Privacy Policy

Last updated: 15 July 2026

1. Overview

This policy explains what Atlex collects, why, and the choices you have. We collect the minimum needed to run the Service and never sell your data.

2. What we collect

Account data: your name, email, and profile photo from Google sign-in.
Connected-system data: read-only metadata about your cloud resources, repositories, deployments, and dependencies, used to build your graph. This can include personal data such as commit and pull-request author names, and ticket assignees.
Usage data: logs and events needed to operate, secure, and improve the Service.

3. How we use it

We use your data to provide the Service: to build and keep your knowledge graph current, to answer your questions with citations, to send the alerts you configure, and to keep the platform secure. We do not use your connected-system data to train shared models.

4. Read-only by design

Atlex requests read-only access to your systems and never writes to your cloud or code. Your data is isolated per organization at every layer, so one customer can never see another customer’s data.

5. Service providers

We use a small number of vetted providers to run the Service - managed database and file storage, cloud hosting, transactional email, and payment processing. Each is bound by data-protection obligations consistent with this policy, and none of them is permitted to use your data for their own purposes.

A current list of these providers, and the role each one plays, is available to customers and to anyone conducting a security review on request.

AI processing works one of two ways, and which one applies to you depends on a setting you control. If your organization configures its own AI provider (bring-your-own key), the relevant context is sent to that provider under your agreement with them, not ours. If it does not, questions are answered using an AI provider engaged by Atlex, under our agreement with them. In both cases only the context needed to answer the question is sent, and no AI provider we engage is permitted to train on your data.

You can see which applies at any time in Settings, and switching to your own provider takes effect immediately.

6. Where your data is processed

The Service is hosted in Australia. AI processing occurs wherever the relevant model provider operates - the one your organization configured, or the one Atlex engages if you have not configured your own. Where personal data is transferred across borders, we rely on appropriate safeguards as required by applicable law.

7. Retention & deletion

We keep your data for as long as your account is active. Raw source snapshots are kept on a rolling window (typically 30 days) and activity history for a limited period; older records are automatically purged. Disconnecting a source removes the data derived from it - including the stored credential and the raw snapshots - and closing your account deletes your organization’s data, including files in storage, subject to legal requirements.

8. Your rights

You may access, correct, export, or delete your personal data. Organization admins can export the personal data we hold for the organization from the app; deletion requests are honored by disconnecting a source or deleting the organization, and we can assist with individual requests. We respond within the timeframes required by applicable law.

9. Contact

Privacy questions? Reach our team at .