1. Who we are and how to reach us
Athollus is a cloud-based business intelligence and decision-support platform for small and medium-sized businesses. Athollus acts as an intelligence layer that sits above your existing business systems: it helps you upload and connect your business data, enrich it with trusted external information, analyze it using deterministic analytics and artificial intelligence ("AI"), and generate insights and reports so you can make more informed decisions.
This Policy is issued by Athollus Technologies LLC, a California limited liability company ("Athollus," "we," "us," or "our"), the company that operates the Athollus platform, websites, and related services (together, the "Services").
If you have any questions about this Policy or your personal information, contact us at privacy@athollus.com. For general inquiries, you can also reach us at hello@athollus.com.
Athollus is a business-to-business service. Most information we process is business information that our customers (companies) choose to upload or connect. Where that information includes personal information, this Policy explains how we handle it.
2. How this Policy applies: customers, users, and visitors
It helps to separate three roles, because the information we handle differs for each:
Customers are the businesses that subscribe to Athollus and create a company workspace. When a customer uploads files or connects a service, the customer decides what data enters the platform and for what purpose. For that customer-provided business data, the customer is the "controller" (or "business") and Athollus acts as a "processor" (or "service provider") that processes the data on the customer's behalf and under its instructions.
Authorized users are the individuals a customer invites into its workspace — for example, employees, owners, or collaborators. We process their account information to provide and secure the Services.
Visitors are people who browse our public website or marketing pages without logging in.
For personal information contained in customer data, the customer's own privacy notice and agreements govern the relationship with the individuals that data is about. This Policy describes Athollus's own practices. Where Athollus processes customer data strictly as a processor/service provider, the applicable terms are set out in our customer agreement and, where required, a Data Processing Addendum.
3. Categories of information we collect
We collect the categories of information described below. Not every customer or user will provide every category; what we hold depends on how you use the Services and what you choose to upload or connect.
3.1 Customer-uploaded business information
Customers can upload business files and records into their workspace. This content is defined in our Terms of Service as "Customer Content." It may include, for example:
CSV files, spreadsheets, and other structured data exports;
financial reports and operational reports;
sales, inventory, and marketing data;
CRM exports, customer lists, and supplier information; and
internal business documents.
Customer Content may itself contain personal information about a customer's own contacts, employees, or customers (such as names or email addresses in a CRM export). Athollus does not control what a customer chooses to upload. We process Customer Content only to provide the Services to that customer, as described in Section 4.
3.2 Information from connected services
Customers may connect third-party business services so that Athollus can read the business information the customer authorizes. We only access data within the scope the customer grants, and we do not use connected-service data for any purpose other than delivering the Services to that customer.
Currently supported: Google Sheets.
Planned: Stripe, accounting systems, additional CRM platforms, and other business software. This Policy will be updated as new integrations are released.
When you connect Google services, our access and use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We request only the scopes needed to provide the features you enable, and you can disconnect a connected service at any time.
3.3 Account and authentication information
To create and secure accounts, we collect: your name; email address; organization or workspace name; authentication credentials (passwords are stored only as salted hashes managed by our authentication provider — we never store passwords in plain text); login history; and security logs such as sign-in events and IP addresses used for security purposes.
3.4 AI interactions
The Services let users ask questions about their business — for example, "Why did revenue decline?", "Which products perform best?", or "What should we focus on next month?" We process the prompts you submit and the responses generated in order to produce answers, and we may store prompts and responses within your workspace so that analysis stays consistent and has continuity over time. AI interactions are associated with the workspace in which they are created and are subject to the tenant isolation described in Section 6.
3.5 Company Memory
Athollus can store business context — such as company goals, preferences, prior analyses, and strategic notes — so that AI recommendations remain consistent across sessions. We refer to this as "Company Memory." It is stored within the customer's isolated workspace and used only to serve that customer.
3.6 External intelligence
To improve analysis, Athollus supplements customer data with information from trusted public and third-party data sources, such as weather data, foreign-exchange rates, economic indicators, regional statistics, and other public datasets. This external intelligence is general (not specific to any individual) and is used only to enrich and contextualize a customer's analysis.
