Privacy Policy

This Privacy Policy applies to all users of the Service, including real estate agents, homeowners and other consumers, home service providers, visitors to our website, and people who join our waitlist or contact us. It applies whether you access the Service through a web browser or through the Atlasio app.

This Privacy Policy does not apply to the practices of third parties that we do not own or control, including other users of the Service. When you hire a provider or work with an agent or homeowner you meet through Atlasio, information you share with them directly — on or off the platform — is governed by their own practices. We encourage you to exercise judgment about the information you share with other users.

Atlasio, Inc. is based in the United States, and the Service is currently offered in the United States, launching first in Denver, Colorado. If you use the Service, your information will be processed and stored in the United States.

We collect information directly from you, automatically when you use the Service, from other users who involve you in a job or closing, and from third-party services and sources.

2.1 Information you provide to us

• Account information. When you create an account, we collect your name, email address, phone number, and a password. Authentication is handled by our authentication provider, Supabase. If you sign in with Google or Apple, we receive identity information from that provider — such as your name, email address, and an account identifier — in accordance with your settings on that provider’s platform.
• Profile information. Information you choose to add to your profile, such as your role on the platform (agent, homeowner, or provider), trade categories, services offered, service areas, business information, and other details you make visible to other users.
• Business fit-check input. If you choose to use the fit checker on our Provider marketing page, we collect the brief description you enter about the services your business performs.
• Provider service-location information. Providers may enter an office or starting address and a travel radius. Before address search or geocoding begins, Atlasio presents a separate disclosure and asks the Provider to affirmatively authorize collection and use of the exact address and precise coordinates for distance matching. Other users see only the city and state and may receive a coarse, approximate service-area location — not the exact office address or precise coordinates.
• Provider credential information. Providers may enter license numbers, licensing state, license expiration dates, insurance expiration dates, and upload supporting license and insurance documents for account review. Public profiles may show a review status and limited professional details selected for display. Supporting documents, storage paths, and private verification evidence are not displayed publicly.
• Property and service addresses. The address of the property where services will be performed, including geographic coordinates. Before address search or geocoding begins, Atlasio presents a just-in-time disclosure and, where sensitive-data consent is required, asks the person providing the address to affirmatively authorize the disclosed collection and use. Address entry and geocoding are assisted by the Google Places API. Before a job is awarded, potential Providers receive only an approximate area; the full service address is disclosed to the awarded Provider and other authorized job participants when needed to perform the work.
• Job information. Job descriptions, service categories, scheduling and timeline preferences, budgets, and other details you include when posting or responding to a job.
• Job media. Photos and videos of homes and property that you upload as context for a job.
• Bids and negotiation history. Bid amounts, pricing, scope notes, counter-offers, award decisions, and completion confirmations exchanged through the Service.
• Payment and billing information. When you add a payment method, Stripe collects your card details directly. Atlasio receives tokenized customer and payment-method identifiers and limited details such as card brand, last four digits, billing status, fee quotes and acknowledgments, charge attempts, transaction status, and receipt information. Atlasio does not store your full card number or security code.
• Agreement and authorization records. We keep records of the Terms and Privacy Policy versions shown and accepted, the exact acceptance statement, acceptance method and surface, server timestamp, IP address and user agent where available, and separate fee or payment authorizations. We use these records to administer the Service and establish what was disclosed and agreed.
• Messages and attachments. The text, images, documents, and videos you send or receive through the Service’s in-platform messaging features, together with message type, timestamps, and delivery or read state where available.
• Support communications. When you email Atlasio support, we collect your email address, message content, attachments, and related email metadata needed to receive and respond to your request. Our email receiving provider processes and stores the full inbound email and its attachments. Atlasio may separately keep a privacy-minimized automated-acknowledgment receipt containing a provider message identifier, a pseudonymous sender hash, status, and operational timestamps — not the subject, body, attachments, or plaintext sender address.
• Closing Tracker information. Property address, MLS number, contract price, closing date and status, buyer name, closing time and location, amounts or items to bring, milestones, alerts, document requests, closing documents, and the names, roles, contact details, invitation status, acknowledgments, and activity of closing participants. Some information may be supplied by an agent or another person coordinating the closing rather than by the person it concerns.
• Safety reports and moderation records. If you report a user or profile, job, bid, message, review, or endorsement, we collect the reason and details you provide, the reported content and account context captured at submission, limited app or web source information, and our internal review notes, status, and outcome.
• Reviews and endorsements. Reviews, ratings, and endorsements you submit about other users, and those submitted about you.
• Waitlist, contact, and partner submissions. Email addresses submitted to our waitlist, and information you provide through our contact form or partner-pilot submission forms.

