Privacy Policy
Last updated: 2026-05-28 · Scope: all Atrium services (verify.useatrium.me, codex.useatrium.me, tablet.useatrium.me)
Contact: privacy@useatrium.me
1. Data controller
The data controller is Atrium (entity registration pending; the Atrium project team operates as an unincorporated team until entity formation is complete; see /team for individuals).
Limitation: no formal entity is registered as of this writing. This policy will be updated with the registered entity name and jurisdiction once incorporation completes.
2. Lawful basis (GDPR Art. 6)
- Legitimate interest: analytics (SimpleAnalytics, aggregated, no personal IDs). You may opt out via the cookie consent banner.
- Contract: service delivery (rendering your portfolio, executing transactions you initiate).
- Consent: Sentry error replay, marketing communications (if any). Revocable at any time.
- Vital interest / legal obligation: fraud prevention, AML record-keeping where KYC is triggered.
3. Data categories collected
- Wallet addresses (pseudonymous, on-chain)
- IP addresses (Codex API logs, retained 24h)
- User-agent strings (Codex API logs)
- Device fingerprints (Sentry, only with consent)
- Error context: stack traces, breadcrumbs (Sentry, scrubbed of wallet addresses)
- KYC documents: government ID, selfie, biometric (Sumsub, only if user opts into tier upgrade)
4. Retention schedule
| Category | Retention |
|---|---|
| Codex API logs | 24 hours |
| Sentry events | 90 days |
| SimpleAnalytics aggregated data | Indefinite (no individual records) |
| KYC documents | Per Sumsub policy + 5 years AML record-keeping |
| Wallet activity logs | Indefinite (on-chain, immutable) |
5. Third-party processors (sub-processors)
Full details at /legal/sub-processors. Summary:
- Vercel: hosting
- Cloudflare: DNS, DDoS protection
- Sentry: error monitoring (consent-gated)
- SimpleAnalytics: analytics (EU-based, GDPR-friendly)
- Sumsub: KYC (only if user opts in)
- Doppler: secrets management (no user PII)
- DigitalOcean: daemon hosting (no user PII)
- The Graph: subgraph indexer (public chain data only)
- Web3.storage: IPFS pinning (public Merkle roots only)
6. Your rights (GDPR Art. 15–22 + CCPA §1798.100)
- Access: request a copy of data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: request deletion. Note: on-chain data is immutable; we erase off-chain mirrors only.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Restriction: request we limit processing.
- Right to lodge complaint: with your supervisory authority (e.g. ICO, CNIL, BfDI).
- California-specific: do not sell my personal information. We do not sell personal information.
7. How to exercise your rights
Email privacy@useatrium.me with your wallet address and request. We respond within 30 calendar days.
A self-service data request form is planned at /legal/data-request.
8. International transfers
Vercel and DigitalOcean process data in the United States. For EU→US transfers, we rely on Standard Contractual Clauses (SCCs) as published by each processor.
Limitation: we have not independently verified each processor's SCC implementation. This will be confirmed during lawyer review.
9. KYC disclosure
When you request a tier upgrade for restricted venues, KYC is processed by Sumsub. See /legal/kyc for full details on what is collected, retention, and appeal mechanisms.
10. Cookies and tracking technologies
We use the following:
| Name / Tech | Purpose | Category |
|---|---|---|
| atrium_consent_v1 | Stores consent preferences | Essential |
| atrium_consent_ts | Consent timestamp (12-month expiry) | Essential |
| atrium_session | SIWE auth session | Essential |
| SimpleAnalytics script | Privacy-friendly page views (no cookies set) | Analytics |
| Sentry SDK | Error capture + session replay | Analytics (consent-gated) |
Manage your preferences via the cookie consent banner or .
11. Children
Atrium is not intended for persons under 18 years of age. We do not knowingly collect data from minors. If we become aware that a user is under 18, we will terminate access and delete associated off-chain data.
12. Changes to this policy
Material changes are announced with 30 days' notice via /changelog and emailed to users who have provided an email address. Continued use after the notice period constitutes acceptance.