Personal data protection

Visiting this information website

The website's own code collects no audio or sign-in credentials and introduces no analytics or advertising measurement. Hosting processes the IP address and technical request details to deliver and secure the page. Operational log scope and platform retention periods have not yet been contractually documented; we do not promise zero retention. BOXLET handles personal data requests through the published contacts.

1. Who is responsible for processing

BOXLET s.r.o., Company ID 29753376, registered office náměstí 14. října 1307/2, Smíchov, 150 00 Praha 5, Czech Republic, is the controller for atlas user profiles, accepted terms, support and its own operations.

Use the BOXLET s.r.o. contact details. Czech data box: dwj58zh. Postal address: náměstí 14. října 1307/2, Smíchov, 150 00 Praha 5, Czech Republic.

For content recorded on an organisation's instructions, that organisation may be controller and BOXLET processor. Such use requires prior determination of roles and an appropriate agreement; reading this policy does not replace one. Ordinary voice audio may be personal data; atlas does not create biometric identification templates from it.

2. Data and purposes

• Sign-in and profile: the platform supplies a user identifier, email and possibly a name. The identifier separates notebooks. Processing is needed to provide the service under GDPR Article 6(1)(b).
• Your content: audio, titles, duration, folder, recording time, transcript, summary and tasks. We store and process these for the features you use. Your own data is generally processed to perform the contract; for other people's data, the user or organisation needs appropriate authorisation and a legal basis.
• Settings and confirmations: accepted terms version, acceptance time and permission to enable or disable OpenAI transfer, to implement your choices and document the service scope.
• Operational data: infrastructure processes IP address, time and technical request details during transfers, for delivery, security and error resolution. The legal basis may be a legitimate security interest or contract performance, depending on the operation.
• Contact and requests: information you provide for support, complaints or rights requests, processed for contract performance or legal obligations according to the request.

Required sign-in information and selected content are necessary for the relevant cloud features; these cannot be provided without them. Sending content to AI is not a condition of storage and playback alone. atlas code contains no advertising pixels or marketing traffic measurement. We do not sell content.

3. AI and data recipients

With separate permission, audio is sent to the OpenAI API for transcription. Transcript text and recording date are sent for summaries and classification. Automatic processing of new recordings is a separate choice. Without permission, the server rejects AI requests. Disable permission in data management; this does not cancel a transfer already in progress or delete completed outputs.

OpenAI states that API data is not used for training by default unless the customer expressly opts into sharing. atlas sends store:false for text responses. This does not automatically mean zero retention for all operational and security data. See OpenAI data documentation.

• OpenAI / ChatGPT Sites: hosting and sign-in for this version; the specific contracting entity and terms depend on the operator's account.
• OpenAI API: optional transcription, summarisation and classification. For EEA customers, the public DPA names OpenAI Ireland Ltd.; the operator's actual account configuration must be confirmed before public launch.
• Cloudflare: this version's application, database and audio storage infrastructure; the contractual chain through the hosting platform must be documented before public launch.
• Browser provider: only if you separately enable browser live transcription, its service, for example Apple in Safari, may process audio. This is separate from the OpenAI API and is optional.

BOXLET may grant content access only to authorised persons for necessary support, security incidents or legal obligations. Access protection is not end-to-end encryption between users; the server handles readable content during processing.

4. Retention and deletion

Active cloud recordings, text and settings are kept while the profile is used and until you delete a note or all atlas data. This version does not automatically delete inactive notes after a fixed period. Deletion removes entries from the active database and corresponding audio objects. If interrupted, repeat the operation in data management.

Unfinished web recordings are backed up in this browser. After successful cloud storage the local backup is removed; otherwise it remains until you delete it or clear browser storage. Native iOS audio is not automatically deleted after upload. The planned Apple Watch extension stores audio on the watch and queues transfer to the paired iPhone through WatchConnectivity after stopping. Receipt on iPhone does not start cloud AI. Watch copies remain until separately deleted; deleting a cloud profile does not remove them. Manage exports and copies on other devices separately.

OpenAI retention differs by interface: its documentation currently states no application-state or abuse-monitoring data retention for audio/transcriptions, and generally up to 30 days of security records for Responses, with stated exceptions. We do not declare an active Zero Data Retention regime.

Specific retention periods and geographic locations for hosting operational logs and recovery backups have not been fully verified for this pilot. Deletion from the active app therefore does not promise immediate deletion of every supplier copy. Before public release, this overview must be completed against actual configuration and contracts.

5. Transfers outside the EEA and security

The global infrastructure used may involve processing outside the European Economic Area, including the USA. This version does not promise EU-only storage or processing. Before public launch the operator must document the contractual chain, a suitable GDPR Chapter V transfer mechanism, any standard contractual clauses and necessary assessments; a supplier's public DPA alone does not confirm its actual execution.

The app uses HTTPS, content separation by signed-in user and origin checks for change requests. The AI API key is not part of the client app. Security incidents are handled according to impact and applicable legal obligations. These measures are not an absolute security guarantee.

6. Your rights

Depending on the circumstances you have rights of access, correction, deletion, restriction, portability, objection to legitimate-interest processing and withdrawal of any consent. Confirming AI settings yourself does not automatically authorise processing other people's data. atlas performs no automated decision-making with legal or similarly significant effects under GDPR Article 22.

You can export and delete content in data management. Send other requests to the operator. We verify identity proportionately; do not automatically send an identity document copy. We respond without undue delay, generally within one month. Any statutory extension will be explained within that period.

If your data is in someone else's work recording, also contact the organisation determining the processing; we will reasonably assist in identifying the relevant controller. You may complain to the Czech Office for Personal Data Protection or another competent supervisory authority.

Contact the operator via the BOXLET s.r.o. contact details. Czech data box: dwj58zh. Postal address: náměstí 14. října 1307/2, Smíchov, 150 00 Praha 5, Czech Republic.