This Data Processing Addendum ("DPA") is between SingleStack Ventures, LLC, doing business as Atlas Visibility ("Atlas"), and the Client that has accepted the Atlas Terms of Use or an applicable order. It forms part of the agreement between Atlas and Client when Atlas processes Client Personal Data on Client's behalf.
1. Scope and Definitions
"Client Personal Data" means personal information that Atlas processes on Client's behalf under the agreement, including personal information in Client Materials, authorized workspace records, connected-service information, deliverables, and related service records. "Data Protection Law" means a U.S. privacy or data protection law applicable to that processing. "Process," "personal information," "controller," "business," "processor," and "service provider" have the meanings given by applicable Data Protection Law.
This DPA does not apply to processing for which Atlas is an independent controller or business under applicable law, such as Atlas's own subscription and billing administration, business records, legal compliance, and website analytics or advertising. Security and service records remain subject to this DPA to the extent Atlas processes them on Client's behalf. A label in this agreement does not determine a party's role or exclude mandatory legal obligations.
2. Roles and Instructions
Where the actual processing and applicable Data Protection Law establish Client as a controller or business and Atlas as its processor or service provider, this DPA governs that relationship. Client may be an individual or an organization; an individual subscription alone does not establish those statutory roles. Client instructs Atlas to process Client Personal Data to authenticate authorized users and manage their workspace access; store and organize authorized business and knowledge-base information; perform requested business research and analysis; generate, review, deliver, and publish authorized content and reports; operate Client-authorized integrations; and provide support, security, error investigation, and reliability maintenance for the contracted Services. The agreement, applicable Order, authorized feature settings, and subsequent lawful written instructions document those instructions. General service-improvement language does not authorize an unrelated use of Client Personal Data.
Atlas will not sell or share Client Personal Data, retain, use, or disclose it for purposes outside the specified processing purposes or direct business relationship, or combine it with personal information received from another source, except as expressly permitted by applicable Data Protection Law. Provider terms do not independently expand Client's instructions.
Atlas will not use private customer information to train general-purpose AI models and will not authorize processors to use it for that training. For this commitment, private customer information means nonpublic personal information and confidential Client Materials. Authorized AI inference, retrieval from a knowledge base (including retrieval-augmented generation), and other AI processing to deliver the Services remain permitted under the agreement and Client's documented lawful instructions.
3. Processing Details
- Subject and purpose: visibility services, knowledge-base development, AI-assisted content, publishing, reporting, support, security, and related contracted operations
- Duration: the service relationship and any additional period needed to complete lawful return or deletion instructions, subject to Section 11 and mandatory legal requirements
- Data: contact information, Client Materials, authorized knowledge-base information, content, correspondence, authorized integration credentials where required, workspace membership and access information, technical metadata, workflow records, and limited personal information included in the authorized processing
- People: individual Clients, Client's representatives, personnel, customers, prospects, vendors, reviewers, and other individuals whose information Client lawfully provides
The Services are not designed for protected health information, payment-card numbers, government identification numbers, children's data, or other regulated or highly sensitive information. Client will not provide that information unless Atlas expressly agrees in a signed addendum.
4. Client Responsibilities
Client is responsible for the lawfulness, fairness, accuracy, and transparency of its instructions and Client Personal Data. Client will provide required notices, obtain required consents, honor applicable rights, minimize information supplied to Atlas, and ensure that its instructions do not violate Data Protection Law or third-party rights.
5. Atlas Obligations
Atlas will:
- process Client Personal Data only on documented instructions
- ensure that personnel authorized to process it are subject to appropriate confidentiality obligations
- maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of the processing
- reasonably assist Client with applicable rights requests, security obligations, assessments, and regulator inquiries, taking into account the nature of the processing
- notify Client if Atlas reasonably believes an instruction violates applicable Data Protection Law and may suspend the affected processing while the parties address the concern
- comply with applicable Data Protection Law for this processing, including the same level of privacy protection required by the California Consumer Privacy Act and its regulations where they apply, and notify Client if Atlas determines that it can no longer meet those obligations
- permit Client, upon notice, to take reasonable and appropriate steps to verify lawful use and to stop and remediate unauthorized use of Client Personal Data, subject to reasonable safeguards for security, confidentiality, and other clients' information that do not defeat rights required by law
6. Security
Atlas's safeguards may include access controls, authentication, least-privilege practices, encryption where appropriate, secure transmission, system and provider configuration, backups, vulnerability and dependency review, logging, incident response, and personnel or contractor controls. No security program can guarantee that an incident will never occur.
