Privacy Policy

1. Who we are and what this covers

Atom is a workspace for projects, people and money, provided by Ovolo IT Building Solutions Private Limited, House No. 113, Double Phatak, Meerut Road, Roorkee, Uttarakhand 247667, India (“we”, “us”). This policy covers the website at app.workonatom.in, the Atom web app, and the Atom apps for iOS and Android.

Atom is a business service, so we hold personal data in two different roles:

• On behalf of an organization. Everything inside a workspace — its members' work, HR records, finance records and files — is held for the organization that runs the workspace (our customer). That organization decides what is recorded and who can see it; it is the data fiduciary, and we process the data on its instructions under our Data Processing Addendum. If you have a question about data in a workspace, ask that organization first.
• For ourselves. We decide how we use the account details we need to run Atom, the technical data that keeps it secure, and anything you send us through the website. For that data we are the data fiduciary, and this policy explains what we do.

2. What we collect

When you visit the website

The website sets no cookies and runs no analytics or advertising scripts. If you send the contact form, we receive your name, work email, organization, team size, the plan you asked about and your message. Our hosting provider processes request data such as your IP address to deliver pages.

Your account

There is no public sign-up. An administrator of your organization creates your account, and you activate it by setting a password from an email link. Your account holds your name, email address and user ID, and — if you or your administrator add them — your phone number, gender, department and profile photo. Your password is stored only as a one-way hash. If you turn on two-factor authentication, its secret and backup codes are stored encrypted.

What you and your colleagues create

Projects, tasks, comments, chat and voice messages, notes, documents, calendar entries, leave requests, attendance check-in and check-out times, finance records such as invoices, expenses and client details, files in Drive, feedback, and a record of activity in the workspace (for example who completed a task).

HR records, if your organization uses the HR module

Employee profiles (date of birth, personal email, phone, address, emergency contact, employee code, joining, confirmation and exit dates), bank account details and tax identifiers, salary structures and payroll, performance reviews and goals, assets issued, HR documents, and recruitment records about job candidates (name, contact details, résumé, experience and interview feedback). Candidates and some employees may never use Atom themselves; the organization is responsible for telling them about this processing.

Technical data

• For each sign-in session: IP address, browser or app identifier, and when the account was last active. You can see and end your sessions.
• If you turn on notifications: a push notification token and your device's manufacturer and model.
• Error reports from the web app, which include technical details of the error and your browser.
• Aggregate page-view statistics for the web app, collected without cookies.
• A daily count of each workspace's members and storage, used for plan limits and billing.

Mobile app permissions

The camera is used only to scan a sign-in QR code (the image is not stored or sent), the microphone only while you record a voice message, and your photo library only for a photo you pick. The apps do not access your location or contacts, and contain no advertising or third-party analytics.

3. How we use it

• To provide Atom: signing you in, showing and syncing your workspace, and delivering messages and notifications.
• To send email the service needs: account activation, password reset and sign-in codes, being added to a workspace, leave decisions, a daily summary of leave awaiting approval, and finance reports a workspace has set up.
• To keep Atom secure: detecting misuse, investigating errors, and enforcing our Acceptable Use Policy.
• To apply plan limits, bill for the service and answer support requests.
• To reply to enquiries sent through the website.
• To meet legal obligations.

We do not sell personal data, use it for advertising, or send marketing email. Atom has no AI features, and we do not use workspace content to train machine-learning models. If any of this changes, we will update this policy first and ask for consent where the law requires it.

4. Our legal basis

We process personal data under the Digital Personal Data Protection Act, 2023. For workspace data, the organization decides the basis and we act on its instructions. For the data we control, we rely on the consent you give when you activate your account or send us an enquiry, on the legitimate uses the Act allows (including employment-related purposes and meeting legal obligations), and, for push notifications, on the consent you give by turning them on. You can withdraw consent at any time; this does not affect processing already done.

5. Who can see it

• People in your workspace see what their roles and team memberships allow. Administrators of your organization can see and manage workspace data and members.
• Anyone with a public link. Workspace members with permission can share a Drive file or folder by public link, optionally with a password, an expiry date and a download limit. Anyone who has such a link can open what it points to until it is revoked or expires.
• Our platform team can see account, membership, plan and usage details to provide support, apply plans, process deletion requests and enforce our terms.
• Service providers listed below, only to provide their service to us.
• Authorities when the law requires it, and a successor if our business is reorganized or sold, under terms that protect your data.

6. Service providers

These providers host or deliver parts of Atom and process personal data only on our instructions. We will update this list before adding a provider that handles workspace data.

7. Where data is processed

Data is stored in India (Mumbai) and Singapore. Some providers above operate globally and may process data outside India, as Indian law permits, under contracts that require them to protect it.

8. How long we keep it

• Workspace content stays for as long as the workspace exists, or until someone with permission removes it. Files moved to the Drive trash are permanently deleted after 30 days. Chat about a deleted task or project stops being reachable but is kept as part of the workspace's record.
• Account details are kept until your account is deleted.
• Sessions expire after 7 days without use.
• After a customer's contract ends, workspace data is kept for 30 days, then deleted.
• Backups are kept for up to 7 days.
• Website enquiries are kept for up to 24 months after the last contact, unless the enquirer becomes a customer.

9. Deleting your account

You can ask for your account to be deleted in the mobile app (Settings → Delete account) or on the account deletion page. We then erase your name, email address, phone number, password and two-factor settings, sessions, push tokens, private notes and profile photo, and remove you from every workspace. Work you created inside a workspace belongs to that workspace and stays, shown as from “Deleted user”; ask the workspace's administrator to remove any of it. If you own a workspace, ownership must pass to someone else first. We complete requests within 30 days.

10. Security

Traffic to and from Atom is encrypted in transit. Every action is checked against the person's permissions on the server, Drive files are kept in private storage and served through short-lived signed links, and two-factor authentication is available to every user. On phones, the sign-in session is kept in the operating system's secure storage. More detail is on our Security page. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the authorities as the law requires.

11. Your rights

Under Indian law you have the right to:

• get a summary of, or a copy of, your personal data;
• have it corrected, completed or updated;
• have it erased;
• withdraw consent you gave;
• nominate someone to exercise your rights if you die or become incapacitated;
• have a grievance addressed by us, and then complain to the Data Protection Board of India.

Many of these you can do yourself: edit your profile, download files, and end sessions in the app. Otherwise write to contact@occulus.in. We will verify that the request is yours, and reply within the time the law sets. For workspace content we may refer you to the organization that controls it.

12. Children

Atom is a tool for organizations and is meant for adults. Organizations must not add anyone under 18 without the verifiable consent of a parent or lawful guardian where the law requires it. We do not knowingly collect data from children outside such a workspace, and do not track or target advertising at anyone.

13. Changes to this policy

When our practices change, we update this page, its version number and the dates above, and record the change in the version history below. For material changes we will give notice in Atom or by email at least 30 days before they take effect.

Version history