This policy explains what Atlas Pay collects when you use the product, why we collect it, who processes it on our behalf, and what you can ask us to do with it.
Last updated September 1, 2026
1. Who we are
Atlas Pay is a payment platform for businesses. It lets a business accept card payments through payment links, QR codes, contracts, subscriptions, an eCommerce catalogue, and digital gift cards, and then follow the resulting customers, payments, refunds, and payouts in one place.
This policy covers the Atlas Pay website, the mobile app, the desktop app, and the merchant portal. It applies to the person who signs up and to anyone they add as a team member. When your customer pays you through a secure payment page, the sale is between you and them, and you are responsible for your own customer data.
Where this policy says “we”, it means Atlas Pay. Where it says “your account”, it means the account and business profile created when you sign up.
2. What we collect
We collect four categories of information, all of them tied to an account.
Account identity
Your email address and a securely hashed password, or the basic profile returned by a sign-in provider if you choose to sign in that way.
The information submitted during identity verification, which is what unlocks payouts and the rest of the secure financial features.
Session records that let us keep you signed in, and the timestamps of account creation and recent sign-ins.
Business profile and activity
Business name, country, default currency, and the support contact details you want shown to your customers.
The payout bank account you link, and its eligibility status.
Records created by using the product: payment links, QR codes, contracts, subscriptions, catalogue products, gift cards, the customers built from real activity, refunds, and the payments and payouts behind them.
Team members you add, and — on Pro — the audit trail and activity log of what each of them did.
Support messages and attachments
The subject, message, and category of anything you send support, plus images you attach. Please do not attach documents containing full card numbers or government identifiers — we do not need them, and we will delete them if we receive them.
Our replies, and the status history of the conversation.
Usage and diagnostic data
Server logs from the API: the requested route, HTTP status, timing, a truncated IP address, and user-agent string, used to investigate errors and abuse.
Application error reports and health-check results.
Aggregate usage of the apps and the portal, used to find the steps people abandon.
3. What we never collect
Atlas Pay does not collect, process, or store your customers’ card numbers, CVC codes, or card expiry dates. Card details are entered by the payer on the secure payment page and handled by the licensed processors behind it, so they never pass through your account, your website, or anything you host.
There is no card data to hold. What reaches your account is a description of a payment — amount, currency, status, the brand and last four digits of the card as the processor reports them, and the customer’s name and email address where they supplied one. That is what appears in the portal.
We also do not sell personal information, we do not share it with advertising networks, and we do not run third-party advertising or cross-site tracking scripts on this website.
4. How we use it
To run the service. Creating your account, authenticating you, creating links, codes, contracts and subscriptions, taking payments, and paying out to the bank account you linked.
To support you. Answering questions, reproducing a problem you report, and telling you when something we run is degraded.
To keep the platform safe. Detecting abuse, rate-limiting, investigating suspicious sign-ins, and meeting the obligations that come with handling money.
To improve the product. Understanding which flows people abandon, in aggregate, so we can make them shorter.
To communicate. Service messages such as security notices, changes to this policy, and replies to a message you sent us. Marketing email, if we send it at all, is separate and can be switched off without losing service notices.
We do not use your account data to train machine-learning models, and we do not give a third party a copy of your records for its own purposes.
5. Processors we use
Atlas Pay runs on infrastructure and partners that process data on our behalf, for the stated purpose only. The roles below describe what each kind of provider does.
Payment partnersPayments
Licensed payment processors and the card networks behind them. They operate the checkout, handle all card data, and move the money from your customer to your bank account. Each one’s own privacy policy governs what it does with the information collected on its pages.
Identity verificationOnboarding
Checks the identity documents you submit when you verify a business, so that payouts can be enabled. We keep the outcome of the check and the minimum needed to evidence it.
Cloud infrastructureAPI and database
Runs the API the apps are built on and the database that holds accounts, business profiles, customer records, and the payment ledger, plus network-level protection for the API.
HostingWebsite and portal
Serves this website and the merchant portal, and produces standard request logs. The front end holds no secrets and stores no card data.