7. Subprocessors
Client gives Atlas general authorization to engage subprocessors needed to provide the Services. Atlas will require each subprocessor to protect Client Personal Data through a written contract imposing the applicable substantive data-protection obligations of this DPA and Data Protection Law for the processing it performs. Atlas remains responsible for its subprocessors to the extent required by applicable law and the agreement.
Atlas maintains a current Subprocessors and Service Providers page. Atlas will update that page for material provider changes. Where Data Protection Law or an Order requires prior notice or an opportunity to object, Atlas will provide that notice and opportunity before the new provider begins the affected processing. Client may raise a reasonable, documented data-protection objection promptly after receiving notice. The parties will work in good faith on a commercially reasonable solution; if none is available, either party may terminate only the affected Service, subject to mandatory law and applicable payment and termination provisions.
8. Rights Requests
If Atlas receives a verified request concerning Client Personal Data, Atlas may direct the requester to Client unless prohibited by law. Atlas will provide assistance required by Data Protection Law and reasonable additional assistance on Client's written request. Where legally permitted, the parties may agree on reasonable charges for documented work beyond ordinary assistance. A charge or a product limitation does not excuse legally required cooperation or delay a mandatory response deadline. Client remains responsible for responding to the requester except where law assigns that duty to Atlas.
9. Security Incidents
A "Security Incident" is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Personal Data in Atlas's custody or control. Unsuccessful attempts that do not compromise that information are not Security Incidents. Atlas will notify Client without undue delay after becoming aware of a Security Incident and within any shorter deadline required by applicable law, including deadlines triggered by a determination or reason to believe that a breach occurred. Atlas will not wait for a completed investigation before providing legally required notice. Initial notice may contain limited information; Atlas will provide material updates as reasonably available and cooperate with Client's legally required response. Notice is not an admission of fault or liability. Client remains responsible for its notices to individuals, regulators, or other parties unless law assigns that duty to Atlas.
10. Legal Requests
Atlas may disclose Client Personal Data when required by valid legal process. Where legally permitted, Atlas will notify Client before disclosure and reasonably cooperate with Client's effort to seek confidential treatment or narrow the request.
11. Return and Deletion
At the end of the Services, Atlas will, at Client's direction, return or delete Client Personal Data as required by Data Protection Law, unless retention is required by law. The agreement's data-export procedures may govern the format and method of return but do not remove mandatory rights. Pending deletion from routine backups, Atlas will protect the retained data, restrict its use to permitted backup and recovery purposes, and reapply deletion instructions if it is restored, as required by law. Atlas will direct applicable subprocessors to comply with the same return or deletion duties.
Atlas may retain its own billing, contract, security, and dispute records only to the extent legally permitted and reasonably necessary for their independent purposes. This does not authorize retaining the complete Client dataset for a general recordkeeping purpose or overriding a mandatory processor-deletion obligation. Information published at Client's direction or retained independently by third parties may remain outside Atlas's control; copies held by Atlas's subprocessors remain subject to applicable deletion obligations.
12. Information and Audits
On reasonable written request, Atlas will provide information reasonably necessary to demonstrate compliance with this DPA. If required by applicable law and the information supplied is insufficient, Client may request one audit per year during normal business hours, subject to reasonable scope, confidentiality, security, noninterference, and cost controls. An auditor may not be a competitor of Atlas. Atlas may satisfy an audit request with a current independent report where appropriate. These procedures do not limit an assessment, audit, regulator inquiry, or information right that Data Protection Law requires, including a reasonable additional assessment following a material Security Incident or substantiated compliance concern where required by law.
13. Provider Terms and Retention
Provider retention, processing locations, access, and deletion practices depend on the provider, product tier, contract, and Atlas account configuration. This DPA does not promise a fixed provider retention or deletion period unless Atlas confirms it in a signed writing. These variations do not qualify the no-training commitment in Section 2, permit processing contrary to Client's lawful instructions, or override Atlas's obligations under this DPA or applicable law.
14. Order of Precedence and Liability
If this DPA conflicts with the Terms on the processing of Client Personal Data, this DPA controls only for that subject. The limitations of liability, dispute provisions, governing law, and other remedies in the Terms apply to this DPA unless applicable law requires otherwise. Mandatory Data Protection Law controls over any inconsistent provision of this DPA, the Terms, an Order, or provider terms. Nothing in the agreement waives a nonwaivable privacy right, permits prohibited processing, or removes a duty imposed by law.
15. Contact
Questions or requests concerning this DPA may be sent to team@atlasvisibility.com.