2.2 Information collected automatically

• Usage and product analytics. We use Vercel Analytics to understand website use, such as pages viewed, referring pages, approximate location derived from IP address, and device and browser type. For signed-in product activity, we also record events such as the feature or surface used, session and account identifiers, related job or closing identifiers, app version, and timestamps. We use these events to operate, secure, and improve the Service, not for cross-context behavioral advertising.
• Server logs. Like most online services, our servers automatically record information such as your IP address, browser type, operating system, request timestamps, pages requested, and error information.
• Notification data. If you enable notifications, we collect device push tokens, your notification and SMS preferences, verified phone status, and delivery information so we can send and manage notifications about bids, messages, jobs, and closing activity.
• Email delivery and engagement data. For emails we send, our email provider may return delivery, bounce, open, and link-click events, along with a provider message identifier, template and campaign information, and limited link destination information. We use this information for deliverability, security, preferences, and service improvement.

2.3 Information from third parties

• Sign-in providers. If you choose to sign in with Google or Apple, those providers send us identity information as described above.
• Google Places. When you enter an address, the Google Places API returns standardized address data and geographic coordinates, which we store with the related job, property, or provider service-area record.
• Other users. Agents and other users may give us transaction, role, identity, and contact information about clients, closing participants, and people they invite to a job or Closing Tracker. The person providing that information is responsible for having authority to do so.
• Public and professional sources. For provider outreach, marketplace integrity, and credential or business review, we may collect publicly available business, professional, licensing, and registration information from government records and other public sources.
• Provider prospect records. We may receive restricted business-development records about prospective Providers, including company and contact name, business email and phone, website, trade, service area, and outreach, qualification, or opt-out information. These records are used for Provider outreach and lead operations, not as a general sync of Atlasio customer accounts.

We use the information we collect to:

• Provide, operate, and maintain the Service, including creating and managing your account;
• Match posted jobs with relevant providers, including suggesting trades and follow-up questions as described in Section 4, and use Provider service-location coordinates and travel radius for distance matching;
• Facilitate the marketplace — displaying jobs, transmitting bids and counter-offers, recording awards, enabling messaging, and confirming completion;
• Display provider profiles, reputation, reviews, and endorsements to users deciding whom to work with;
• Review Provider license and insurance submissions and display limited credential-review status or professional information;
• Create and operate Closing Trackers, invite authorized closing participants, present milestones, alerts and documents, and record participant acknowledgments or updates;
• Send transactional communications and notifications, such as new-bid alerts, messages, and job status updates;
• Send waitlist, launch, and marketing communications, which you can opt out of at any time;
• Calculate and collect fees owed to Atlasio under the fee schedule you are shown before the applicable paid action;
• Protect the safety and integrity of the Service, including reviewing reports and detecting and preventing fraud, spam, fake reviews, fee circumvention, and other violations of our Terms of Service;
• Respond to your questions and provide support;
• Measure product and email performance and improve, test, and develop the Service; and
• Comply with legal obligations and enforce our agreements and legal rights.

When you post a job, the text of your job description is processed by an artificial intelligence classification service to suggest relevant trades and follow-up questions. This helps route your job to the right categories of providers and helps you include details providers typically need. You review and can change the results — the suggestions do not make final decisions on your behalf.

Photos and videos you upload are not analyzed by AI. Job media is stored and made available as visual context for the people involved in the job — the job poster, participating agents, and matched providers — to view.

If you choose to use the fit checker on our Provider marketing page, we send the brief business description you enter to the AI classification service to suggest relevant trade categories. When the description identifies a specialty, we may retain the description — currently limited to 120 characters — with a restricted internal demand signal so we can evaluate future trade categories. The result is informational and does not approve or reject an account.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects concerning you without human involvement. Job description text sent to our AI model provider is processed to return the requested classification and suggestions under the provider terms and safeguards applicable to our account. We may retain a limited excerpt of a description — currently up to 500 characters — in a restricted internal demand-signal record when the classifier cannot confidently map the request, so we can improve routing and our service taxonomy. Do not include information in a job description that is unnecessary to describe the requested work.

