Legal

Privacy policy

Last updated 12 September 2026

This describes every piece of personal data this website collects, where it goes, and how long it stays — checked line by line against the code that runs the site rather than adapted from a template.

Who we are

Atom Agencies is a trading name, not a company. There is no limited company behind it: it is run by one person as a sole trader, while we find out whether enough businesses want this for it to be worth incorporating. If that changes, this page will say so and name the company.

Atom Agencies is the data controller for everything described here — the one that decides what is collected and what happens to it, and that is answerable for it. Because there is no company, that responsibility rests on one named individual rather than on an organisation. We have not put his name on this page: it is a home-run business and the page is indexed by search engines. Ask at the address below and we will tell you who the controller is — you are entitled to know, and we are not going to make you work for it.

The way to reach the controller about anything on this page, including any of the rights set out below, is privacy@atomagencies.com. We do not publish a postal address, because the business is run from a home and that address is a private one. If you would rather write on paper than email — and you are entitled to make a request however you like — send us a line at that address and we will give you somewhere to post it. You can also go straight to the Information Commissioner’s Office without coming to us at all; how to do that is at the end of this page.

Most organisations that process personal data for their own business purposes must pay the Information Commissioner’s Office a data protection fee and appear on its register of fee payers, and a few are exempt. We are establishing which of those we are, and will pay and register if the fee is due. We are not claiming to be registered today, and this paragraph will be replaced by the registration number once there is one.

We have not appointed a Data Protection Officer, and we do not believe one is required: this is a one-person business, it is not a public authority, and its core activity is neither large-scale monitoring of individuals nor large-scale processing of the special categories of data that would make a DPO compulsory. The email address above reaches the person responsible, who is the same person who wrote this.

Separately from this policy: when we run a news desk for a client, anything personal that ends up in that client’s desk is handled by us as their processor, on the terms agreed with that client. This page is about the public website.

The short version

There are no analytics on this site. No Google Analytics, no tag manager, no pixel, no session recorder, no advertising network, nothing of the kind. We do not know how many of you there are.
There are no cookies, and we store nothing in your browser — no local storage, no session storage, no device identifier. That is why you have not been shown a consent banner: there is nothing to consent to.
Your browser fetches nothing from anyone but us on this site — the typefaces are ours and the icons are drawn into the page. The one exception is a newspaper preview inside the live demo, which still loads its own typefaces from Google; that is set out in full below.
The only form that stores anything is the demo request form, and the promise printed on it is one we keep: those details are used to prepare and arrange your demo, and for nothing else. No list. No newsletter you did not ask for. Nothing sold, and nothing shared with anyone beyond the providers named below.
There are no user accounts on this site, and nothing to sign in to.

What we collect, and why

Five things happen on this site that involve personal data. Here is each of them, with the lawful basis we rely on and our reasoning for it.

When you ask us for a demo

What we collect

What you type into the form: your website, your name, your work email address, your business name, the market you are in, and — if you fill them in — who competes with you and what you already read.

Two things you do not type: the IP address the request arrived from, and the user-agent string your browser sends, which names your browser and operating system. If you reached the form from a preview we had already built, we also record the web address that preview was for.

The form has one hidden field, labelled as a fax number, which no person can see or type into. It exists so that automated submissions give themselves away. Nothing typed into it is ever stored.

What we use it for

To build the desk we show you, to reply to you, and to arrange the call. The IP address and user-agent are kept for one purpose only: telling a genuine enquiry apart from a run of automated ones, which is the difference between a real lead being answered and being lost in a hundred fakes.

Lawful basis

Steps taken at your request before entering a contract (Article 6(1)(b)), and our legitimate interests (Article 6(1)(f)).

