ATROVIAPolicies

Privacy Policy

Effective 16 September 2026 · Version 2026-09-16

This policy explains what information Atrovia collects, why we collect it, who we share it with, how long we keep it, and how you can get it back or have it deleted. We do not sell your personal information, and we do not use your business data to train AI models for anyone else.

1. Who we are

Atrovia Corporation (“Atrovia”, “we”, “us”) operates the Atrovia platform at atrovia.co and its associated applications. Atrovia is a business management platform for small businesses, covering marketing, sales and CRM, operations, and finance.

Our registered address is 937 N. Amphlett Blvd., San Mateo, CA 94401. For privacy questions, contact admin@atrovia.co.

Two kinds of people in this policy

Our customers. Businesses that sign up for Atrovia, and the people who use Atrovia on their behalf. For their account data, we are the controller.

Their customers. People whose details a customer stores in Atrovia — their contacts, leads and clients. For that data we are a processor: our customer decides what is collected and why, and we handle it on their instructions. If you believe a business is storing your details in Atrovia and you want them changed or removed, contact that business first; we will help them act on your request.

2. What we collect

Information you give us

Account details — name, work email, business name, role, phone number.
Billing details — handled by our payment processor. We never see or store full card numbers.
What you tell the platform — answers you give during setup, the numbers you enter in your plan, documents you upload, and the content of conversations you have with the Atrovia agents.
Support requests — anything you send us by email or through the app.

Information we collect automatically

Usage data — pages viewed, features used, timestamps, and which parts of setup you have completed.
Device and log data — IP address, browser type, operating system, referring page, and error logs.
Cookies and similar technologies — see section 15.

3. Data from services you connect

Atrovia is only useful when it can see your real numbers, so you may choose to connect other services. Every connection is optional, made by you, and can be disconnected at any time. We request the narrowest permissions that let the feature work.

Service	What we read	What it powers
QuickBooks Online	Financial reports, chart of accounts, invoices, bills, payments, customers, vendors, employees and items	Break-even, margin, cash position, revenue per person, budgets, job costing
Google Ads	Campaigns, spend, conversions, keywords	Cost per lead and return on ad spend
Google Analytics	Traffic, conversions, channel data	Where customers come from
Google Search Console	Search queries, impressions, clicks	Search visibility
Google Business Profile	Listing details, reviews, insights	Local visibility and review flow
Meta (Facebook & Instagram)	Ad accounts, campaigns, spend, results	Paid social performance
Email and CRM tools	Contacts, lists, campaign results, deals	Pipeline, follow-up and reporting

We only read what the feature needs. Where a connection allows write access, we use it only for actions you explicitly ask for, and we tell you before anything is created, changed or sent.

Google accounts (Gmail, Google Calendar, Postmaster Tools)

When you connect a Google account, Atrovia asks only for what these features need:

Send email as you (gmail.send): to send the messages you write or approve in Atrovia — quotes, invoices, replies and campaigns — from your own address. We do not read, list or store the messages in your inbox.
Your calendar (calendar.events): to show your appointments in Atrovia and to create or update the events you book from it.
Sender reputation (postmaster.readonly, only if you connect it): to read how Gmail rates your sending domain, so Atrovia can slow your sending down before it hurts your delivery.
Marketing data (Google Analytics, Ads, Search Console, Business Profile, Tag Manager, only if you connect them): to read reporting data for your dashboards and recommendations, and to make the changes you approve.

Data from Google is used only to provide these features to you. We do not sell it, use it for advertising, or use it to train general-purpose AI models. People at Atrovia do not read it unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it. You can disconnect at any time in Settings → Connectors or in your Google Account's security settings; we then stop using it and delete the stored access.

Atrovia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. QuickBooks Online specifically

Our commitments on your accounting data

QuickBooks connects to Atrovia, and only to Atrovia. When you connect, you authorise the Atrovia app. Atrovia Corporation holds the connection and is the only company that can reach your QuickBooks company. No other company — including our hosting, database and AI model providers, and the other services you connect such as Google or Meta — is given access to your QuickBooks account or your connection tokens.
We use it only to provide Atrovia to you. It is never used for advertising, never sold, never rented, and never shared with another Atrovia customer. We do not export, save or store QuickBooks data for any purpose other than running the Atrovia features you use.
How the Finance agent uses it. When you ask Atrovia a question about your numbers, Atrovia's own servers retrieve the data, work out the figures, and include only the figures that answer needs when preparing the response. Our AI model provider processes that request on our behalf, returns the answer, and may not keep it or train on it. It never receives your QuickBooks connection or tokens and cannot access QuickBooks.
It is isolated per business. Every record is tagged to your organisation and every query is filtered by it. One customer cannot see another's data.
Your connection tokens are encrypted and held in a dedicated secret store — encrypted with AES-256, never kept in an ordinary database table, and never written to a log file or an error message. QuickBooks data itself is never written to our logs.
We do not post transactions to your books as part of the finance features described in this policy. Where any write capability exists, it happens only on your explicit instruction.
You can disconnect at any time, from Settings in Atrovia or from the Apps screen in QuickBooks. Disconnecting immediately stops all further access.

