Privacy policy

Atlas is business software for small service businesses (such as barbershops and salons), made by Conkoda (To be confirmed), registered at To be confirmed, enterprise number To be confirmed. In this policy, “we” and “us” mean Conkoda.

We handle personal data in two different roles:

• As controller for this website and for the accounts of the people who use Atlas — for example the owner and team of a business. We decide why and how that data is used.
• As processor for the data a business puts into Atlas about its own clients, such as appointments, contact details and notes. The business is the controller of that data; we process it only on its instructions to provide the service. The terms of that processing are set out in a data processing agreement with each business (agreement to be finalised).

If you are a client of a business that uses Atlas (for example, you booked an appointment), please contact that business first about your data. We will help the business respond.

Account data

Your name, email address and password (stored only as a one-way hash, never in readable form), two-factor login settings, your preferences such as language and theme, and which businesses you belong to and with which role.

Security and session data

When you sign in we keep a session record that includes your IP address and browser type. We also keep records of login attempts to limit abuse, and an audit trail of important actions inside a business account (who changed what).

Business data

Information about the business itself: its name, location (country, city and, where available, coordinates), opening hours, services and prices, team members and schedules, settings, legal details for receipts (such as address and VAT number), and sales and revenue records. We keep business-level revenue figures and locations from the start of the service; how we may use them in aggregate, anonymised form in the future is to be specified before any such use.

Data about a business’s clients (processed on the business’s behalf)

Depending on how a business uses Atlas: client names, contact details, date of birth, address, appointment and purchase history, notes, marketing preferences and any extra fields the business chooses to keep. Some fields a business may choose to record (for example allergies) can be sensitive; the business decides what it records and is responsible for having a lawful basis for it.

Booking page data

When someone books through a business’s public booking page, we process the name, email address, phone number, chosen service and time, any note they add and whether they opt in to marketing messages — on behalf of that business.

Payments

When a business connects its own Mollie account, payments are handled by Mollie. Card details are entered on Mollie’s pages or payment terminals, not in Atlas. We store payment status, amounts and references so sales and receipts are correct.

Atlas AI

If a business uses Atlas AI, we process the questions and instructions typed or spoken to it (including voice audio when voice is used), the answers, and the business data needed to respond — which can include client details when you ask about a client. Conversation history is stored in the business’s own workspace.

Website use

This website does not currently load third-party analytics or advertising trackers. If you arrive with campaign parameters in the link (such as utm_source), we keep them, together with the page you landed on and the referring page, in your browser’s session storage while you sign up. They are not sent to our servers, except the source, medium and campaign names when you open the demo (see “Demo sign-ups” below). Our hosting infrastructure may keep short-lived technical logs (such as IP addresses) for security; the retention period is to be confirmed.

• Providing the service — creating and running your account, bookings, sales, reminders and support. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• Security and abuse prevention — sessions, rate limiting, two-factor login and audit trails. Legal basis: our legitimate interest in keeping the service and your data safe (Art. 6(1)(f)).
• Service emails — verification, password reset and important account messages. Legal basis: performance of contract (Art. 6(1)(b)).
• Legal obligations — keeping records the law requires, such as accounting records once paid plans are offered. Legal basis: legal obligation (Art. 6(1)(c)).
• Business-level metrics — storing each business’s location and revenue totals, as described above. Legal basis: legitimate interest (Art. 6(1)(f)) (to be confirmed).
• Demo sign-ups and product news — opening the demo and abuse prevention on our legitimate interest (Art. 6(1)(f)); tips, product news and offers only with your consent (Art. 6(1)(a)). See Demo sign-ups.
• Client data processed for a business — only to provide the service to that business, on its instructions (Art. 28 GDPR). The business determines its own legal basis.

We do not sell personal data, and we do not use customer data to train AI models.

To open the demo shop we ask for your email address. Here Conkoda is the controller.

