Privacy Policy

Sist oppdatert: 2026-09-13

ATHOMIC handles two different kinds of personal data under two different legal roles. Getting the difference right is the whole point of this document.

English is the governing language of this policy. Translations are provided for convenience only; where they differ, the English text applies.

1. Two roles

We are the controller for data about you, the merchant: your account, your store's configuration, your billing, and how you use the Service. This policy governs it.

We are a processor for data about your customers: the email addresses, names and marketing-consent states we read from your Shopify store so that we can send campaign email on your behalf. You are the controller of that data. We process it only on your instructions, under Schedule 1 of our Terms of Service. Your customers should be directed to your own privacy policy, not this one.

Controller for both purposes on our side: ATHOM AS, org. 831 754 702, Kongens gate 51C, 7012 Trondheim, Norway. We have not appointed a Data Protection Officer; data-protection enquiries go to privacy@athomic.no.

2. Merchant data we control

We do not sell personal data. We do not train any model on your data, and we use our AI providers under their standard API terms, which exclude submitted data from provider model training.

3. Your customers' data we process for you

This only happens when your Shopify installation has granted permission to read customers. Shopify treats customer data as Protected Customer Data and gates that permission behind an approval, and ATHOMIC does not currently request it at install — so unless your store's existing grant already carries it, campaign email does not send and ATHOMIC holds no customer data at all.

We read consent state; we do not collect consent. You are responsible for having a valid legal basis for every address, and we send only to those your store records as subscribed.

4. Legal bases

For merchant data:

• Contract (Art. 6(1)(b)) — running the Service you subscribed to, billing it, and sending account email such as welcome, trial-ending and team invitations.
• Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse, diagnosing errors, and understanding product usage in aggregate. You can object at privacy@athomic.no.
• Legal obligation (Art. 6(1)(c)) — keeping accounting records.

For your customers' data we rely on your basis as controller — normally consent under the GDPR and, in Norway, the Marketing Control Act.

5. Competitor prices

We fetch publicly listed prices from price-comparison sources — Prisjakt, Prisradar and Klarna — and from your own store's product pages. We fetch as an ordinary client over HTTPS, identifying ourselves in the user agent, only from a fixed allow-list of permitted hosts, re-checking every redirect and capping how much of a page we read. Where the catalog module harvests a supplier's website, it reads that site's robots.txt first and skips paths the site disallows. On our public site, the analyzer reads the publicly available product listing of the store address you type in. No personal data is collected in any of this.

6. AI providers — what we send and what we never send

Campaign copy and campaign images are generated by a third-party AI provider. By default that is OpenAI; a store can be configured to use Anthropic for text instead, and the pre-signup campaign preview on our public site uses Anthropic where it is available.

What we send: your store name and web address, your brand-voice settings (tone, description, example posts, words to avoid, emoji and hashtag policy), campaign facts (name, discount, dates), product names, variants, supplier names and prices, product descriptions, any guidance you type for a generation, and — for image generation — your product photographs, which are downloaded by us and uploaded to the provider as files.

What we never send: your customers' data. No email address, no name, no recipient list and no order data is included in any AI request. The code paths that build these requests have no access to customer records.

Generated images are stored in our own file storage and served from public URLs, because Meta fetches an image by URL when publishing it.

7. Shopify

At install your store grants: reading and writing products, and reading and writing inventory. Reading customers and orders is Protected Customer Data; we do not request it at install today, and campaign email works only on stores whose existing grant already carries it.

With those permissions we read products, variants, prices, compare-at prices, inventory items and costs, barcodes, metafield definitions and your shop profile — and, where granted, customer email addresses, names and email-marketing consent states. We write product fields, variant prices and compare-at prices, inventory costs, barcodes, product media, metafields, and product publication, and can delete a product you ask us to delete.

