Legal

Privacy Policy

Effective date: March 14, 2026  ·  Iroko Labs Inc.

Atona is a product of Iroko Labs Inc. ("we", "us", or "our"). This Privacy Policy explains how we collect, use, and protect your personal information when you use Atona ("the Service").

By using Atona, you agree to the practices described in this policy.

1. Information we collect

We collect information you provide directly and information generated through your use of the Service:

• Account information: name, email address, phone number
• Google account data: email messages, calendar events, and contacts — only when you explicitly grant access
• Communications: SMS and WhatsApp messages sent and received through the Service
• Voice data: call transcripts and summaries when you use voice features
• Usage data: interactions with the Service, feature usage, and preferences

2. How we use Google user data

When you connect your Google account, Atona may access:

• Gmail (read, send, modify) — to triage your inbox, draft responses, and surface important emails in your daily briefing
• Google Calendar — to schedule, reschedule, and prepare you for meetings
• Google Contacts — to personalize communication and recognize senders

We use this data solely to provide the Atona service to you. Specifically:

• We do not sell your Google data to any third party
• We do not use your Google data for advertising purposes
• We do not allow humans to read your email content except when required for security investigation, to comply with applicable law, or with your explicit permission
• We do not use your Google data to train AI or machine learning models
• We only transfer your Google data to others as necessary to provide the Service, subject to confidentiality obligations

3. How we use your information

We use the information we collect to:

• Provide, operate, and improve the Atona service
• Generate your daily briefings and handle tasks on your behalf
• Send you service-related notifications and updates
• Respond to your requests and support inquiries
• Ensure the security and integrity of the Service

4. Sensitive data handling

This classification happens automatically. You do not need to configure or manage it. Sensitive content remains accessible only through your email provider — Atona will not read, summarize, or act on it.

5. How AI processes your data

Atona uses third-party AI systems (such as Anthropic) to understand your requests and generate responses. Here is how that works:

• What is processed: non-sensitive email metadata (subject lines, sender names), calendar details, your instructions, and drafted responses
• When processing occurs: only when fulfilling a specific feature or request — such as drafting a reply, generating a briefing, or summarizing a meeting
• What is excluded: sensitive content (financial, medical, legal) is never sent to AI providers, as described in Section 4
• No training: your data is never used to train, fine-tune, or improve any AI or machine learning models — ours or any third party's

AI providers process data strictly on behalf of Atona, under contractual agreements that prohibit them from retaining, sharing, or using your data for any purpose other than providing the Service.

6. Automated actions on your behalf

Atona is designed to act on your behalf — not just provide information. This means Atona may:

• Send or reply to emails using your connected email account
• Schedule, reschedule, or cancel calendar events
• Send SMS or WhatsApp messages from your assistant number
• Flag emails that need your attention
• Draft responses for your review before sending

These actions are based on your instructions, preferences, or features you have enabled. Atona does not take actions outside the scope of what you have authorized.

7. Data retention

Atona is designed to minimize the data it stores:

• Email content: never stored. Atona reads emails directly from your email provider (e.g., Gmail) in real time. Email content is not copied to Atona's servers.
• Email metadata: subject lines, sender names, and flags (e.g., "needs your attention") are stored for up to 30 days to power briefings and notifications.
• Drafted responses: when Atona drafts a reply on your behalf, the draft is retained temporarily until you approve, edit, or dismiss it.
• Assistant memory: your preferences, interaction history, and context are retained while your account is active. This is what allows Atona to learn how you work and improve over time.
• Cached integration data: when you disconnect an integration (e.g., Google), all cached data from that integration is deleted within 30 days.

You may request deletion of all your data at any time by contacting privacy@atona.ai.

8. Data sharing

We do not sell your personal information. We do not share your data for advertising purposes. We may share data with:

• AI providers: such as Anthropic, who process non-sensitive data strictly on our behalf to provide the Service. These providers are contractually prohibited from retaining or using your data for any other purpose, including model training.
• Infrastructure providers: such as AWS, who host and operate the Service under strict confidentiality agreements.
• Legal requirements: when required by law, court order, or to protect the rights and safety of our users.

9. Security

We implement industry-standard security measures including encryption at rest and in transit, access controls, and regular security reviews. However, no system is completely secure. If you believe your account has been compromised, contact us immediately at security@atona.ai.

10. Your rights and controls

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Revoke Google account access at any time via your Google Account settings
• Export your data in a portable format

You can also:

• Disconnect integrations from within the Atona app under Settings
• Disable automation features — turn off auto-replies, auto-scheduling, or any other automated action individually
• Delete your account — email support@atona.ai from your registered email address to request full account and data deletion

11. Children's privacy

Atona is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use of Atona after changes take effect constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy, contact us at:

Iroko Labs Inc.
Atona Privacy Team
privacy@atona.ai