5.1 With other marketplace participants

Atlasio is a marketplace, and sharing certain information between participants is core to how the Service works:

• Job details and media are visible to providers who are matched to your job so they can evaluate and bid on it, and to agents participating in the job.
• Property addresses. A provider who is evaluating a job sees an approximate neighborhood or area. The awarded Provider and other expressly authorized job participants can see the full service address when needed to coordinate or perform the work.
• Bids and negotiation history are visible to the job poster and to agents participating in the job.
• Provider profiles and reputation — including offered services, city and state, approximate service area, limited credential-review status or professional details, reviews, and endorsements — are visible to agents and homeowners evaluating Providers. Exact office addresses, precise service-location coordinates, and supporting license and insurance documents are not displayed publicly.
• Messages and attachments are visible to the participants in the conversation.
• Reviews and endorsements you submit are displayed with the reviewed user’s profile and may be visible to other users of the Service.
• Closing Tracker information is visible to the agent and the closing participants the agent or another authorized user invites, according to each participant’s role and permissions. A party link is a bearer credential: anyone who has a valid link may be able to open the scoped tracker until the link expires or is revoked. Recipients should not forward a party link to anyone who is not authorized to participate in that closing.

5.2 With service providers (processors)

We disclose personal information to service providers that help us operate the Service. Their processing is governed by the agreements and terms applicable to the services they provide, and we require protections appropriate to the service and the information involved. These providers include:

• Supabase — database hosting, authentication, and file storage (including job media);
• Vercel — website and application hosting, and privacy-focused analytics;
• Google — the Places API for address entry and geocoding, and Google OAuth sign-in;
• Apple — Apple OAuth sign-in;
• Stripe — secure payment-method collection, payment processing, billing status, and receipts;
• Anthropic — processing of job description and optional business fit-check text for trade classification, title or question suggestions, and fit-check results, as described in Section 4;
• Twilio — delivery and management of text messages when you opt in;
• Expo — mobile application services and push-notification delivery;
• Resend — transactional and optional email delivery, delivery or engagement events, and receiving and storing inbound support emails and their attachments;
• Notion — restricted contractor-prospect CRM and lead-operations records;
• EPA AirNow — air-quality information for a location requested in the Service. We send coordinates needed to retrieve local conditions; and
• Other infrastructure, security, support, and professional service providers that process only the information needed for their role.

5.3 For legal reasons

We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or that disclosure is reasonably necessary to protect the rights, property, or safety of Atlasio, our users, or the public, to enforce our agreements, or to detect, investigate, and prevent fraud, security, or technical issues.

5.4 Business transfers

If Atlasio is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, personal information may be transferred as part of that transaction, subject to standard confidentiality protections. We will notify you of any such transaction that changes how your personal information is handled.

5.5 With your consent

We may share information for other purposes with your consent or at your direction.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising.

We use a small number of cookies and similar technologies that are essential to operating the Service — primarily authentication and session cookies set by our authentication provider so you can stay signed in securely.

For analytics, we use Vercel Analytics, which is designed to be cookie-light: it does not use third-party advertising cookies or track you across other websites. We also use first-party product events tied to an account or session to understand feature use, reliability, and safety. Emails may contain standard tracking technologies that report delivery, opens, and link clicks to our email provider. We use this information for deliverability, preferences, and product or communication performance. We do not use third-party advertising or cross-site tracking cookies on the Service.

Most browsers let you control cookies through settings. Because essential cookies are required for sign-in, disabling them may prevent parts of the Service from working. Because we do not sell personal information or use it for targeted advertising, browser-based opt-out preference signals such as Global Privacy Control do not change how we process your data; we will honor such signals to the extent required by applicable law.

We retain personal information for as long as your account is active and as long as reasonably necessary for the purposes described in this Privacy Policy. In deciding how long to keep information, we consider the nature of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal requirements. In general:

