Privacy Policy — Attosol Private Limited

Applies to: Attosol Optix and other Attosol products and services Published by: Attosol Private Limited

How Attosol's products — including the Optix suite and other tools we build across a range of platforms and technologies — collect, use, and protect data.

1. Scope

Attosol Private Limited builds IT administration and productivity tools, including the Optix suite, that help organizations discover, govern, and migrate data across the platforms they use. As we continue developing tools around new technologies, this policy is written to apply across our current and future products rather than to any single one.

Where a specific product connects to a third-party platform — such as a cloud storage, collaboration, or productivity service — it does so through that provider's official APIs, and only with the access an administrator has granted. This policy does not cover Attosol's general corporate website, employment-related data, or consulting engagements, which are addressed in separate notices.

2. Information we collect

Our products are typically deployed by an organization's IT administrator and operate under permissions that administrator grants. We collect two broad categories of data:

Account and administrator data

Name, work email, and role of the administrator(s) who register, configure, and manage our products.
Organization details such as domain name, tenant ID, and licensing information.
Support correspondence and configuration preferences.

Platform data processed on your behalf

Depending on the product and the platforms it connects to, we may access data through official administrative APIs to perform discovery, reporting, governance, or migration. This can include, depending on the platform:

File and content metadata: names, owners, types, sizes, timestamps, and sharing or permission settings.
Directory data: user accounts, organizational units, and group memberships needed to scope an operation.
Messaging or collaboration metadata (e.g., channel names, membership, timestamps), and content itself where a task explicitly requires copying it from a source to a destination the administrator selects.

Our products are designed to request only the access needed for the features an administrator enables, and that access is granted and revocable through the relevant platform's own admin console. As we add support for new platforms and technologies, this same principle applies regardless of which provider is involved.

The exact scopes requested differ from tool to tool: a discovery tool may request read-only access, while a migration tool may need broader access to write content to a destination. We size each tool's permissions to what that specific tool does, rather than requesting a single broad set of permissions across our whole product line.

3. Third-party platform data & Limited Use

Where our products access data through Google APIs, our use and transfer of that information adheres to the Google API Services User Data Policy , including the Limited Use requirements. The same principle — using platform data only to provide the features an administrator has requested, never for advertising, and never selling it — applies to any other third-party platform we integrate with.

Data obtained through a connected platform's API is used only to provide and improve the specific discovery, governance, or migration features an administrator has enabled — for example, generating a sharing report, or copying content to a destination the administrator selects. We do not use such data for advertising, and we do not sell it or transfer it to third parties except as necessary to perform the requested service, to comply with law, or as part of a merger or acquisition covered under this policy.

4. How we use information

Delivering the service — running the scans, reports, migrations, or other operations an administrator configures, and displaying results in the product's console.
Account administration — provisioning licenses, authenticating administrators, and managing subscriptions.
Support and troubleshooting — diagnosing issues an administrator reports, using logs and configuration details relevant to that issue.
Product improvement — aggregated, de-identified usage statistics (such as which features or platforms are most used) to guide our roadmap, including decisions about which new technologies to support. We do not use the content of your files or messages for this purpose.
Security and abuse prevention — monitoring for anomalous access patterns to protect your tenant and ours.

We do not sell personal data or platform data. We share information only in the following circumstances:

Sub-processors — infrastructure and hosting providers that store or process data on our behalf, bound by confidentiality and data-processing agreements no less protective than this policy.
At your direction — for migration or transfer features, data is written to the destination platform that your administrator specifies.
Legal requirements — where disclosure is required to comply with a valid legal process, protect against fraud, or protect the rights and safety of Attosol, our customers, or the public.
Corporate transactions — in connection with a merger, acquisition, or asset sale, subject to standard confidentiality commitments and continued protection under this policy or its successor.

6. Storage and retention

Reports, operation logs, and configuration data are retained for as long as your organization's subscription is active, plus a limited period afterward to support account recovery and legal or audit needs. Platform content itself is generally transient: our products read it from a source and write it to a destination your administrator selects, rather than retaining a long-term copy on our infrastructure, except where temporary staging is required to complete an operation.

Our infrastructure runs on Microsoft Azure. We use a separate, dedicated Azure Storage Account for each project or engagement, so data belonging to different customers or projects is never mixed together. Data can be kept in any region Azure supports, and we host it in the region(s) agreed with your organization. Once a project concludes, all data associated with it is purged from our systems.

Administrators can request earlier deletion of reports, logs, or account data by contacting us — see Contact us .

7. Security

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data our products handle, including:

Encryption of data in transit (TLS) and at rest.
Role-based access controls limiting internal access to the minimum necessary.
OAuth-based authorization with your identity provider, so credentials are never stored in plaintext.
Logging and monitoring of administrative access to production systems.
Compute for our products runs on virtual machines hosted on Microsoft Azure, and our environment is managed entirely within the Microsoft Azure stack. All of Microsoft's applicable Azure security, compliance, and data-handling policies apply to how we host and process your data.

These practices apply consistently as we bring new products and platform integrations online. No method of transmission or storage is completely secure. If you believe you've found a vulnerability, please report it to contact@attosol.com .

8. Your choices and rights

Because our products are deployed by your organization's administrator, day-to-day control over what data is accessed sits with that administrator, including the ability to:

Scope which accounts, sites, drives, or channels a product can access.
Revoke a product's access at any time from the relevant platform's admin console.
Request export or deletion of reports and logs held by Attosol.

Individual end users whose data appears within an operation (for example, as a file owner) should direct access, correction, or deletion requests to their organization's administrator, who controls the underlying account. Where applicable law gives you direct rights against Attosol as a processor, contact us and we will support your administrator in fulfilling the request.

9. International transfers

Attosol may process and store data in countries other than where your organization is located. Where this involves a cross-border transfer of personal data, we rely on appropriate safeguards, such as standard contractual clauses or equivalent mechanisms recognized under applicable data protection law.

10. Children's privacy

Attosol's products are enterprise IT tools intended for use by organizations and their administrators. They are not directed to, and we do not knowingly collect personal data from, children.

11. Changes to this policy

We may update this policy as our product portfolio grows, as we support new platforms and technologies, or as legal requirements change. If we make material changes, we will update the effective date above and, where appropriate, notify administrators directly.

12. Contact us

Attosol Private Limited Questions about this policy or how our products handle your organization's data:

Email: contact@attosol.com
Website: www.attosol.com