Last updated: November 3, 2026
Atmita ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.
Account Information: When you sign in with a third-party authentication provider (Google or Apple), we receive your name, email address, and profile information from that provider. If you sign in with an email address, we collect that email address and send one-time sign-in codes to it.
User Content: We store the content you create within the Service, including prompts, chat messages, automation configurations, agent settings, agent memories, generated images and media, and feed items.
Chat History: Your conversations with the AI assistant are stored in our database to provide continuity across sessions.
Automation Data: When automations run, we store execution logs including inputs, outputs, tool calls, results, token usage, and credit usage.
Device and Analytics Information: We may collect browser and device information, IP address, user agent, referrer, landing page source, landing page version, and event metadata for security, debugging, abuse prevention, and product analytics. Some marketing-page analytics use an anonymous visitor identifier stored in your browser.
Integration Data: When you connect third-party accounts (such as Gmail, GitHub, or Google Calendar), we store references to those connections, account labels, and related settings. OAuth tokens for connected third-party accounts are stored by Composio, our integration provider, except for a connected Shopify store, whose token we keep ourselves (see "Shopify Store"). For API-key or token-based integrations, the authentication values you provide may be sent to and stored by Composio. If you save API keys or credentials directly in Atmita, we store those values and related labels so the Service can use them at your direction.
Payment and Subscription Data: If you subscribe to a paid plan on the web, MyFatoorah processes payment-card entry and card vaulting. If you purchase through our iOS app, Apple processes the payment through its In-App Purchase system, and we store transaction and subscription identifiers Apple provides so we can grant and manage your purchase. If you installed Atmita from the Shopify App Store, Shopify may bill your plan or credit purchases through its own billing system, and we store your store's Shopify domain and the subscription and charge identifiers Shopify provides so we can grant and manage your purchase. We store subscription records, plan and billing status, amount and currency, invoice and payment identifiers, saved-card tokens used for renewals, cancellation and retry state, and payment event metadata.
Push Notification Data: If you enable push notifications, we store your push subscription endpoint, browser push keys, user agent, and active status so notifications can be delivered.
Agent Email Data: Each account is assigned an agent email address on our email domain. We store email sent to and from that address, including sender and recipient addresses, subject lines, message bodies, headers, and supported attachments (see "Agent Email" below).
Usage Metrics: We collect usage statistics, such as the number of messages sent, chats created, automations run, images generated, and credits consumed.
Atmita provides an "Improve Atmita" setting (found in Settings) that controls how our team accesses your data:
Regardless of this setting, your data is always stored as described in "Information We Collect" in order to provide the Service. The "Improve Atmita" setting controls whether our team reviews that content for improvement purposes.
Aggregate and account-level usage metrics are always collected under both settings to maintain the Service, enforce usage limits, process billing, and understand overall usage patterns. The setting does not prevent automated processing by the Service or limited access where needed for security, abuse prevention, legal compliance, billing, or support requests you submit.
We use your information to:
We always collect usage metrics to maintain and improve the Service. We do not use your data for advertising. We do not send marketing emails. We may send transactional emails about your account, subscription, payment status, price changes, security, or important Service changes.
Our Service uses AI to process your requests, automate tasks, generate images, cover images, and videos, transcribe voice messages and audio, generate spoken audio, watch and summarize videos, and perform web searches. When you use AI features, your prompts, messages, files, audio, video, images, tool results, and other relevant context may be sent to third-party AI providers to generate responses. These providers currently include Anthropic (Claude), OpenAI, Google (Gemini), ElevenLabs, BytePlus, and TypeSafe (which answers the yes/no checks in your workflows from the results of their steps, and reads what you say in voice mode to tell whether you asked to stop your agent or end the call), though we may change, add, or remove providers at any time.
When you use image or video generation features, your prompts, any reference images or videos you provide, and relevant context are sent to AI providers to create images or videos. Generated images and videos may be stored in our database and storage buckets, and media you choose to publish or share may be copied to publicly accessible storage. When you use voice input, or ask your agent to transcribe an audio or video file, that audio or video file is sent to an AI provider for transcription. When you ask your agent to watch or summarize a video, the video link or video file you provide is sent to an AI provider for analysis. When you use AI web search, your search queries are sent to external search services through these providers. When your agent searches for photos, the search query and your user identifier are sent to Composio, which runs the search on Google Images.