You asked us for a demo, so preparing and arranging it is a step taken at your own request. Where the agreement we would eventually sign is with your employer rather than with you personally, that basis does not fit, and we rely instead on our legitimate interest in answering a business enquiry addressed to us. Legitimate interests requires us to balance that against you, and we have: you contacted us first, the details are ordinary work contact details rather than anything private, a reply is precisely what you were expecting, and — as the form promises — we do not add you to a list or a newsletter. The same legitimate interest, in keeping a public form usable, is what covers the IP address and the user-agent. You can object to either at any time, and we will stop.

How long

Until we delete it. There is no automatic expiry — see How long we keep things, below.

When you ask for a free preview of your market

What we collect

The web address you paste in. That is the whole of what you give us: no name, no email address, no account.

The IP address the request arrived from, held in the server’s memory so that one visitor cannot run hundreds of previews and exhaust the feature for everybody else.

To build the preview we fetch a few pages of the website you named and send their text to Google’s Gemini model, which proposes the publications and organisations worth watching. If that website publishes people’s names — a team page, an author byline, a contact address — then those names are in the text that goes to Google. We fetch the site from our own server, so your address is never disclosed to it.

What we use it for

To build the preview you asked for, and to keep a public, unmetered feature available to everyone.

Lawful basis

Our legitimate interests (Article 6(1)(f)).

Our interest is in showing what the product does without putting a sign-up wall in front of it, and in protecting an endpoint that costs us money every time it runs. Weighed against you that is a light touch: there is no account, nothing that identifies you is asked for, and the IP address is never written to the database.

How long

A finished preview is held against the website’s host name for 30 minutes and then discarded. The rate-limiting record holds an IP address in memory for at most a couple of hours, and everything held this way is lost whenever the app restarts.

When you use the chat bubble

What we collect

Whatever you type into it, and a conversation id our server generates so that your next message lands in the same exchange.

Your messages are sent to Google’s Gemini model, which writes the replies. Please do not type anything confidential, and nothing about another person, into it.

The IP address the request arrived from, held in memory for rate limiting exactly as the preview does.

What we use it for

To answer questions about what we sell, without making you wait for office hours.

Lawful basis

Our legitimate interests (Article 6(1)(f)).

You opened the chat and asked us something; answering it is what you wanted to happen. The balance is helped by what the feature does not do: it asks for nothing about you, it writes nothing to our database, and it has no memory of you once the conversation is over.

How long

Conversations are held in the server’s memory only and are never written to our database. One is dropped 30 minutes after its last message, sooner if more than 25 conversations are open at once, and immediately if the app restarts. What Google keeps under its own terms is not within our control.

Whenever anyone visits the site at all

What we collect

Our web server writes an ordinary access log: the IP address, the address requested, the time, the response it gave and the user-agent. Our application writes its own log alongside it, which records an IP address when a request is refused for tripping a rate limit or the form’s automated-submission trap.

Both logs are sent to Google Cloud Logging, which is where we read them.

What we use it for

To keep the site up, to work out what went wrong when something breaks, and to see and stop abuse.

Lawful basis

Our legitimate interests (Article 6(1)(f)).

Running a public website securely is not really possible without a record of who asked for what. We do not use these logs to build a picture of any visitor, and nothing in them is combined with anything else to identify you.

How long

See How long we keep things, below. This is the one retention period we have not yet set for ourselves, and we would rather say so than print a number we do not enforce.

When you email us

What we collect

Your name, your email address and whatever you choose to put in the message, along with anything our mail provider records in the course of delivering it.

What we use it for

To reply to you and to keep a record of the correspondence.

Lawful basis

Steps taken at your request before entering a contract (Article 6(1)(b)), or our legitimate interests in answering correspondence (Article 6(1)(f)).

Which of the two applies depends on what you wrote to us about. Neither of them is a basis for doing anything with your address other than replying to you.

How long

For as long as the correspondence is live, and then reviewed alongside our demo enquiries.

One more thing worth naming, because it is personal data even though it never comes from a visitor: the desks we run read public news feeds, and an article’s byline carries the name of the journalist who wrote it. We store those bylines with the articles, exactly as the publisher published them, so that every story can be attributed to its author and its source.