Email deliveryReceipts and notices
Sends the email receipts, contract copies, and service notices the product generates, and records whether a message was delivered.
Sign-in providerOptional
Used only if you choose to sign in with an external account. We receive your name, email address, and profile image URL. We never receive your password, and we request no further access to that account.
The named providers behind each role will be listed here by name before this policy is finalised, alongside the governing-law terms.
These providers operate globally, so your information may be processed on servers outside your country. We use providers that offer standard contractual protections for those transfers. We will update this list when a processor is added or removed.
6. Cookies and sessions
We use a small number of strictly necessary cookies. The important one is a same-origin session cookie that keeps you signed in; it is HTTP-only, so scripts in the page cannot read it. We also store short-lived state needed to complete a sign-in safely.
We do not set advertising cookies and we do not embed third-party tracking pixels. Blocking strictly necessary cookies will prevent you from signing in.
7. How long we keep it
The periods below are proposed defaults and are still to be confirmed, alongside the governing-law terms.
Account and business records are kept for as long as your account is open, and for up to 90 days after you ask us to close it, so that an accidental deletion can be reversed.
Payment and payout records are kept for as long as we may need them for reconciliation, dispute handling, and tax or accounting obligations — typically seven years from the date of the transaction.
Support messages and attachments are kept for 24 months after the conversation is closed, then deleted.
Server logs and diagnostics are kept for 30 days, except where an entry is part of an open security investigation.
Identity verification evidence is kept for as long as the law requires us to be able to show that the check was done.
When a retention period ends, records are deleted or irreversibly anonymised. Data held by a payment partner about your merchant account is governed by that partner’s own retention rules, not ours.
8. How we protect it
Account isolation. Every API request is scoped to the account of the authenticated session. A request that cannot prove which account it belongs to is refused rather than answered broadly.
Verified payment events. We check the signature on every event we receive from a payment partner before acting on it, and we ignore duplicates, so a replayed or forged event cannot change your records.
Secrets stay on the server. API keys and signing secrets are held as deployment secrets. They are never bundled into the apps and never reach a browser.
Same-origin session cookies. Authentication uses an HTTP-only, same-origin cookie rather than a token stored in the page, which limits the damage a script injection could do.
Fail closed. If a dependency is unreachable or a check cannot be completed, the action is refused and surfaced as an error instead of being guessed at.
Encryption in transit. All traffic between your device, our apps, our API, and our processors runs over HTTPS.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify affected accounts without undue delay and describe what happened, what we know, and what we are doing about it.
9. Your rights
Depending on where you live, you may have some or all of the following rights over your personal information:
Access. Ask for a copy of the personal information we hold about you.
Correction. Ask us to fix information that is wrong or out of date — most of it you can edit yourself in your business profile.
Deletion. Ask us to close your account and delete your personal information, subject to the records we must keep for financial and legal reasons.
Portability. Ask for an export of your account data in a machine-readable format. CSV export is also available in the product on the Pro plan.
Objection and restriction. Ask us to stop or limit a particular use of your information.
Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect processing that already happened.
To exercise any of these, email support@atlaspay.com from the address on your account, or use the contact page. We will respond within 30 days, and we will tell you if we need to verify your identity first. You may also complain to your local data protection authority.
If your request concerns data held by a payment partner about your merchant account, we may need to direct you to that partner, since the relationship is between them and the account holder.
10. Children’s data
Atlas Pay is a business product and is not directed at children. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect personal information from children.
If you believe a child has provided us with personal information, contact us and we will delete it promptly.
11. Changes to this policy
We update this policy when the product changes — for example when we add a processor, change a retention period, or launch a capability that handles new information. The date at the top of this page always reflects the current version.
If a change materially affects how we handle your personal information, we will tell you in the product or by email before it takes effect, so you have time to review it.
12. How to contact us
Questions about this policy, or about anything we hold, can go to the support team. Sending them from the address on your account is the fastest route, because it arrives with your account context attached.
AtlasPay