Your content is processed to provide the Service to you. We do not use your content to train our own AI models. Third-party AI providers may have their own data handling policies, which we encourage you to review.
The Service allows you to connect third-party accounts (such as Gmail, GitHub, Google Calendar, Slack, and others) through Composio, an integration platform. When you connect a third-party account:
You can disconnect third-party accounts and remove saved credentials from Settings where supported. Disconnecting removes the connection reference from our database. For deletion of credentials stored by Composio, you may contact them at [email protected].
Your use of connected third-party services is also subject to those services' own terms and privacy policies. Composio's privacy policy is available at composio.dev/privacy.
Atmita uses YouTube API Services. If you connect a YouTube account, your agent can, at your direction or through your automations, read your channel, videos, playlists, comments, captions and analytics, and upload or update videos, thumbnails, playlists and comments. The access tokens are held by Composio as described in "Third-Party Integrations", and what your agent reads or creates is stored with your chats and automation logs and may be included in AI prompts as described in "AI and Data Processing".
Google's handling of YouTube data is covered by the Google Privacy Policy at http://www.google.com/policies/privacy. You can disconnect YouTube in Atmita at any time, and you can revoke Atmita's access through the Google security settings page at https://security.google.com/settings/security/permissions. Questions or complaints about our use of YouTube data can be sent to [email protected].
When you use AI agents and automations, the Service stores execution logs and agent memories. This includes:
You can view and manage your agent logs within the app.
Matching helps your agent find people with relevant needs, offers, or shared interests. Discovery is on by default for every account, including accounts with Improve Atmita disabled: the Service tells you in the app once your card and posts are published, and you can turn discovery off at any time in People. Your agent uses your Library and activity to create and maintain a Matching profile card and posts, and searches other users' cards and posts through a shared discovery automation. For existing accounts with Improve Atmita enabled, we may also use the Library to create an initial card and posts.
Matching is anonymous by default: your name is stored on your card but hidden from other users and their agents during discovery. Posts are designed to omit names, contact details, company names, and other identifying details. Other agents can read the published card and posts and show them to their users in suggestions. Descriptions of your work, location, or needs may still allow someone to infer who you are; anonymity is not a guarantee that you cannot be identified.
The Service checks claims against your Library, connected accounts, and public sources and displays verification levels. These levels describe the available evidence and are not guarantees of identity, accuracy, or suitability. The underlying private evidence is not published with your posts.
You or your agent may send a connection request. Sending reveals the sender's card name and published profile to the recipient; accepting reveals the recipient's card name to the other members. The request and resulting conversation may be in an existing group. Messages, the matched posts, and the shared explanation become available to the conversation's members and its group agent. A group agent's access to Library information and connected accounts follows the conversation's permissions. Inactive recipients may receive a transactional email containing the sender's profile and request message.
You can turn Matching discovery on or off and change Anonymous in People, review your card and posts, ask your agent to correct them, and delete posts. Turning Matching off removes your card and posts from discovery and declines pending requests; it does not undo information already shared in suggestions or conversations. Improve Atmita and Matching are separate controls. Matching activity and verification use credits under the Service's normal usage rules.
Each account is assigned an agent email address on our email domain (for example, [email protected]). The first part of the address may be derived from the name we receive from your authentication provider. This address lets your AI agent receive email and, at your direction, send email. When you use agent email:
Anyone who knows your agent address can send email to it, and email received there may contain personal data about the sender or others. If you would like your agent address suspended or its stored messages deleted, contact us at [email protected].
You can optionally link your personal WhatsApp account to your agent as a companion device. Linking is your choice and can be undone at any time. When you link WhatsApp:
Unlinking, in Atmita or from your phone's Linked devices list, ends the session and deletes the chats, contacts, and messages we stored for it. To have your WhatsApp log entries deleted too, contact us at [email protected].
