Privacy statement

ATLAS is provided by Aigent37. For privacy questions or to exercise your rights, contact us via aigent37.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

The text, photo or PDF of the letter you upload. Such a letter can contain special-category data (for example health or criminal-law data, Art. 9/10 GDPR).

Your citizen service number (BSN) is detected and removed (masked) the moment a document is read — before anything is sent to a model or stored. Your raw BSN is never stored.

Data we derive from the letter in order to help you: the deadline(s), amounts, the type of letter, and the status of your case.

If reminders are enabled, the email address your reminders are sent to.

For each letter processed we record, linked to your account ID, what processing it cost: which service was used, the number of pages and tokens, and the amount. This never includes the content of your letter, your BSN or your email address. This record is stored in our database in the EU.

To turn your letter into one action, one deadline and watched follow-up. ATLAS does not give legal advice, does not rank or recommend a route, and takes no action on your behalf (no submission, payment or DigiD). There is no automated decision-making with legal effect.

We use the per-account cost record for cost management and to base our prices on real costs.

We process your data to provide the service you ask for when you upload a letter. Where a letter contains special-category data, we process it only to deliver that service, on the basis of your explicit consent — which you give by uploading the letter.

We keep the per-account cost record on the basis of our legitimate interest in managing costs and setting fair prices; no letter content is included.

We use a small set of processors, each under a processing agreement. Most are EU-resident: Vercel (hosting), Supabase (database, EU region), Microsoft Azure Document Intelligence (takes the text from your photo or PDF, West Europe), Mistral (reads and explains your letter if you choose 'Process only within Europe'), and Resend (sending reminder emails, EU). One step is not yet EU-resident: the AI language model that reads your letter and explains it in plain language runs via Anthropic's API in the United States. Moving this step to an EU-resident path (Anthropic via AWS Bedrock, EU region) is planned but not yet live. The full processor register is kept internally and is available on request.

Short retention: an uploaded document is automatically deleted after 30 days. You can delete a case yourself at any time — that is a hard delete and removes the document, the extracted data, the deadlines and the reminders.

We keep the per-account cost record for 24 months; deleting a case leaves that record in place, as it contains no letter content. After 24 months we keep only monthly totals, without your account ID. If you delete your account, your account ID is removed from the cost record straight away (anonymised).

Stored document content is encrypted at rest (AES-256-GCM). Your BSN is never stored in raw form. Storage and reading the text from your photo or PDF happen in the EU; the language-model step currently runs in the United States (see the processors section above).

You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent. The quickest way to erase is to delete the case in the app; for the other rights, contact us via aigent37.com.