3.7 Operational and diagnostic information
We process technical and operational information needed to operate, secure, troubleshoot, and maintain the Services, such as application errors, performance information, security events, and other diagnostic data generated by our systems and infrastructure. We do not currently use analytics cookies to track page or feature usage. If our analytics practices change, we will update this Policy and our Cookie Notice as appropriate.
3.8 Secure file sharing
Users can share files outside their organization using controlled links. To operate this feature securely, Athollus generates cryptographically secure sharing tokens and stores those tokens in hashed form. Authorized workspace administrators can revoke a shared link, and deleting the underlying file invalidates access through that link. Shared files remain associated with the workspace from which they were created.
4. Why we use information (purposes)
We use the information above for the following purposes:
Provide the Services — to host your workspace, ingest and organize the data you upload or connect, run analytics, generate AI answers and reports, and enable secure sharing.
Authenticate and secure accounts — to verify identity, prevent unauthorized access, maintain audit and security logs, and enforce access controls and tenant isolation.
Maintain continuity of analysis — to store AI interactions and Company Memory within your workspace so results remain consistent over time.
Enrich analysis — to combine your data with external intelligence so insights are more useful.
Operate, maintain, and improve the platform — including diagnostics, debugging, performance monitoring, and developing new features.
Communicate with you — to send service, security, and administrative messages, respond to requests, and (where permitted) share product updates.
Billing — to administer subscriptions and process payments once paid plans are enabled.
Comply with law and protect rights — to meet legal obligations, enforce our agreements, and detect, prevent, or address fraud, security, or technical issues.
We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. We do not use Customer Content to train foundation AI models for the benefit of other customers.
5. How the AI is used, and what it does not do
Athollus uses AI to summarize data, explain trends, answer business questions, and generate reports and recommendations. This is important to understand clearly:
The AI produces analysis and suggestions; it does not automatically make business decisions for you. You always decide whether to act on any output.
AI outputs can contain errors or omissions and should be reviewed before you rely on them. The Services do not provide legal, tax, accounting, or investment advice.
AI processing is performed using our AI subprocessor (see Section 7). Prompts and relevant workspace context are sent to that provider solely to generate your response and are subject to that provider's commitments not to use business inputs to train its general models.
Because outputs are generated from the data available in your workspace and from external intelligence, the quality of results depends in part on the accuracy and completeness of the data you provide.
6. Multi-tenant architecture and data separation
Each customer receives an isolated company workspace. Company data is never intentionally shared with other customers. Athollus uses logical separation between organizations (tenant isolation) together with row-level access controls to restrict access to each workspace's data. Within a workspace, a customer's administrators control which authorized users may access what.
7. Service providers and subprocessors
We share information with a limited set of vendors that help us operate the Services. These providers process information on our behalf, under contract, and are not permitted to use it for their own purposes. Our current key subprocessors are:
Supabase — database hosting, authentication, and file storage.
Anthropic — AI processing that powers analysis and generated responses.
Google — the Google Sheets integration, for customers who connect it.
Stripe — payment and financial processing, when paid features are enabled.
We will update our subprocessor list as we add providers. We may also disclose information: to professional advisors (such as lawyers and accountants); in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections; and to authorities or others where required by law or to protect rights, safety, and the integrity of the Services.
8. How long we keep information (retention and deletion)
We keep information for as long as needed to provide the Services and for the limited additional periods described below.
Active workspace data. Customer Content, connected-service data, AI interactions, and Company Memory are generally retained while the customer maintains an active account or for as long as needed to provide the Services.
Account and workspace closure. When a customer closes a workspace or requests deletion, Athollus will delete or de-identify Customer Content in accordance with our operational deletion procedures, subject to applicable legal, security, backup, dispute-resolution, and enforcement requirements. Where privacy law establishes a deadline for responding to a verified deletion request, we will respond within the period required by applicable law.
User-deleted files. When an authorized user deletes an uploaded file through available product controls, the file is removed from active use in accordance with our deletion procedures. Residual copies may remain temporarily in backups or other protected recovery systems until those systems are overwritten or expire in their ordinary course.