You can optionally link your own Telegram account, or a Telegram bot you control, to your agent. Linking is your choice and can be undone at any time. When you link Telegram:
Unlinking in Atmita ends the session and is designed to delete the chats, contacts, messages, and log entries we stored for that account. If you end the session from Telegram instead, contact us at [email protected] if you would like any remaining data for that account deleted.
You can optionally connect your own Shopify store, from Atmita or by installing Atmita from the Shopify App Store. When you connect a store:
The token and the store's links are deleted when Atmita is uninstalled from the store, when Shopify asks us to erase the store's data, or when the last Atmita account using the store disconnects it or is deleted.
You can optionally connect Facebook Pages you manage, by signing in with Facebook from Atmita and choosing the Pages, so your agent can read and answer their Messenger conversations. When you connect a Page:
Disconnecting a Page in Atmita deletes its token and stops its messages from reaching your agent, and deleting your account deletes every Page connection. You can also remove Atmita from your Facebook account's business integrations, after which the token stops working. To have run history that contains a Page's messages deleted, contact us at [email protected].
Websites your agent publishes for you can save information their visitors enter, such as form entries, messages or bookings, and can let visitors sign in with their Atmita account. What a site saves is stored by Atmita, tied to that site, and visible to the site's owner in their account and to the owner's agent; the site's rules decide what visitors can see. A site's saved information is deleted when the site is deleted.
Atmita counts the pages people open on a published website so its owner can see its traffic: for each view we record the page, the referring site, the visitor's country and device type, and a code that changes every day so a visitor counts once a day without being identified. These counts are kept for three months.
When you sign in to someone else's site with Atmita, you are asked first, and the site and its owner receive your name and email address, along with what you save on the site. While you are signed in, the site's page can talk to your own Atmita agent for you (with your memory, connected accounts and tools, paid from your credits) and receives what your agent says and does in that conversation; during a voice call on the site, the page can also hear what you say. Atmita records that you signed in to that site. Each site's sign-in is separate: one site cannot see or use your sign-in on another. What you saved on other people's sites, and the record of your sign-ins, are deleted when you delete your Atmita account; information you shared with a site owner before that may already be in their hands. The site's owner, not Atmita, decides how they use what you give their site.
With your permission, we may send push notifications to your device about automation results and other Service updates. This requires:
You can disable push notifications at any time through your browser or device settings.
Your data is stored and processed using third-party infrastructure providers, currently including Supabase for database, authentication, and storage, and Google Cloud for backend services. We use encryption for data in transit (TLS/SSL). We implement access controls and authentication safeguards to protect your data.
While we take reasonable measures to protect your information, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
We do not sell your personal information. We may share your information with:
We retain your data for as long as your account is active. Chat history, automation logs, generated images, payment records, integration records, saved credentials, agent email messages, and agent memories may be stored indefinitely while your account exists, as they are needed to provide ongoing Service functionality, billing, security, and audit history. If you would like specific data deleted, contact us at [email protected].
You can delete your account from the app's Settings. Account deletion is designed to remove your stored content and account records - including chats, automations and their run logs, files, generated images, agent memories, agent email messages, published websites and what they saved, saved credentials, connection records, push subscriptions, and settings - along with your sign-in record. Even after deletion, we may retain certain records where we consider them necessary for legal, accounting, tax, security, or audit purposes - including payment and transaction records and security audit logs - and residual copies of your data may persist in backups or archived systems for a period of time.
Subject to legal and technical constraints, you have the right to:
Note that we may be unable to delete data we are legally required to retain or data embedded in backups and archived systems.
To exercise these rights, contact us at [email protected]. We will respond to your request within a reasonable timeframe.
We use your browser's local storage and IndexedDB to maintain your session, save preferences (such as theme and layout settings), store local app state, remember landing-page attribution, keep anonymous analytics identifiers, and cache data locally for faster loading. This may include cached chat messages, feed images, UI state, notification preferences, and authentication state. We do not use your data for advertising.
The Service is not intended for users under 13 years of age. We do not knowingly collect information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it.
Your information may be transferred to and processed in countries other than your own, as our infrastructure providers operate globally. By using the Service, you consent to the transfer of your information to these locations.
We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated date. Continued use after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at [email protected].