Privacy Policy

What we collect. When you sign in we receive your email address and an account identifier; we do not receive your name, contacts, location, or assistant conversation history. We also process subscription and usage records, sandbox configuration, the tool requests you make, logs, and content you choose to store. Our load balancer and security logs record each request's IP address, time, path, and user agent.

Why. We use this data only to authenticate you, run and secure your sandboxes, meter usage, prevent abuse, and provide support. We do not use it for advertising or profiling, and we do not sell personal information.

Where it is stored. Sandbox files may be stored in encrypted persistent workspaces, private object storage, account records, and PostgreSQL resources assigned to your account.

Who receives it. Amazon Web Services hosts the service and handles sign-in. Stripe processes payments; ATL Sandbox does not store complete payment-card details. When you use ATL Sandbox through an AI assistant such as ChatGPT or Claude, the assistant sends us your tool requests and receives the results, and its own privacy policy governs what it does with them. Code you run in a sandbox can reach the public internet as you direct it. We otherwise share data only to comply with law, prevent abuse, and protect users.

Retention and your choices. Control-plane logs are retained for 14 days; access, security, and audit logs are retained for up to 90 days; job and run history is retained for 30 days. Workspace backups expire after 7 days and database backups after 14 days. Account records and user-created workspace, database, and object content remain until the account owner deletes them or requests deletion. After deletion, residual backup copies expire within 14 days, while billing records may be retained where law requires. You can delete sandboxes, storage, and objects yourself at any time, and you may request access, export, correction, or account deletion using the contact below. Do not submit payment-card data, health information, government identifiers, passwords, API keys, authentication tokens, or other access credentials. Public website publishing intentionally makes selected artifacts available to anyone.