← Back to Home

Privacy Policy

AtlasBurn

Control Your Burn.

Effective Date: February 22nd 2026

1. Legal Entity & Data Controller

AtlasBurn is operated by:

Akhil Anand (operating as "AtlasBurn")

("AtlasBurn", "we", "our", "us")

Address:

Kanpur Nagar, Uttar Pradesh

India

Email: [email protected]

For the purposes of:

  • EU General Data Protection Regulation (GDPR)
  • Digital Personal Data Protection Act, 2023 (India)
  • Information Technology Act, 2000 and SPDI Rules

Akhil Anand, operating as AtlasBurn, acts as the Data Controller for personal data processed through the AtlasBurn platform.

2. Jurisdiction

This Privacy Policy is governed by the laws of:

  • India (primary jurisdiction)
  • GDPR (for EU/EEA data subjects)
  • Applicable international data protection laws

Any disputes shall be subject to the exclusive jurisdiction of courts located in Kanpur, India.

3. Nature of Service

AtlasBurn provides:

  • AI API usage monitoring
  • Probabilistic runway forecasting
  • Margin stress detection
  • Operational burn analytics

AtlasBurn's cost-monitoring pipeline is content-blind — prompt and completion content is never collected or stored as telemetry (see Section 4B for the scope of this guarantee and the optional AI-assist tools it does not cover). Non-sensitive usage metadata (such as token counts, cost, model, provider, and timestamps) is stored on our servers to power cost tracking and forecasting; by creating an account and using the Services, you consent to this processing.

4. Data We Collect

A. Account Data

  • Full Name
  • Email Address
  • Organization Name
  • Role
  • Authentication Provider
  • User ID / Organization ID

Purpose: Account creation, Service delivery, Authentication, Security

B. API Usage Metadata (SDK / Connector)

We may collect:

  • Model name
  • Provider name
  • Input / Output token count
  • Cost calculation
  • Timestamp
  • Environment metadata
  • Retry indicators
  • Operational usage flags

We DO NOT collect:

  • Prompt content
  • Model outputs
  • End-user personal data inside prompts
  • Raw API keys
  • Billing credentials

Purpose: Runway forecasting, Margin modeling, Probabilistic risk analysis, Survival simulations

Automatic telemetry vs. optional AI-assist tools

The "DO NOT collect" guarantee above applies to the automatic monitoring pipeline (SDK and proxy). Each telemetry record is built from a fixed allowlist of fields — token counts, cost, model, provider, timestamp — so prompt and completion content is never stored, even if a client transmits it.

Separately, several optional in-app tools (Quality Sentry, Audit & Optimize, and the tool Recommender) analyze only text you explicitly submit to them. That text — which for Quality Sentry can include model outputs you paste in — is sent to Google Gemini (see Section 10) for processing and is not retained as telemetry. Do not submit data you are not permitted to share with a subprocessor.

C. Technical & Log Data

  • IP Address
  • Browser metadata
  • Device information
  • Access timestamps
  • Security logs

Purpose: Fraud detection, Security monitoring, System reliability

5. Lawful Basis of Processing (GDPR)

We process data under:

  • Article 6(1)(b): Contractual necessity
  • Article 6(1)(f): Legitimate interests
  • Article 6(1)(c): Legal compliance
  • Consent where applicable

6. Digital Personal Data Protection Act (India) Compliance

Under the DPDP Act, 2023, you have the right to:

  • Access your personal data
  • Request correction or erasure
  • Withdraw consent
  • Nominate a representative
  • Seek grievance redressal

Grievance Officer (India)

Name: Akhil Anand

Email: [email protected]

Response timeline: Within statutory limits under DPDP Act.

7. Data Protection Officer (DPO)

A formal Data Protection Officer will be appointed if:

  • Required under GDPR Article 37
  • Required under Indian law due to data volume
  • Required due to large-scale processing

Until such threshold is met, privacy inquiries may be directed to: [email protected]

8. Data Minimization & Content-Blind Architecture

AtlasBurn is designed to minimize exposure. Security mechanisms include:

  • HMAC-SHA256 hashed ingest keys
  • Server-side key verification
  • No storage of raw API credentials
  • No prompt logging
  • Encryption in transit (HTTPS/TLS)
  • Encryption at rest (Firestore-level)
  • Role-based access controls
  • Batched write ingestion

We store only metadata required for cost forecasting. Note: the optional featureId label you attach to events is stored verbatim to segment your own analytics — do not place personal data in feature tags.