We implement Shopify's three mandatory privacy webhooks:

• customers/redact — a customer asked your store to erase them. We delete every campaign send record and unsubscribe record we hold for that address in your store.
• customers/data_request — a customer asked what is held on them. Because the webhook has no channel back to the customer, we raise a notification in your ATHOMIC account stating exactly what we hold for that address, so that you, as controller, can answer them.
• shop/redact — sent about 48 hours after you uninstall. We delete every store-scoped record: campaigns, drafts, send logs and recipients, campaign planning runs, scheduled actions, social posts, email templates, AI image jobs, marketing and planner configuration, Meta installation and tokens, sender domains, the unsubscribe list, agent configuration, activity and runs, subscription and billing audit records, feeds, notifications and preferences, products, memberships, invitations, store settings, and the Shopify installation itself.

8. Facebook and Instagram

With your authorisation through Meta we access: the Facebook Pages you manage (pages_show_list, pages_read_engagement), permission to publish to a Page (pages_manage_posts), your linked Instagram Business account (instagram_basic, instagram_content_publish), and your commerce catalogue (business_management, catalog_management) for product tagging.

We store: Page ID and access token, Instagram user ID, business and catalogue IDs, a short-lived cache of your catalogue's products, the content you compose, and a record of each publish attempt. We publish only when you act. We never read your personal profile, friends or messages.

Disconnect at any time from Store then Integrations in ATHOMIC, or from Facebook Business Tools settings. Either way we delete the stored tokens and identifiers on receipt of the signal — see Data Deletion. Meta's own Privacy Policy and Platform Terms also apply.

9. Email we send

• Account email to you — welcome, trial ending, team invitations, repricing run summaries, circuit-breaker alerts, campaign start and end notices. These are about your account and carry no unsubscribe header; turn the operational ones off in notification preferences.
• Campaign email to your customers — sent one message per recipient, never to a shared address list. Each carries a signed unsubscribe link unique to that recipient and your store, plus the one-click unsubscribe headers mail clients use. Unsubscribing is immediate and permanent for your store.

Both go through Resend, which records delivery, bounce and complaint events. For campaign email we also receive open and click events and count them per campaign, so that you can see how a campaign performed.

10. Sub-processors

Each is engaged under a data processing agreement. We give 30 days' notice before adding or replacing one; see Schedule 1 section 7 of the Terms.

11. International transfers

Where a sub-processor is outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses, an adequacy decision, or the EU-US Data Privacy Framework where the provider is certified, together with additional measures such as encryption in transit and minimisation of what is sent.

12. Retention

13. Security

Encryption in transit, and at rest at the storage layer; per-store scoping of every stored record; least-privilege access with server-side credentials never exposed to the browser; signed, per-recipient unsubscribe tokens; verified signatures on every Shopify, Meta and email-provider callback; a fixed allow-list and private-address checks on outbound fetches; and twice-daily database backups to a private, access-controlled bucket. No system is perfectly secure; if a breach affects your data we will tell you without undue delay.

14. Cookies and tracking

ATHOMIC sets session cookies for authentication only, plus short-lived cookies that carry an OAuth state value through a Shopify or Meta connection. There is no analytics script, advertising pixel or tracking cookie on any ATHOMIC page. Our product analytics run entirely server-side, with IP-based geolocation disabled.

The one thing worth knowing: when an error occurs while you are signed in, our monitoring tool records a replay of the ATHOMIC interface as you were using it, so we can reproduce the fault. It captures our own application only, it is triggered by errors and never by ordinary sessions, text and form inputs are masked in the recording, and it never involves your customers.

15. Your rights

As a merchant you may access, correct, erase, restrict, object to, or receive a portable copy of the personal data we hold about you. Write to privacy@athomic.no; most of it is also available or editable in the app, and Data Deletion sets out every deletion route. You may complain to Datatilsynet, the Norwegian Data Protection Authority, or to the supervisory authority where you live.

If you are a customer of a store that uses ATHOMIC: contact that store. They are the controller and we act only on their instructions. If you write to us we will pass your request on and tell you we have. You can always unsubscribe using the link in any campaign email, and that takes effect immediately.

16. Children

ATHOMIC is a business tool. It is not directed at children and we do not knowingly collect their data.

17. Changes

We will notify material changes by email or in-app before they take effect, and the date at the top of this page always reflects the current version.

18. Contact

ATHOM AS, Kongens gate 51C, 7012 Trondheim, Norway. Org. 831 754 702. privacy@athomic.no