Privacy Policy

Atliso ("we", "us") is operated from the United Kingdom. This policy explains what data we collect, why, and your rights under UK GDPR.

What we collect

Email address: when you voluntarily subscribe via our email capture form. We use this solely to send you new tools, guides, and product updates.

Analytics: we use Vercel Analytics for anonymous, aggregated page views, and PostHog to understand which pages and tools are used.

Atliso Pro analytics: we record the steps of signing up to Atliso Pro (sign-in, approving access, the first scan, starting a trial, paying) against a random account ID, so we can see where people get stuck. We never send your email, name, tenant name or device names to PostHog. If you decline analytics cookies, none of this is recorded.

Cookies

We only set PostHog's analytics cookies after you click Accept in the cookie banner. Until you choose, PostHog counts visits without storing anything on your device. If you click Decline, analytics stop completely. You can change your choice any time with Cookie settings in the footer. Signing in to Atliso Pro uses a necessary session cookie, which is always set while you are signed in. Read PostHog's privacy policy.

The email address you subscribe with is linked to site analytics so we can see which tools are used, and you can unsubscribe at any time.

How we process your email

Your email is sent to Resend (our email service provider) via their API, and used to send you the emails you signed up for. Resend processes data under their own privacy policy and acts as a data processor on our behalf. We do not sell, share, or rent your email to third parties.

Atliso Pro

Your account: when you sign in with Microsoft we receive your name, work email address, and your Microsoft user and tenant IDs. We use them to run your account and send the alerts and digests you choose. If your tenant's administrator has approved it, we also keep a small copy of your Entra ID profile photo to show next to your name. It is refreshed daily and deleted with your account.

Your tenant data: after an administrator approves access, Atliso Pro reads device information from Microsoft Intune and Entra ID through Microsoft Graph: device names, operating system, encryption and compliance state, and whether a BitLocker key or LAPS password exists and when it was backed up, and when Apple certificates and tokens in Intune expire (with the Apple ID they belong to). It never reads the recovery keys or passwords themselves. Scan results are stored in our database (Supabase, EU region) so we can show trends and changes. Removing a tenant in Settings deletes its data. We keep only a count of AI credits it used this month, without who used them, and a record that its free scan was used, so reconnecting can't reset either.

AI fix plans: when you ask for one, a summary of the finding is sent to Anthropic (Claude) to write the plan. Device names, users and IDs are never included, only counts and anonymised details.

Billing: payments are handled by Stripe, which saves your card securely and charges it for your plan. Our own systems never see or store your card details. We keep your Stripe customer ID and subscription status so we know which plan you are on.

Lawful basis

We process your email on the basis of consent. You provide it voluntarily by submitting the form. You can withdraw consent at any time by clicking "unsubscribe" in any email we send.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Withdraw consent at any time
• Lodge a complaint with the ICO (ico.org.uk)

To exercise any of these rights, email hello@atliso.com.

Data retention

We retain your email address for as long as you remain subscribed. If you unsubscribe, your data is removed from our mailing list within 30 days.

Changes

We may update this policy. Changes will be posted on this page with an updated date.