• Account and profile information is retained for the life of your account and for a reasonable period afterward to handle disputes, enforce our agreements, and meet legal obligations;
• Terms, Privacy Policy, fee-authorization, and consent event records may be retained after account deletion in a restricted, pseudonymous form for the period reasonably necessary to establish what was disclosed, accepted, authorized, or withdrawn and to comply with legal obligations. These records cannot be used to restore a deleted account;
• An exact Provider office location is retained while active consent and distance matching remain enabled. Withdrawing that consent deletes the exact office address and coordinates and stops location-based matching until the Provider supplies a new location and affirmatively consents again;
• If an already-accepted Atlasio fee is unresolved when an account is deleted, service-only billing customer and payment identifiers may be retained solely for fee resolution for up to 90 days. They are then deleted and any unresolved amount is written off. This retention cannot restore account access or authorize a new fee;
• Job and Closing Tracker records, bids, negotiation history, messages, participant activity, reviews, and endorsements are retained while relevant accounts are active because they document marketplace and transaction activity and support dispute resolution and trust and safety;
• Provider credential information and supporting documents are retained while needed for account review and marketplace integrity. Private credential files are deleted or replaced in accordance with the credential-management and account-deletion flows, unless a dispute, safety matter, fraud-prevention need, or legal obligation permits or requires limited retention;
• Safety reports, captured evidence, and moderation audit records are retained as reasonably necessary to investigate concerns, document our response, identify repeat abuse, prevent fraud, and meet legal obligations. A report may be retained after the reporter or reported account is deleted, with account identity removed or restricted where appropriate;
• Job media (photos and videos) tied to a completed transaction, safety report, dispute, or legal obligation may be retained with that restricted record. Media for cancelled or otherwise non-retained work is deleted when it is no longer needed;
• Closing documents tied to a completed transaction may be retained as restricted transaction evidence. If a private document-upload link was issued shortly before account deletion, the link can remain valid for up to two hours; Atlasio schedules an additional cleanup after that window to remove late uploads for cancelled or otherwise non-retained closings;
• Server logs and diagnostic data are retained for a limited period consistent with security and operational needs;
• Waitlist and contact submissions are retained until no longer needed for the purpose collected or until you ask us to delete them;
• Inbound support emails and attachments stored by Resend are subject to Resend’s provider retention and deletion controls. Atlasio’s separate, privacy-minimized automated-acknowledgment receipts are retained for up to 90 days after they are sent or safely skipped, or up to 180 days if they fail or require manual review, unless a longer period is required or permitted by law.

When you delete your account or ask us to delete your data, we will delete or de-identify your personal information, except where retention is required or permitted by law — for example, records needed for tax, accounting, dispute-resolution, or fraud prevention purposes, and residual copies in backups that are purged on a scheduled cycle.

Account deletion revokes active Closing Tracker party sessions and links associated with the deleted account where supported by the participant’s role. It cannot erase information another user was independently entitled to retain or copies a recipient saved outside Atlasio before access was revoked.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit (TLS), encryption at rest provided by our infrastructure providers, access controls that limit which users and personnel can access data, and authenticated, role-scoped access to database records.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. If we learn of a security incident affecting your personal information, we will notify you and applicable regulators as required by law.

9.1 Choices available to all users

• Access and correction. You can view and update most account and profile information in your account settings.
• Deletion. You can initiate permanent account deletion from Account settings in the Atlasio app or on the web. Active jobs and closings must be finished or cancelled first. Deletion disables sign-in, removes your public profile, revokes applicable party-link access, deletes stored files that are not subject to a permitted retention need, and deletes or de-identifies other personal information. A closing-document upload issued immediately before deletion may be removed by the scheduled post-expiry cleanup described in Section 7. For accounts using Sign in with Apple, Atlasio attempts to revoke the Apple authorization during in-app deletion and provides manual Apple Account instructions if an automatically revocable token is unavailable. You may also contact privacy@atlasioapp.com for help with a deletion request.
• Notifications. You can manage push notification preferences in your device or app settings and manage optional account SMS alerts in the app. Replying STOP to an Atlasio text opts the mobile number out of further texts as described in Section 12.
• Precise Provider service location. Providers can update their office or starting location and travel radius in Profile settings. You may ask us to delete the exact location; doing so may disable distance matching until you provide a new starting point.
• Marketing emails. You can opt out of marketing and waitlist emails using the unsubscribe link in any such email. We will still send transactional messages about your account and jobs.

9.2 Colorado residents — Colorado Privacy Act

If you are a Colorado resident, the Colorado Privacy Act (CPA) gives you the right to: (a) confirm whether we process your personal data and access that data; (b) correct inaccuracies; (c) delete personal data concerning you; (d) obtain a portable copy of your personal data; and (e) opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Atlasio does not sell personal data, does not process personal data for targeted advertising, and does not engage in profiling that produces legal or similarly significant effects.

Before a provider searches for or geocodes an exact office location for service-radius matching, Atlasio requests consent through a separate, purpose-specific disclosure. The choice is not preselected and is not inferred from acceptance of broad Terms of Service. We keep an event record of acceptance or withdrawal. A provider may withdraw as easily as they consented through the service-location setting or by contacting us; after withdrawal, Atlasio stops that future processing and removes the saved exact office location unless retention is required or permitted by law. Property and job addresses that a customer chooses to enter are processed to create and fulfill that customer’s request; Atlasio does not collect device GPS location through these address fields.