Cookies and what we store in your browser

This site sets no cookies at all. Not for analytics, not for advertising, not for preferences, and not for sign-in — there is no sign-in. We have checked the whole application for this rather than assuming it: nothing sets a cookie, there is no session, and there is no consent banner because there is nothing that would require one.

We also store nothing in your browser by any other means: no local storage, no session storage, no database in the browser, no service worker. The chat bubble keeps its conversation id in the page’s memory for as long as the tab is open, and it goes when you close or reload the tab.

If that ever changes — if we add analytics, or anything that needs to remember you between visits — we will ask you first where the law requires it, and this section will say so before it happens rather than after.

Webfonts

This site no longer asks Google for anything. Its typefaces are served from our own servers and its icons are drawn into the page itself, so loading any page here sends no request to fonts.googleapis.com, fonts.gstatic.com, or any other Google address. Nothing about you reaches Google by visiting this site.

That was not true until recently, and this page said so. Until 12 September 2026 the typefaces came from Google’s font service, which meant your browser asked Google for them directly and told it your IP address and which browser you were using, on every page, before you had interacted with anything. Courts in Europe have found against site owners for exactly that. We said here that we intended to serve the files ourselves instead; that is now done, and this paragraph records what used to happen rather than quietly deleting it.

One exception, because it would be wrong to claim a clean sweep. The newspaper and magazine layouts previewed inside the live demo workroom are separate documents with their own typefaces, and those are still fetched from Google’s font service when you open a preview. That is a page you have to go looking for rather than one you land on, and it is on the list to fix the same way.

Who else sees it

We do not sell personal data and we do not share it for anyone else’s marketing. These are the providers that handle it on our behalf, and they are the complete list.

Google Cloud

Hosting, database and backups

Everything stored: the demo enquiries table, the nightly database backups, and the machine the site runs on.

London (the europe-west2 region)
Google Cloud Logging

Server logs

The web server and application logs described above, which contain IP addresses.

Google’s logging service. We have not pinned it to a UK region, so it may be stored elsewhere.
Google (Gemini API)

The model behind the preview and the chat bubble

What you type into the chat bubble, and the text of the website you ask us to preview.

Google’s infrastructure, which may be outside the UK.
Google Fonts

Typefaces inside the newspaper previews only

Nothing from this site any more — its fonts are served by us. Opening an edition preview in the demo workroom still fetches that layout’s own typefaces, which discloses your IP address. See Webfonts, below.

Google’s servers, which may be outside the UK.
Postmark

Sending us the email that tells us a demo has been requested

Your name, email address, business, website, market, and the optional lines about competitors and what you read. Your IP address and user-agent are not sent to Postmark; they stay in our own database.

The United States.

Anything you send us by email is also handled by whoever hosts our email, which is [EMAIL PROVIDER — TO CONFIRM]. Beyond these, we would disclose personal data only where the law requires it of us, or to professional advisers under a duty of confidence.

Sending data outside the UK

Everything we run ourselves stays in the UK. The server, the database that holds demo enquiries and the nightly backups are all in Google Cloud’s London region. That was a deliberate choice, made for latency before it was made for anything else, and it is the reason the great majority of what we hold never leaves the country.

Four things do cross the border. Google’s Gemini model, which powers the preview and the chat bubble, may process what is sent to it outside the UK. Our server logs go to Google Cloud Logging, which we have not pinned to a UK region. Postmark, which sends us the email telling us a demo has been requested, is in the United States. And if you open a newspaper preview in the live demo, that layout’s request for its own typefaces may reach a Google server anywhere.

