01Who we are
In shortAtomiq is run by one company, which is responsible for the data described here.
Atomiq is an email marketing service for online shops, operated by MARSA Agency d.o.o. (MARSA Agency društvo s ograničenom odgovornošću za marketing i poslovni razvoj), Ulica Hrvatske Republike 17B, 31000 Osijek, Croatia, registered with the Commercial Court in Osijek under MBS 030263285, OIB 53873550189. In this policy “Atomiq”, “we” and “us” mean that company.
For anything in this policy, write to dinko@marsa.agency.
02Which data this policy covers
In shortThis covers you as a visitor or a customer of Atomiq. If a shop emailed you through Atomiq, the shop is in charge of your data.
We handle personal data in two different roles.
- As controller, for people who visit our website, sign up for Atomiq, use it as members of a shop’s team, or pay for it. This policy describes that data.
- As processor, for the contacts a shop keeps in Atomiq: its subscribers and customers. The shop decides what it collects and why, and its own privacy policy applies. We handle that data only on the shop’s instructions, under our Data processing agreement.
Received an email from a shop that uses Atomiq?
Every marketing email sent through Atomiq has an unsubscribe link that takes effect at once. To see, correct or delete what a shop holds about you, contact the shop: it can export or erase your profile in Atomiq. If you cannot reach the shop, write to us and we will pass your request on.
03What we collect
When you create and use an account
- Your name, email address and password. We store the password only as an Argon2 hash.
- If you sign in with Google: your Google account’s email address and its user ID. We ask Google only for your basic profile and email address.
- If you turn on two-factor sign-in: the authenticator secret (encrypted) and your recovery codes (hashed).
- For each signed-in session: the IP address and browser details (user agent) it came from, so you can review and end sessions and we can spot misuse.
- Your shop’s details: name, website, store platform, sending domain and brand settings.
- What you do in the account that changes it: settings, team invitations, API keys, erasures and suppression changes are written to an audit log with who did it and when.
When you pay
Payments are taken by Paddle, which acts as the seller of record (see “Who we share data with”). Paddle collects your card or other payment details; we never see them. We keep your plan, subscription status and the customer reference Paddle gives us.
When you use AI features
The briefs you write and the content you ask the assistant to work on (campaign, email and flow content, and the aggregate figures it looks up, such as how many contacts are in a segment) are sent to our AI provider to produce a draft. The prompts and the results are saved in your account so you can come back to them.
When you connect AI apps
If you connect an AI app such as Claude, ChatGPT or Cursor to your account, it can read what you allowed when you signed in: reports, campaigns, flows, segments and emails, and contact details only if you allowed them. With “Read and draft” access it can also save drafts, which wait in your Assistant until someone applies them, and, when you ask, send a test of an email to your own address; it never sends to your contacts, schedules or deletes anything. We keep the connection (which app, who connected it and what it may do) and a log of each request it makes: the tool used, when, whether it worked and how long it took, but not what was asked or answered. If an app finds a task it has no tool for, it may send us a short description of the task, after asking you, so we can decide what to build next; it is told to leave out names, email addresses and copied content. You can see and disconnect every app under Settings → Connected apps.
If you add another service’s app for the assistant to read (Settings → Connected apps → Apps your assistant can read), the assistant sends that service the lookups it makes there, such as a search term. Its sign-in token is stored encrypted.
When you visit our website
Our website uses no analytics, advertising or tracking cookies, and no third-party scripts that follow you. Our web server records requests (IP address, page, time, browser) to keep the service running and secure.
04Why we use it, on what basis, and for how long
In shortWe use your data to run your account, keep it secure, bill you and meet our legal duties, and we delete it on a schedule.
| Purpose | Data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Providing your account and the service | Account, shop and content data | Contract (Art. 6(1)(b)) | While your account is open, then 30 days after it closes |
| Keeping accounts secure: sessions, two-factor sign-in, audit log, rate limits | Session IP and user agent, audit entries | Legitimate interest in security (Art. 6(1)(f)) | Sessions: deleted 30 days after they end. Audit log: 1 year |
| Billing and subscriptions | Plan, status, Paddle customer reference | Contract; legal obligation for accounting records (Art. 6(1)(c)) | As long as accounting law requires: 11 years (Croatian Accounting Act) |
| AI drafting and the assistant | Briefs, content, prompts and results | Contract (Art. 6(1)(b)) | Saved with your account until you delete them or the account closes |
| Connected AI apps | Connections, their access, the request log (tool, time, result, duration), and reports of tasks an app had no tool for | Contract (Art. 6(1)(b)); legitimate interest in security for the log (Art. 6(1)(f)) | Request log and reports: 90 days. Connections: until you disconnect them or the account closes |
| Service emails: verification, password resets, alerts, billing notices | Name, email address | Contract (Art. 6(1)(b)) | Sent records kept 1 year |
| Answering you when you write to us | Your message and contact details | Legitimate interest in replying (Art. 6(1)(f)) | 2 years after the conversation ends |
| Running and protecting the website | Server request logs | Legitimate interest in security (Art. 6(1)(f)) | 14 days |
| Backups of the service | Everything above | As for the original data | Rolling: each backup is deleted after 7 days |
Import files and their error reports are deleted after 30 days. We do not sell personal data, and we do not use your data or your contacts’ data to train AI models.
06Where your data is kept and transfers outside the EU
Atomiq’s database, files and backups are held in Germany. Data leaves the European Economic Area only where a feature needs it:
- AI features send the content you ask about to Google in the United States. Google LLC is certified under the EU–US Data Privacy Framework; the European Commission’s Standard Contractual Clauses also apply.
- Paddle is in the United Kingdom, which the European Commission recognises as giving adequate protection.
- An AI app you connect receives what it reads wherever its provider runs it, often in the United States.
If you do not want content sent to the AI provider, do not use the AI features; nothing is sent unless you ask for a draft or open the assistant.
07How we protect it
- Every connection to Atomiq is encrypted with HTTPS.
- Passwords are hashed with Argon2; store credentials and two-factor secrets are encrypted with AES-256-GCM.
- Each shop’s data is kept apart inside the database by row-level security, enforced for every query the application makes.
- Two-factor sign-in with an authenticator app, and team roles (owner, admin, editor, viewer) that limit who can do what.
- The database and internal services are not reachable from the internet.
Our Security page describes these measures in more detail.
08Your rights
In shortYou can see, correct, export or delete your data, and object to how we use it. Write to us and we answer within a month.
Under the GDPR you have the right to:
- access the data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased where we no longer need it or have no basis to keep it;
- restrict how we use it while a complaint is resolved;
- receive data you gave us in a portable format;
- object to uses based on our legitimate interests;
- withdraw consent at any time, where we rely on it.
You can correct your details in your account settings. For everything else, write to dinko@marsa.agency. We answer within one month, and may ask you to confirm your identity first.
You may also complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is the Croatian Personal Data Protection Agency (AZOP).
10Emails sent with Atomiq
When a shop sends you an email through Atomiq, the email may record when it is opened and which links are clicked, so the shop can see what works. Opens record the time and a shortened description of the email program; we do not store your IP address for this.
Emails that use a Google web font ask Google’s font service for the font file when they are displayed, so your email program contacts Google directly.
11Children
Atomiq is a service for businesses. It is not meant for anyone under 16, and we do not knowingly collect their data.
12Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use your data in a meaningful way, we tell account owners by email before it takes effect.