• What we collect: your email address; whether you ticked the box for tips, product news and offers, and if so when and which wording you agreed to; the language of the page; the campaign source, medium and name from the link you arrived with (if any); and when you first and last opened the demo and how often. The demo shop itself is a sample business with invented data that is deleted automatically after 24 hours.
• Opening the demo and preventing abuse — we use your email to open the demo and to limit repeated or automated demo requests. Legal basis: our legitimate interest in offering a free demo and protecting it from abuse (Art. 6(1)(f)). We do not use your email for marketing on this basis.
• Product news and tips — only if you tick the box, which is never ticked in advance and is not required to open the demo. Legal basis: your consent (Art. 6(1)(a)). Every such email contains a one-click unsubscribe link; unsubscribing is as easy as opting in and takes effect straight away.
• Retention — we keep a demo sign-up for 24 months after your last demo visit and then delete it automatically (proposed period, to be confirmed). If you unsubscribe, we stop product emails immediately and keep the note that you unsubscribed for the rest of that period, so we can honour it.
• Who processes it — the sign-up is stored in our own database with our hosting provider in Germany (see sub-processors below). When we send product emails we will use an EU email provider with a data processing agreement (provider to be confirmed before the first send).
• Your rights — you can withdraw consent at any time (the unsubscribe link, or email To be confirmed), and ask for access to or deletion of your sign-up, or object to its use, as described under “Your rights” below.

We use the following service providers to run Atlas. They process data only on our instructions. Entries marked “to be confirmed” are still being verified.

We may also disclose data where the law requires it, for example to a court or authority with a valid legal request.

We keep our main systems of record in the EU: hosting and storage in Germany, email and payments in the Netherlands, text messages in Denmark.

Atlas AI features use Google (Gemini API) or OpenAI, depending on configuration. Both are US-headquartered companies, so using Atlas AI can involve a transfer of personal data outside the European Economic Area. The safeguards for these transfers (such as the EU–US Data Privacy Framework or Standard Contractual Clauses) and the processing locations are to be confirmed. Requests to OpenAI are sent with storage disabled. We do not claim EU data residency for these AI providers.

Atlas AI works with the permissions of the person using it: it can only see and change what that person may see and change, and sensitive changes are shown for confirmation before they run. For automated insights we send aggregated business figures rather than client details. We do not use customer data to train AI models.

• Login sessions expire after 30 days and are deleted when you log out.
• Business account data is kept while the business uses Atlas. Each business’s data is kept in its own separate database area; when a business account is deleted, that entire area is removed. How and when a business can request deletion is described in our terms.
• Backups are kept for To be confirmed and then overwritten.
• Demo sign-ups are deleted 24 months after the last demo visit (proposed); see Demo sign-ups.
• Client data is kept for as long as the business decides; businesses can export or anonymise a client’s data from within Atlas.
• Other data is kept only as long as needed for the purposes above or as required by law. Specific periods are to be confirmed.

Each business has its own separate database area. Access inside a business follows roles and permissions, two-factor login is available, passwords are stored only as hashes, data travels over encrypted connections, and important actions are recorded. Read more on our security page.

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time where we rely on consent. You can also object to processing based on our legitimate interests.

To use these rights, email To be confirmed. We will respond within one month, as the GDPR requires. If your request concerns data a business keeps about you as its client, we will pass it on to that business or help it respond.

We do not use advertising or tracking cookies. Atlas uses:

• A session cookie (atlas_session) that keeps you signed in. It is HttpOnly and cannot be read by scripts. It is strictly necessary.
• A setup-tour cookie that remembers whether you have finished the in-app tour.
• Browser storage (local and session storage) for preferences such as theme and language, small interface states, and the sign-up campaign details described above.

These are needed for the site and app to work as you asked, so no consent banner is shown. If we ever add analytics or other non-essential cookies, we will ask for your consent first.

We will update this policy when our practices change and show the new date at the top. For significant changes we will notify account owners by email or in the app.

Questions about privacy: To be confirmed. Data protection officer: To be confirmed. You can also reach us through our contact page.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. Our lead authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) (to be confirmed).