For these we rely on the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, as set out in each provider’s standard data processing terms. [TO CONFIRM: that each provider’s data processing agreement has actually been accepted and a copy kept]

How long we keep things

Demo enquiries: There is no automatic deletion, and we will not pretend otherwise. We review the enquiries we hold at least every six months and delete the ones we no longer have a reason to keep. It is a review a person does, so the interval can slip; what does not slip is that we will delete your enquiry at any time if you ask us to.
Copies of enquiries in our backups: The database is backed up every night to storage in London. A backup is deleted 30 days after it is taken, and no more than about 60 days after that in the worst case. So an enquiry deleted today can survive in a backup for a short while after, and will then go for good.
Preview results: 30 minutes, held against the website’s host name in the server’s memory, then discarded.
Rate-limiting records (IP addresses): At most a couple of hours in the server’s memory, and lost whenever the app restarts. Never written to the database.
Chat conversations: 30 minutes after the last message, or immediately on restart. Never written to the database.
Server logs: We have not set a retention period of our own, so our logging provider’s default applies. Setting an explicit one is outstanding — see the highlighted note below.

[OWNER DECISION: set an explicit retention period for server logs] — until one is set, the default applied by our logging provider is what governs, and this page will say so.

Automated decisions, and where AI is involved

We do not make any decision about you by purely automated means that produces a legal effect or similarly significantly affects you. There is no profiling, no scoring of you, and no automated judgement about whether to deal with you. Every demo enquiry is read by a person.

We do use AI, and it would be strange to sell what we sell and be coy about it. Google’s Gemini model reads the website you paste in, proposes the publications worth watching, and writes the replies in the chat bubble. It is pointed at news and at business websites, not at people, and it decides nothing about you.

The live demo workroom

The live demo at /studio is genuinely live: it reads real feeds and saves what you build. It also has no sign-in yet, and everything created in it goes into a single shared demonstration workspace that other visitors can see.

Please do not put personal data, or anything confidential, into it. It is a demonstration, not a private workspace, and we would rather tell you that here than have you discover it.

How we look after it

The whole site is served over HTTPS, and the database is not reachable from the internet at all.
Backups are encrypted at rest by our hosting provider and stay in London.
Access to the server and to the database is limited to the one person who runs the business, and credentials are held in a managed secret store rather than in our code.
We do not take card details on this site, and we do not ask for anything in the special categories — health, beliefs, and so on. Please do not send them to us.
No security is perfect. If you think you have found a problem with ours, tell us at privacy@atomagencies.com and we will take it seriously.

Your rights

Under UK data protection law you have the following rights over what we hold about you.

Access: Ask what we hold about you, and get a copy of it.
Rectification: Have anything wrong corrected, and anything incomplete filled in.
Erasure: Ask us to delete what we hold. For a demo enquiry this is straightforward and we will simply do it.
Restriction: Ask us to keep it but stop using it — while a correction is being sorted out, for instance.
Portability: Get the details you gave us in a machine-readable form, or ask us to send them somewhere else. This applies to what you typed into the demo form.
Objection: Object to anything we do on the basis of legitimate interests — which is most of what is described above. Tell us and we will stop unless we can show a compelling reason not to.

To use any of them, email privacy@atomagencies.com. It costs you nothing and we will answer within one month. We may need to ask something to satisfy ourselves that you are who you say you are, and we will keep that to the minimum.

We do not rely on consent for anything described on this page, so there is no consent for you to withdraw. What there is instead is the right to object, and for a demo enquiry an objection and a request for erasure amount to the same thing: we delete it.

Complaining to the ICO

If you think we have handled your data badly, we would like the chance to put it right first. But you do not have to come to us, and you can complain to the UK’s data protection regulator at any time.

The Information Commissioner’s Office takes complaints at ico.org.uk/make-a-complaint, on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Changes to this policy

When this policy changes, the date at the top changes with it, and the current version is always the one at this address. If we change it in a way that materially affects how we use details you have already given us, we will email the people whose details we hold rather than leave them to notice.

Some of what is above — the entries highlighted in red — is outstanding rather than secret. When those are settled, this page is where they will appear.