AtlyOnline
Sign in

Data processing agreement

Version: 2026-10-21.

1. Parties and roles

  • Processor: AtlyTech s.r.o., IČO 29944627, DIČ CZ29944627, registered office Dandova 2619/13, Horní Počernice, 193 00 Praha 9, registered at Městský soud v Praze, oddíl C, vložka 454920 ("AtlyTech", "we").
  • Controller: the customer who determines the purposes and instructs AtlyOnline to process personal data of other people ("Customer", "you"). This includes a call on which other people can be heard, whether through the computer audio, a microphone, or both.
  • This Data Processing Agreement (DPA) applies when AtlyOnline processes personal data on your behalf to provide AtlyOnline.
  • When a person uses AtlyOnline only for themselves, that person is the data subject and AtlyTech is the controller. That relationship is described in the privacy notice at /legal/privacy, not in this DPA.
  • Accounts and minutes are separate from AtlyChat. This DPA does not govern AtlyChat or Atly at https://atly.work/legal/dpa.

2. Subject matter and duration

AtlyOnline processes Customer personal data on the Customer's instructions to provide one live call, the transcript, grounded checks, notes, uploaded briefs, and the desktop helper that sends call audio. Processing continues for the term of the service relationship and for a reasonable closure window after termination or an account-deletion request, unless a longer period is required by law.

3. Nature and purpose of processing

Nature: infrastructure operation, storage, retrieval, transcription, speaker separation, summarisation, grounded checks, logging, and transmission to the sub-processors listed below as needed to run the product.

Purpose: deliver AtlyOnline on the Customer's instructions. AtlyTech does not train or fine-tune foundation models on Customer content.

4. Types of personal data

Depending on what the Customer uses, processing may include:

  • Account data: email, authentication identifiers, locale, and preferences. The password is stored as a scrypt hash.
  • The live transcript, call notes, and briefs and other files the Customer uploads.
  • System audio and microphone audio, sent as PCM for the time of the transfer. Raw PCM is not stored. On macOS the desktop helper asks for Screen Recording so it can hear the call. It does not record the screen. On a phone, the app hears the microphone only, and only while the phone stays awake with the speaker on.
  • Billing identifiers. Payment cards are handled by Stripe and are not stored in AtlyOnline.

AtlyOnline does not seek special categories of data. The Customer must not intentionally submit special-category data unless the Customer has a lawful basis and instructs AtlyTech accordingly.

The Customer is responsible for whether assistance is allowed on that call.

5. Categories of data subjects

  • The Customer.
  • People who can be heard on a call the Customer starts.

6. Customer instructions

AtlyTech processes personal data only on documented Customer instructions: use of the product, starting a call, and written instructions (including support requests). AtlyTech informs the Customer if an instruction appears to infringe the GDPR and may refuse an unlawful instruction.

7. Confidentiality

Persons authorised to process personal data are bound by confidentiality obligations (contractual and/or statutory).

8. Security measures (summary)

Technical and organisational measures include, as implemented in the product:

  • HTTPS for the application and TLS for the live audio connection.
  • Password hashing with scrypt for password-based accounts.
  • Isolation so each account sees only its own data.
  • Raw PCM is not stored. The desktop helper does not keep a recording and does not hold provider keys.
  • Account deletion removes the account, the stored calls, the library, and extracts.

9. Sub-processors

The Customer authorises AtlyTech to use the following sub-processors, as configured for the service:

  • Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) for hosting in the EU (europe-west1), the database, and file storage.
  • OpenAI for speech-to-text, including speaker separation on a closed turn.
  • Deepgram for speech-to-text when that backend is turned on.
  • Together AI for language-model inference.
  • OpenAI for language-model inference when that backend is turned on.
  • Google Gemini for language-model inference when that backend is turned on.
  • Stripe for the subscription and extra minute packs. Payment cards are handled by Stripe. AtlyOnline does not store card numbers.
  • Cloudflare (Turnstile) for bot protection on sign-up, sign-in, and password reset. Cloudflare receives the visitor IP, user agent, and browser signals for the challenge. It does not receive call content. Provider transfer tools (for example standard contractual clauses) apply under Cloudflare's terms.
  • Transactional email for account messages such as password reset and a shared call link.
  • Sentry (Functional Software, Inc.) for application error diagnostics on the web app, the gateway, and the desktop helper. Personal data in error payloads is scrubbed before transmission. Provider transfer tools (for example standard contractual clauses) may apply depending on the Sentry organisation region.

AtlyTech informs Customers of a material sub-processor change by a product notice or a documentation update, with reasonable advance notice where feasible. Continued use after that notice is acceptance.

10. International transfers

Where a sub-processor processes data outside the EEA, the transfer relies on that provider's transfer mechanism (for example standard contractual clauses or an adequacy decision) as stated in that provider's terms. The Customer should review those terms for the Customer's region. Hosting of the application is in the EU (europe-west1). Speech-to-text and language-model inference run at the providers named above.

11. Assistance to the controller

Taking into account the nature of the processing, AtlyTech assists the Customer with:

  • Responses to data-subject requests (access, rectification, erasure, restriction, portability, objection), to the extent the data is in the product, including export and account deletion.
  • Notice of a personal-data breach affecting Customer data in AtlyOnline, without undue delay after AtlyTech becomes aware of it.
  • A data-protection impact assessment or prior consultation, by providing this DPA and a description of the product on request.

12. Retention, return, and deletion

  • The Customer may delete a call in the product. The transcript and notes of that call are then deleted.
  • Briefs and other files the Customer uploads stay for as long as the account keeps them.
  • Raw PCM is not stored.
  • On termination or a written deletion request, AtlyTech deletes the account and Customer personal data in AtlyOnline storage within a reasonable period, except data AtlyTech must keep under law or for dispute and security logs. Retained logs are minimised and access-controlled.

13. Audits

On a reasonable written request, and no more than once a year unless a breach investigation requires otherwise, AtlyTech makes available the information needed to demonstrate compliance with Article 28 (this DPA and a security summary). An on-site audit needs agreement on scope, timing, and confidentiality. The Customer bears the external auditor's cost unless a material breach by AtlyTech is confirmed.

14. AI annex

  • No training: Customer personal data is not used to train or fine-tune third-party foundation models.
  • Speech-to-text runs through OpenAI, and through Deepgram when that backend is turned on.
  • Language-model inference runs through Together AI, and through OpenAI or Google Gemini when that backend is turned on.
  • The minute balance belongs to the AtlyOnline account. It is not the AtlyChat credit ledger.

15. Liability

Liability under this DPA follows the Terms.

Public page: /legal/dpa. Related: /legal/privacy, /legal/terms, /legal/cookies.