Privacy policy

Who is responsible for your data

2Atomic Inc., a Delaware corporation, 2440 Bert Dr, Building 100, Suite 105, Hollister, CA 95023. For visitors in the EU and the UK, we are the controller for the processing described here. Contact: security@2atomic.com.

This policy covers 2atomic.com. It does not cover analysis work we perform under a customer contract; that is governed by the agreement and by a data processing addendum where one applies.

What we collect

Three things:

• What you type into the contact form. Your name, your email address, the topic you pick, and your message. All four are sent to our inbox as a plain-text email. You choose what goes in the message, so please do not put sensitive personal information in it.
• What our server logs about the request. One structured line per request: the time, the method and path including any query string, your IP address, the status and byte counts of the response, the TLS version, cipher, and server name your client negotiated, and the headers your browser sends, which include the user-agent string, Referer, and Accept-Language. Credential headers (Authorization, Cookie, Proxy-Authorization) are never written: only the name and the length of the value. Your IP address is also held in memory to rate-limit the contact form so a script cannot flood it.
• What you give us if you create an account. Your username and email address, the public credential of the passkey your device registers, the projects you create, the firmware images you upload and the analysis results produced from them, and the state of your entitlement. Invoices are issued and paid through Stripe, our payment processor.

What we do not do

• Only a session cookie. This site sets one signed session cookie, used to keep you signed in and to protect forms. It carries no advertising or analytics identifier.
• No analytics and no advertising trackers. There is no Google Analytics, no pixel, no tag manager, and no A/B tooling.
• No third-party assets. Every stylesheet and script is served from this domain. No hosted fonts and no CDN, so no third party learns that you visited.
• No profiling. We build no profile of you and make no automated decisions about you.
• We do not sell or share your personal information as those terms are defined under the California Consumer Privacy Act, and we have not in the preceding twelve months. We do not disclose it for cross-context behavioral advertising.

Why we are allowed to hold it

We use contact-form data to answer you and to keep a record of the conversation, and log data to keep the site up, to prevent abuse, and to investigate a security incident. Where the GDPR or the UK GDPR applies, our legal basis is our legitimate interest in responding to inquiries and in securing our own service, and taking steps at your request before entering a contract where you are asking about buying something.

How long we keep it

• Contact-form emails: 24 months from the last message in the thread, then deleted, unless the exchange became a customer record, in which case the contract governs it.
• Request logs: 90 days, then deleted, unless a specific entry is part of an open security investigation and is held until that closes.
• Rate-limit counters: one hour. They are held in memory for the length of the rate-limiting window and are not written to disk, so they do not survive a restart.

Who else sees it

The categories of third party that may process this data on our behalf, and nothing beyond what they need to do the job:

• Our email provider, which carries and stores the contact-form message as ordinary email.
• Our hosting and network provider, which operates the servers and the connection the request arrives over.
• Stripe, our payment processor, which issues your invoices and takes their payment.

We also disclose data where the law requires it, such as a valid legal process, or to establish or defend a legal claim. If we are ever compelled to hand something over, we will tell you unless we are legally barred from doing so.

We do not transfer your data outside the United States as a routine matter. Where a provider processes it elsewhere, we rely on the standard contractual clauses or another lawful transfer mechanism.

Your rights, and how to use them

Wherever you live, you can ask us to tell you what we hold about you, to correct it, or to delete it. Depending on where you live, you may also have the right to a copy in a portable format, to object to or restrict processing, to opt out of sale or sharing (we do neither), and to be free from retaliation for asking.

To exercise any of these, email security@2atomic.com from the address you contacted us from, or write to the postal address above. We will answer within 45 days and will not charge you for it. If we cannot identify you from what we hold, we will say so rather than ask you for more identifying data than we already have. You may use an authorized agent; we will ask for proof of their authority.

If you are in the EU or the UK you may complain to your supervisory authority. We would rather you told us first, and we will answer.

Do Not Track

Some browsers send a Do Not Track signal. There is no consensus on what a site must do with it. We do not track you across sites in the first place, so our behavior is the same whether or not you send the signal, and we do not respond to it differently.

Children

This site is for business use and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us something, tell us and we will delete it.

Security researchers

If you are reporting a vulnerability, the disclosure policy governs what we do with your report, including credit and safe harbour. We keep report correspondence for as long as the issue and its advisory are live, which may be longer than the 24 months above.

Changes to this policy

We version this page and date every change. If we change it in a way that materially affects what we do with data we already hold, we will say so at the top of this page for at least 30 days, and we will contact you directly where we have your address and the change is significant.

Contact

Privacy questions and rights requests: security@2atomic.com, or 2Atomic Inc., 2440 Bert Dr, Building 100, Suite 105, Hollister, CA 95023.