━

Atlas / Legal

Privacy Policy

What Atlas collects, how it is used and protected, and the choices you have.

Effective date and last updated: September 14, 2026.

Hyperion Works, LLC (“Hyperion Works,” “we,” “us,” or “our”) operates the Atlas platform at atlascore.app and its applications (Atlas File Storage, Atlas CRM, Atlas Calendar, and others; together “Atlas”). This policy explains what information Atlas collects, how it is used, and the choices you have.

Who this policy covers

Account holders and organization members who sign in to Atlas.
People whose information is stored in Atlas by our customers (for example, a contact record in Atlas CRM). For that data, our customer is the controller and we process it on their instructions.

Information Atlas collects

Account information. Name, email address, password (stored as a salted hash), optional phone number for two-factor codes, organization name and billing address, and the apps each organization subscribes to.

Billing information. Card details are collected by our payment processor (Authorize.Net) and never touch our servers; we store only the processor’s token, the card brand, and last four digits. Invoices, payments, and usage counts are stored by us.

Content you put into Atlas. Files and folders (File Storage), contact and company records (CRM), calendars and events (Calendar), documents, messages, and any other content you or your organization create or import.

Connected third-party accounts

Connecting a third-party account is always your choice, and you can disconnect it at any time. Your use of each third-party service remains governed by that provider’s own terms. When you connect an account, Atlas accesses only the data needed for the feature you started. These are the services we currently support:

Google Contacts (CRM import). Reads names, email addresses, phone numbers, organizations, and postal addresses for a one-time import into Atlas CRM after you review a preview. Writes nothing to Google. The access token is deleted when the import completes or fails.
Google Calendar (Calendar import and two-way sync). For a one-time import, Atlas reads the calendar list and the events in the calendar and date range you choose, writes nothing to Google, and deletes the token when the import completes or fails. For two-way sync, Atlas reads events on the calendar you connect and creates, updates, and deletes events on that calendar to mirror changes you make in Atlas. The token is kept while sync is connected and deleted when you disconnect.
Apple iCloud Contacts and Calendar (CardDAV and CalDAV). Atlas signs in with your Apple ID and an app-specific password that you generate at appleid.apple.com; Apple does not use an OAuth sign-in for this. For CRM contact import, Atlas reads the contacts you choose. For Calendar, Atlas reads the calendars you choose and writes calendar events only for two-way sync. The app-specific password is stored encrypted while an import is in progress, or while calendar sync is connected. If you authenticate but do not start the import, it is deleted within 24 hours. You can revoke it at any time at appleid.apple.com.

Atlas File Storage also includes imports from Google Drive and Dropbox that are not currently turned on. They are not available to customers, and this policy will be updated before either is.

Atlas does not run background or recurring access against a connected account except for calendar sync you have explicitly turned on. Atlas never sells, shares, or uses connected-account data for advertising, and never uses it to train machine-learning models.

Data you import becomes part of your organization’s content in Atlas and is kept until you or your organization delete it, or until your organization’s data is deleted as described under “Data retention and deletion” below. Server and audit logs are kept for 90 days.

Technical information. IP address, browser type, pages requested, and timestamps, kept in server and audit logs for security and troubleshooting.

Cookies. A session cookie to keep you signed in, a CSRF token, an optional “trust this device” cookie for two-factor authentication, and theme or layout preferences. Atlas does not use advertising or cross-site tracking cookies.

How Atlas uses information

To provide, operate, secure, and support Atlas and the apps you subscribe to.
To bill your organization and send invoices, receipts, and payment notices.
To send transactional email (sign-in codes, password resets, invitations, billing notices, terms updates). Marketing email is sent only with consent and always has an unsubscribe link.
To detect and prevent abuse and to comply with law.

How Atlas protects information

Data in transit is encrypted with TLS. Passwords are hashed; connected-account tokens and app-specific passwords are encrypted at rest (AES-256-GCM).
Access inside Atlas is scoped to your organization; each app verifies a signed, short-lived token on every internal request.
Atlas runs on servers Hyperion Works owns and maintains, colocated at a data center in Tempe, Arizona, USA. There is no third-party hosting provider in this chain. Files in Atlas File Storage are replicated across multiple storage servers and backed up.
Administrative access is limited to authorized Hyperion Works staff and is logged.

Sharing

We share Atlas information only with:

Service providers who process it for us under contract: payment processing (Authorize.Net) and email delivery (our own relay at hyperionworks.com).
Your organization’s administrators, who can see members, usage, and content within your organization.
Authorities, when required by law or to protect rights and safety.

We do not sell personal information.

Google API Services User Data Policy. Atlas’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention and deletion

Account and organization data is kept while the account is active.
Content in an app is kept while the organization subscribes. After an organization unsubscribes from an app, its data in that app is retained for 90 days so the subscription can be restored, then permanently deleted.
Imported-account tokens are deleted as described above.
Invoices and payment records are kept for 7 years as required for tax and accounting.
Logs are kept for 90 days.
You can delete your organization (and all of its data in every app) from Organization settings, or ask us at the address below. Deletion is permanent after the retention window.

Your choices and rights

Review and update your profile and organization details in Atlas.
Disconnect a connected Google or Apple account at any time from the app’s settings; you can also revoke Atlas at myaccount.google.com/permissions or appleid.apple.com.
Export your data: CSV export from Atlas CRM, file download from Atlas File Storage, and calendar export from Atlas Calendar.
Depending on where you live you may have rights to access, correct, delete, or port your data, or to object to processing. Contact us and we will respond within 30 days.