Atrium EliteBeta
LoginGet started

Privacy Policy

Last updated: July 6, 2026

This Privacy Policy explains how Atrium Elite ("Atrium Elite," "we," "us") collects, uses, and shares personal information in connection with the Atrium Elite platform and website (the "Service").

Controller vs. processor. For account and website information, we act as a controller. For the data our customers enter into the Service about their properties, tenants, owners, and investors ("Customer Data"), we act as a processor on the customer's behalf and process it only per their instructions and our agreement; if you are an individual whose data appears in a customer's account, please contact that customer (the controller) about your data.

1. Information we collect

  • Account information you provide: name, email, company, and authentication data (we use a managed identity provider; passwords are not stored in readable form, and we support multi-factor authentication).
  • Customer Data you input to operate your business: property, lease, rent-roll, financial, document, and contact records — including information about your tenants, owners, and investors.
  • Payment information: processed by our payment provider (Stripe). We receive limited billing details and subscription status; we do not store full card numbers.
  • Usage & device data: log data, IP address, browser/device type, and actions taken, used to operate and secure the Service.
  • Cookies: a session cookie to keep you signed in, a preview cookie for demo/read-only access, and a preference cookie (e.g., light/dark theme). We do not use third-party advertising cookies.

2. How we use information

To provide, secure, support, and improve the Service; to process payments and manage subscriptions; to communicate with you about your account and service-related matters; to comply with legal obligations; and to detect and prevent fraud or abuse.

We may also create and use aggregated and de-identified data — data that no longer identifies any individual or customer and cannot reasonably be used to re-identify them — to develop and improve the Service and our analytical and machine-learning models and to produce anonymized, statistical benchmarks and market insights. Aggregated and de-identified data is not personal information. Customers can opt out of the use of their data for cross-customer benchmarks (see the "Aggregated and De-Identified Data" section of the Terms of Service).

3. Legal bases (where applicable, e.g., EEA/UK)

We process personal information as necessary to perform our contract with you, for our legitimate interests in operating and securing the Service, to comply with law, and — where required — with your consent.

4. How we share information

We do not sell personal information. We share it with:

  • Subprocessors that host and power the Service: Amazon Web Services (cloud hosting, database, authentication via Amazon Cognito, email delivery via Amazon SES, and document storage via Amazon S3) and Stripe (payment processing).
  • Professional advisors, authorities, or acquirers where required by law, to protect rights and safety, or in connection with a corporate transaction.

A current list of subprocessors is available on request. Our Data Processing Addendum (DPA) governs our processing of Customer Data on your behalf; business customers may request a signed copy.

5. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, then delete or de-identify it within a reasonable period, subject to legal, accounting, or security retention requirements. Customers may export or request deletion of Customer Data as described in our agreement.

6. Security

We use industry-standard safeguards, including encryption in transit and at rest, access controls, and multi-factor authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. International transfers

The Service is hosted in the United States. If you access it from outside the U.S., your information may be transferred to and processed in the U.S. and other countries with different data-protection laws.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including to know, delete, and not be discriminated against for exercising rights; we do not sell or "share" personal information for cross-context behavioral advertising. To exercise rights, contact us; if your data is held by a customer as Customer Data, we will refer your request to that customer.

9. Children

The Service is intended for businesses and is not directed to children under 18. We do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Policy; material changes will be posted with a new "Last updated" date or otherwise communicated.

11. Contact

Privacy questions or requests: privacy@atriumelite.com.