9. Data Retention

Personal data is retained:

  • For the duration of active subscription
  • As required by applicable law
  • Until deletion request

Upon deletion:

  • Identifiable personal data is deleted within 30 days
  • Access tokens invalidated immediately
  • Aggregated statistical data may be anonymized

Organizations can also self-serve from Settings → Data: export a full JSON copy of their data, purge all telemetry while keeping the account, or permanently delete the account and all associated data.

10. Hosting & Infrastructure Subprocessors

AtlasBurn relies on the following infrastructure subprocessors to operate the platform itself. These are distinct from the AI providers (OpenAI, Anthropic, Google, Cohere, AWS Bedrock, etc.) that customers call through AtlasBurn using their own credentials:

Google (Firebase / Google Cloud)

Purpose: primary datastore (Firestore), authentication, and serverless compute. Google Gemini also powers AtlasBurn's optional AI-assist features (quality-degradation analysis, cost-optimization suggestions, and tool recommendations); text you submit to those features is sent to Gemini for processing (see Section 4B). Forecasting and risk models are deterministic and run without any LLM.

Cloudflare

Purpose: edge proxy, DDoS protection, TLS termination, and Cloudflare KV for guardrail enforcement flags. If you route provider traffic through the AtlasBurn proxy, those requests transit Cloudflare's edge and are processed in-transit to extract token counts — never stored. Traffic captured via the SDK never leaves your own process.

Data may be processed in multiple regions for redundancy. Where required for international transfers, we rely on appropriate safeguards — such as Standard Contractual Clauses (SCCs) or equivalent mechanisms — together with encrypted transmission protocols. This subprocessor list may be updated from time to time; material changes will be notified per Section 16.

10A. Cross-Tenant Benchmarking

AtlasBurn can compute aggregated, k-anonymized, de-identified statistics across customers to power benchmarks (e.g. typical cost-per-call ranges by model, retry-rate distributions, runway-compression base rates). Participation is off by default — an organization is included only after it explicitly opts in.

  • Only aggregated metrics are used — never raw events, prompts, model outputs, API keys, user identifiers, or organization identifiers.
  • A minimum cohort of k ≥ 5 organizations is required before any benchmark statistic is computed or published.
  • No raw data or identifiers ever leave the tenant boundary; aggregations are produced inside AtlasBurn's processing environment.
  • Affirmative opt-in only. Participation requires explicit consent, recorded with a timestamp, toggled by the organization owner in Settings → Data. Legal basis: GDPR Art. 6(1)(a), DPDP Act § 6, and IT Act SPDI Rule 5. Consent can be withdrawn at any time from the same screen (or by emailing [email protected]); withdrawal excludes you from all future benchmark runs. Past aggregates are not reversible as they contain no personal data.

11. International Data Transfers

If you access AtlasBurn from outside India, your data may be transferred to India or other jurisdictions where our infrastructure is located. Appropriate safeguards are implemented.

12. Security Measures

We implement:

  • HTTPS encryption
  • Firestore security rules
  • Hashed ingest keys
  • Rate limiting
  • Batched writes
  • Access segregation by organization
  • Operational audit logging

However, no system is completely secure.

13. Your Rights

GDPR (EU/EEA Users)

You may: request access, correction, deletion, restrict processing, data portability, or object to processing.

Requests: [email protected]

India (DPDP Act)

You may: access data, correct or erase, withdraw consent, nominate representative, or lodge grievance.

14. Children's Data

AtlasBurn is not intended for individuals under 18. We do not knowingly collect children's data.

15. Third-Party AI Providers

Customers connect AtlasBurn to AI providers they already use — including OpenAI, Anthropic, Google (Gemini / Vertex AI), Cohere, and AWS Bedrock — so AtlasBurn can observe usage metadata. The automatic monitoring pipeline does not send prompts or outputs to these providers on the Customer's behalf, and AtlasBurn is not responsible for their privacy practices. The one exception is the optional AI-assist tools described in Sections 4B and 10, which send text you explicitly submit to Google Gemini. Infrastructure subprocessors used to operate AtlasBurn are listed in Section 10.

16. Updates to Policy

We may update this Privacy Policy periodically. Material updates will be notified via email or platform notice.

17. Contact Information

Data Controller:

AtlasBurn

Kanpur, Uttar Pradesh, India

Email: [email protected]