To exercise these rights, contact us as described in Section 9.5. If we decline to take action on your request, you may appeal our decision by replying to our response or emailing privacy@atlasioapp.com with the subject line “CPA Appeal.” We will respond to appeals within the time required by the CPA. If your appeal is denied, you may contact the Colorado Attorney General.

9.3 California residents — CCPA/CPRA

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to: (a) know and access the personal information we collect about you, including the categories of sources and the purposes of collection; (b) correct inaccurate personal information; (c) delete personal information, subject to statutory exceptions; (d) obtain a portable copy of your personal information; (e) opt out of the “sale” or “sharing” of personal information — Atlasio does not sell or share personal information as those terms are defined by the CCPA/CPRA; (f) limit the use of sensitive personal information — we do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA/CPRA; and (g) not receive discriminatory treatment for exercising these rights.

In the preceding 12 months, we have collected the following categories of personal information as described in Section 2: identifiers (name, email, phone, account identifiers, IP address); customer records information; commercial information (jobs, bids, negotiation, fee, and Closing Tracker activity); internet or network activity (usage data, logs, and email engagement); geolocation data (property and Provider service addresses and coordinates); message contents and attachments; audio and visual information (photos and videos you upload); professional information (Provider trade, license, insurance, and profile details); and inferences limited to trade-category suggestions derived from job descriptions and optional business fit-check descriptions. We collect this information from the sources and for the purposes described in Sections 2 and 3, and disclose it for business purposes to the recipients described in Section 5. You may designate an authorized agent to submit requests on your behalf; we will verify the request as permitted by law.

9.4 Residents of other states

Residents of other U.S. states with comprehensive privacy laws may have similar rights of access, correction, deletion, portability, and opt-out. We will honor rights requests as required by the law applicable to you.

9.5 How to exercise your rights

To exercise any of these rights, email privacy@atlasioapp.com from the email address associated with your account, or use the tools available in your account settings. We may need to verify your identity before acting on a request — typically by confirming control of the email address on the account. We will respond within the timeframe required by applicable law (generally 45 days, extendable where permitted). We will not discriminate against you for exercising your privacy rights.

Atlasio does not sell personal data and has not sold personal data. We do not share personal information with third parties for cross-context behavioral advertising, and we do not knowingly process the personal data of minors. Sharing information between marketplace participants as described in Section 5.1 — for example, showing an approximate job area to potential Providers, the full job address to the awarded Provider, or scoped closing information to an invited Closing Tracker participant — is done to provide the Service you have requested and is not a sale.

The Service is intended for adults and requires users to be at least 18 years old. The Service is not directed to children, and we do not knowingly collect personal information from children under 13 in accordance with the Children’s Online Privacy Protection Act (COPPA). If you believe a child under 13 has provided us personal information, contact us at privacy@atlasioapp.com and we will delete it.

Atlasio offers two optional categories of transactional text messages. If you are invited to a Closing Tracker and provide closing-specific consent, we may send messages about that closing, such as milestone updates or a requested tracker link. If you have a signed-in account, verify your mobile number, and separately enable time-sensitive SMS alerts, we may send job and deal alerts covered by that preference, such as bid, deadline, completion, cancellation, or closing activity. We send each category only after the consent applicable to it. Consent to texts is not a condition of using or purchasing the Service.

We do not use your mobile number for marketing. Mobile numbers and SMS consent are not sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. We disclose mobile information only to service providers that help us deliver and administer the messages, or when disclosure is required by law.

Message frequency varies based on job, deal, or closing activity. Message and data rates may apply.

You can opt out at any time by replying STOP to any message. You can also disable optional account SMS alerts in the app. Reply HELP for help. After an opt-out, we may send one confirmation and retain a suppression record so we can honor your request.

We may update this Privacy Policy from time to time. If we make changes, we will revise the “Last updated” date above. If the changes are material, we will provide additional notice — such as by email or a prominent notice within the Service — before the changes take effect. Your continued use of the Service after the effective date of an updated Privacy Policy means the updated policy applies to your information going forward.

If you have questions about this Privacy Policy or our privacy practices, or want to exercise your rights, contact us at:

Atlasio, Inc.
Attn: Privacy
Email: privacy@atlasioapp.com