ATLAS Privacy Notice
Status: Effective August 15, 2026 Version: 2026-08-11.1 Scope: Individual ATLAS, ATLAS Organizations, and ATLAS Enterprise/OEM
Provider and contact
On Spot Solutions LLC provides ATLAS. Privacy requests should route to support@onspot-solutions.com through a verified-request process. Written requests may be sent to On Spot Solutions LLC, 1 Washington Mall #1282, Boston, MA 02108, United States. Counsel must confirm any additional jurisdiction-specific contact requirements.
Information ATLAS may process
- account identity, contact, authentication, role and Organization membership;
- subscription, order, invoice, payment status and usage allowance metadata;
- facility, site, equipment, model, serial, configuration and service-history data;
- diagnostic prompts, responses, transcripts, outcomes, timestamps and downtime;
- photos, files and commissioning material deliberately uploaded by authorized users;
- support communications, feedback and product-testing information;
- device/browser, session, security, audit, IP and error/monitoring information;
- email delivery, invitation, recovery and notification records;
- aggregate product, reliability, adoption and value measurements.
The final notice should instruct customers not to upload unnecessary payment-card data, government identifiers, medical information, facial imagery, license-plate/surveillance content, credentials, secrets, or data they lack authority to process.
Purposes
ATLAS uses information to authenticate users; provide diagnostics and history; operate tenant and role boundaries; administer facilities, equipment, users and invitations; process subscriptions; provide support; secure and monitor the service; communicate transactional notices; comply with law; and improve reliability and approved product capabilities. Marketing use, model improvement, and de-identified/aggregated learning require precise final disclosures and controls.
AI processing
Relevant diagnostic content may be sent to the configured AI API provider to generate a response. The final notice must identify the current providers and accurately describe their contracted retention/training treatment. It must not make blanket “no training” or “zero retention” claims unless verified for the exact production account and model path.
Organization and Enterprise visibility
Organization administrators and authorized managers may see users, equipment, sessions, outcomes and reports within their Organization according to role. Enterprise/OEM parents receive only the contracted parent-level information; aggregate-only mode does not expose child transcripts, photos, named technicians, equipment details or private reports.
Service providers and subprocessors
The final notice and DPA must reconcile the production inventory, including database/auth, hosting, email, payments, monitoring and AI providers. Current engineering records refer to Supabase, Render, Hostinger, Resend, Stripe, Sentry, Anthropic and/or OpenAI depending on the configured production path. Counsel should approve a maintained subprocessor list, locations, purpose and notice process.
Retention and deletion
The candidate schedule provides a 30-day retrieval window after expiration; retains active account, diagnostic, equipment, upload and report data through that window; retains security/admin audit and email-delivery evidence for up to 24 months; retains support records for up to three years; and retains billing/tax/dispute records for up to seven years or the legally required period. Marketing suppression records may be retained as long as reasonably necessary to honor the request. Encrypted backup deletion is targeted within the ordinary cycle, no more than 35 days after primary deletion unless a legal or security hold applies. De-identified learnings may be retained as disclosed. Counsel and engineering must verify these periods against production capabilities before the notice becomes effective.
Security
Describe administrative, technical and organizational safeguards by reference to the approved security exhibit. Do not promise absolute security or controls not currently verified. Explain customer responsibilities for administrators, credentials, devices, authorized data and incident reporting.
Rights and choices
The final notice should explain applicable access, correction, deletion, export, objection/limitation, appeal and marketing choices; identity verification; authorized agents; response timing; and limits. B2B end users may need to direct requests first to their employer/Organization as controller, with On Spot acting as processor.
Cookies and local storage
Inventory essential authentication/session storage, theme preferences, service workers, security and analytics/monitoring. Obtain any legally required consent before enabling nonessential tracking. Product pages and every portal must link the current notice.
Children, transfers and changes
ATLAS is a professional service not directed to children. Counsel should define age, international transfer mechanisms, state-specific disclosures, effective date, material change notice and re-acceptance requirements.