Security, audit, diagnostic, and product-analytics information. We retain this information for as long as reasonably necessary to secure and operate the Services, investigate incidents, diagnose problems, understand product usage, comply with legal obligations, and enforce our agreements. Retention periods may vary according to the type of information and its purpose.
Backups. Information contained in backups may remain until the applicable backup is overwritten or expires through its normal lifecycle. We do not use backup copies for ordinary business purposes after the corresponding information has been deleted from active systems, except where restoration is necessary for security, continuity, or disaster recovery.
If you would like to request deletion of personal information, contact us at privacy@athollus.com or use in-product controls where available. Where Athollus acts as a processor or service provider for a customer, we handle requests concerning Customer Content in accordance with that customer's instructions, our agreement with the customer, and applicable law.
9. Cookies and similar technologies
We use strictly necessary cookies and similar browser technologies to authenticate users, maintain signed-in sessions, and support the secure operation of the Services. We do not currently use advertising cookies or analytics cookies to track page or feature usage. For more information about the technologies we currently use and how you can control them through your browser or device, see our Cookie & Tracking Notice.
10. Security
We take reasonable and appropriate measures designed to protect information, including: encrypted connections (HTTPS/TLS) in transit; authentication and access controls; logical tenant isolation and row-level access controls; secure file storage; audit logging; hashed secure sharing tokens; and revocable sharing links. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for configuring access within your workspace appropriately. Our current security practices are described further on our Security page.
11. International data transfers
Athollus is currently offered in the United States, and information is processed in the United States. As we expand, we may process information in other locations and will implement appropriate safeguards for cross-border transfers as required by applicable law (for example, standard contractual clauses for transfers from the European Economic Area or the United Kingdom). If you access the Services from outside the United States, you understand your information may be transferred to and processed in the United States.
12. Your privacy rights
12.1 California residents (CCPA/CPRA)
If you are a California resident, you have rights regarding your personal information, subject to certain exceptions:
Right to know the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it.
Right to delete personal information we have collected from you.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information — however, as noted above, we do not sell or share personal information as those terms are defined by California law.
Right to limit the use of sensitive personal information — we do not use sensitive personal information for purposes that would trigger this right.
Right to non-discrimination for exercising your rights.
For transparency, the categories of personal information we may collect map to CCPA categories as follows: identifiers (such as name, email, IP address); internet or other electronic activity (usage and diagnostic data); professional or employment-related information and commercial information (contained in business data a customer uploads or connects); and inferences drawn to generate insights. The sources are: you and your organization; your connected services; and third-party public data sources for external intelligence. The purposes and disclosures are described in Sections 4 and 7. Where Athollus processes personal information within Customer Content on behalf of a business customer, we act as that customer's service provider; individuals should direct requests to the business that controls that data, and we will assist that business as required.
To exercise a right, contact us at privacy@athollus.com. We will verify your request before responding and will not discriminate against you for exercising your rights. You may use an authorized agent where permitted.
12.2 Other U.S. state privacy laws
Residents of other U.S. states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a portable copy of personal information, and to opt out of targeted advertising, sale, or certain profiling. We honor these rights where they apply. Contact us at privacy@athollus.com to make a request.
12.3 EEA and UK individuals (GDPR readiness)
If and when we serve customers in the European Economic Area or the United Kingdom, individuals there may have rights to access, rectify, erase, restrict, and port their personal data, and to object to certain processing. Where we act as a processor, we support our customers (as controllers) in responding to such requests. Our legal bases for processing, where GDPR applies, are typically performance of a contract, our legitimate interests in operating and securing the Services, consent (where required), and compliance with legal obligations.
13. Children
The Services are intended for businesses and their authorized users, not for children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us at privacy@athollus.com and we will take appropriate steps to delete it.
14. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice (such as an in-product notification or email). Your continued use of the Services after an update takes effect means you accept the revised Policy.
15. Contact us
Questions, requests, or complaints can be sent to privacy@athollus.com. If you are a customer, you can also reach us through your in-product support channel or at support@athollus.com.