Privacy policy

What we collect

• A hash of your access code, never the code itself. We cannot read it back to you.
• An optional email address, only if you attach one — for recovery links, deposit confirmations and notifications. We store whether it is confirmed and the security codes used to confirm it.
• Account records: balances, deposits, cards and transactions, needed to operate the service and reconcile the pooled custodial account.
• Card program data: the cardholder name you set and a US billing address per card, shared with our card issuing partners to operate your cards.
• Telegram data, only if you link your account to our Telegram bot: your chat ID, and the messages you send the bot. We push transaction alerts and 3-D Secure codes to that chat at your request.
• Standard server logs (IP address, request time) kept briefly for rate limiting and abuse prevention.

What we share

Card issuance and payment processing run through licensed partners (card issuing, payment processing and custody providers), who receive the data needed to issue and operate your card and process your deposits. Email is delivered through an email service provider. Telegram messages are processed by Telegram under its own privacy policy. We do not sell personal data, and we run no advertising trackers.

What we store locally

A session cookie keeps you logged in. It contains a signed random identifier with no personal data, and is deleted when you log out or after 30 days. We use no analytics or advertising cookies.

How long we keep things

Account and transaction records are kept as long as your account is open, and as required by our processing partners and applicable law afterwards. Security events (for example recovery requests) are kept as part of your account history. Server logs roll over within weeks.

Your choices

You can attach or remove your recovery email in Settings at any time. You can unlink the Telegram bot at any time. Closing your account closes your cards and settles any remaining balance; records required by law are retained after that.

Your California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right to: know the categories and specific pieces of personal information we collect, use, disclose and sell/share; delete personal information we hold, subject to legal retention exceptions; correct inaccurate personal information; and opt out of the sale or sharing of personal information for cross-context behavioral advertising. We will not discriminate against you for exercising any of these rights.

We do not sell or share personal information for cross-context behavioral advertising. In the preceding 12 months we have sold or shared none. To exercise your rights, contact us through the support channel or the email below; we will verify your request (for account-bound data this means confirming control of the account or its recovery email). An authorized agent may submit a request on your behalf with written proof of authorization.

Security and international transfers

Access codes are stored only as hashes. Our partners may process data outside your country of residence, including in the United States; by using AtmosCard you acknowledge those transfers. No system is perfectly secure — keep your access code and email account safe, since control of either can control your account.

Contact

Privacy questions and rights requests: the support channel linked in the footer of this site, or support@atmoscard.com.