What happens when you disconnect. We stop syncing at once and revoke our stored tokens. Data already synced remains in your Atrovia account so your history and plan still work — you can delete it at any time from Settings, or ask us to delete it and we will do so within 30 days. If you close your Atrovia account, QuickBooks-derived data is deleted with the rest of your account as described in section 8.

Our use of information received from Intuit APIs adheres to the Intuit Developer Terms of Service, and we comply with its limited use requirements.

5. How we use AI

Atrovia uses AI models to read your data, prepare drafts, answer your questions and write the reports you see in the product. Two things are worth saying plainly:

Your business data is not used to train AI models — not ours, and not our providers'. Our AI providers process your data only to return the response you asked for, under contracts that prohibit training on it.
Data is never mixed between customers. An agent answering a question for your business sees only your business's data.

AI output can be wrong. Atrovia's agents prepare drafts and recommendations; a person at your business reviews and approves anything that matters. Nothing an agent produces is a substitute for professional accounting, legal or tax advice. How the agents work, and what you are responsible for reviewing, is set out at atrovia.co/ai-disclosure and in section 8 of the End User License Agreement.

6. Why we use your data

Purpose	Legal basis (UK/EU)
Providing the platform and its features	Performance of a contract
Billing and account administration	Performance of a contract
Support and service communications	Performance of a contract
Security, fraud prevention and abuse detection	Legitimate interests
Improving and debugging the product	Legitimate interests
Marketing emails about Atrovia	Consent — withdraw any time
Meeting legal and tax obligations	Legal obligation

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We share it only in these situations:

Service providers who help us run Atrovia — hosting, databases, AI model providers, email delivery, payment processing, error monitoring and analytics. Each is bound by contract to protect the data and use it only to provide their service to us. Our current list is at atrovia.co/subprocessors.
Services you connect — when you ask us to send something to a connected service, we send what that action needs. QuickBooks data is never sent to another connected service.
People in your own organisation — according to the permissions your administrator sets.
Legal requirements — when we are legally required to, or to protect the rights and safety of people or our platform. Where we are permitted to tell you, we will.
A change of ownership — if Atrovia is involved in a merger, acquisition or sale of assets, data may transfer. We will give notice before your data becomes subject to a different privacy policy.

8. How long we keep it

While your account is open — we keep your data so the platform works and your history stays intact.
After you close your account — we delete or anonymise your business data within 90 days, except where we must keep records for legal, tax or accounting reasons.
Backups — deleted data can persist in encrypted backups for up to 35 days before those backups expire.
You can delete sooner. Ask us and we will delete your data within 30 days.

9. How we protect it

Encryption in transit (TLS) and at rest.
Row-level isolation per organisation, enforced in the database rather than only in the application.
Connection tokens encrypted with AES-256 and stored in a dedicated secret store, separate from application data.
Least-privilege access for staff, granted only where needed and reviewed regularly.
Logging and monitoring, with alerting on unusual access.

No system is perfectly secure. If a breach affects your personal information we will notify you and any required regulator without undue delay, and in any case within the time the law requires.

10. Your rights and choices

Depending on where you live, you may have the right to:

Access a copy of the personal information we hold about you
Correct information that is wrong or incomplete
Delete your information
Export it in a portable format
Object to or restrict certain processing
Withdraw consent at any time, without affecting what we did before
Complain to your data protection authority

Most of this you can do yourself in Settings. For anything else, email admin@atrovia.co and we will respond within 30 days. We will not discriminate against you for exercising any of these rights.

11. California residents

Under the CCPA as amended by the CPRA, you have the rights above plus the right to know what we collect and why. We collect the categories described in section 2: identifiers, commercial information, internet activity, geolocation inferred from IP, professional information, and — through connections you choose to make — financial information.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16.

To make a request, email admin@atrovia.co. You may use an authorised agent; we will ask for proof of their authority.

12. International transfers

Atrovia is operated from the United States and your data is processed there. If you are in the UK, EEA or Switzerland, we rely on Standard Contractual Clauses and equivalent safeguards for transfers. Contact us for a copy of the safeguards we use.

13. Children

Atrovia is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

14. Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, understand how the product is used, and keep the platform secure. You can control cookies in your browser settings; blocking essential cookies will stop parts of the platform working.

15. Changes to this policy

We may update this policy. The date at the top always shows the latest version. If a change materially affects how we handle your data, we will tell you by email or in the product before it takes effect.

16. Contact us

Atrovia Corporation
937 N. Amphlett Blvd., San Mateo, CA 94401
admin@atrovia.co
Privacy requests, security reports and general enquiries all reach us at this address.