sell personal data. We share it only with trusted infrastructure and tooling providers strictly to deliver our services (for example, cloud hosting, email and the payment gateways described in section 7), under appropriate safeguards, and where required by law or competent authority.

7. Payment data

When you pay Atlee for our services online, the payment is processed by an RBI-authorised payment aggregator or payment gateway such as Razorpay, Cashfree, PayU or PhonePe.

• Your card number, CVV, expiry date, UPI PIN and net-banking credentials are entered on and handled by the gateway's own systems, which are PCI-DSS compliant. They are never entered on, sent to or stored on Atlee's systems.
• From the gateway, Atlee records only transaction references: the payment or order ID, the amount, the date and whether the payment succeeded, so we can issue your invoice, reconcile accounts and process refunds.
• The gateway processes your payment data under its own privacy policy and RBI's rules for payment aggregators, including its rules on storing card data.
• Bank transfer and direct UPI payments show us only what appears on our bank statement: the payer name, amount, date and bank reference.

8. Security & data breaches

We implement reasonable technical and organisational security measures. As a studio that operates what it builds, we maintain active error monitoring, uptime monitoring and on-call paging. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDP framework.

9. Children's data

Our services are directed at businesses and are not intended for individuals under 18. We do not knowingly process children's personal data without verifiable parental/guardian consent, and we do not carry out behavioural tracking or targeted advertising directed at children.

10. International processing

Where data is processed outside India by our service providers, we take steps to ensure it remains protected consistent with this policy and applicable law.

11. Grievance Officer

For any questions, requests or complaints regarding your personal data, contact:

If your grievance is not satisfactorily resolved, you may escalate to the Data Protection Board of India in accordance with the DPDP Act.

12. Mobile application (Atlee Tech Hub)

Atlee Tech Hub is an invite-only operations app for the Atlee team and authorised collaborators; access is tied to an existing Atlee account and there is no public sign-up. In connection with the app we process:

• A push-notification token (Apple Push Notification service) and a per-device authentication token, linked to your Atlee account and used solely to deliver alerts and authenticate the device to our backend (app functionality). They are not used for tracking or advertising, and are revocable — you can unpair the device in the app and we can revoke the token server-side.
• Operational data you are already authorised to see — the app shows the signed-in user their own organisation's infrastructure, alerts, work and finance figures; it does not collect additional personal data from your device.
• Biometrics (Face ID / Touch ID) are used locally on your device to unlock sensitive figures, entirely within Apple's Secure Enclave — we never receive or store your biometric data.

The app contains no third-party analytics or advertising SDKs and does not track you across other apps or websites.

13. Changes to this policy

We may update this policy as our services or the law evolve. Material changes will be reflected by the “Last updated” date above.