What we collect, and
what we don’t.

Atlys Labs designs and builds websites and quote-request systems for manufacturers, machine shops, fabricators and contract manufacturers. This policy explains what information we collect through atlyslabs.com, how we use it, how long we keep it, and what you can ask us to do with it.

This policy covers our own website and the enquiry forms on it, correspondence you send us by email, and material you share with us during a teardown, a build, or an ongoing engagement.

It does not cover websites we build and operate on behalf of clients. Each of those sites is controlled by the client whose business it represents, and that client is responsible for the data collected through it. Where we handle data on a client's behalf, we do so under the terms of our agreement with that client and on their instructions.

It also does not cover third-party websites we link to. If you follow a link away from our site, the privacy practices of that destination apply.

When you submit an enquiry or teardown request through a form on this site, we collect the information you enter into it. At present that is your name, your work email address, your company name and website, a description of the processes and capabilities your shop runs, and an explanation of how quote requests currently reach you.

If you email us instead, we collect whatever you choose to put in that email, including your email address, any signature block it carries, and any attachments.

During an active engagement we may receive further material from you: capability details, machine lists, certifications, photographs of parts or your facility, existing website content, analytics access, domain registrar access, and the names and contact details of people at your company we need to work with.

We ask for the minimum needed to do the work. If we request something you would rather not share, say so — in most cases there is an alternative.

Like any website, this one is served by infrastructure that generates standard technical logs. These typically include IP address, browser type and version, device type, referring page, pages requested, and timestamps. This information is generated as an ordinary part of delivering a web page and is used for security, debugging and understanding aggregate traffic patterns.

We do not use this information to build advertising profiles, we do not sell it, and we do not attempt to identify individual visitors from it.

We do not run third-party advertising trackers, retargeting pixels, or social media tracking scripts on this site. We do not operate a cookie consent banner because we do not set the kind of cookies that would require one. If that changes, this policy and the site will change with it.

This section matters more than the rest of this policy for most of our clients, so it is deliberately specific.

During a teardown, a build, or a test of a quote-request system, you may send us technical documents: PDF prints, STEP or IGES models, DXF or DWG files, native CAD files, quality documents, or customer specifications. We treat these as confidential by default, whether or not a separate non-disclosure agreement is in place.

Files are transferred over encrypted connections. Where a system we build accepts uploads, those uploads are transferred directly from the sender's browser to storage rather than passing through intermediate servers unnecessarily, and access to that storage is restricted.

We retain files only for as long as the work requires. Test files used to validate an upload path are deleted once testing is complete. Files shared to inform a build are deleted at the end of the engagement or on request, whichever comes first.

We do not use your drawings, models or specifications as portfolio material, case study content, or examples in sales conversations without your explicit written permission. We do not share them with anyone outside the people working on your engagement.

Where your drawings carry export-control obligations, government contract flow-downs, or non-disclosure commitments to your own customers, tell us before you send anything. In those cases we will architect the system so uploaded files route directly into storage that you control and we never hold them, and we will avoid taking possession of controlled technical data ourselves. We do not claim registration or certification under any specific export-control regime, and we will not pretend otherwise to win work.

To respond to enquiries. We use your contact details and what you tell us about your shop to reply, to prepare a teardown or a quote, and to answer follow-up questions.

To carry out work you have engaged us for. This includes building and testing your site, configuring quote routing, monitoring that requests are being delivered, and making changes you ask for.

To operate and secure this website. This includes diagnosing faults, investigating suspicious activity, and understanding aggregate traffic.

To meet legal, tax and accounting obligations, including keeping records of invoices and contracts for the periods required.

We do not sell personal information. We do not share it with data brokers. We do not use it to train machine learning models. We do not add enquiry contacts to a marketing list without asking first, and if we ever send anything beyond a direct reply to your enquiry, it will be because you agreed to receive it and it will carry a working unsubscribe.

Where a legal basis is required for processing your information, we rely on the following.

Performance of a contract, or steps taken at your request before entering one: replying to your enquiry, preparing a quote, and carrying out an engagement.

Legitimate interests: operating and securing our website, keeping records of business correspondence, and understanding aggregate traffic. We consider these interests balanced against your rights and use the minimum information necessary.

Legal obligation: retaining financial and contractual records for the periods the law requires.

Consent: where we ask for it explicitly, such as using your project as a case study. Consent given can be withdrawn at any time.

We use a small number of third-party services to operate. Each processes information only to provide its service to us, under its own terms and security commitments.

Website hosting and content delivery, which serves the pages of this site and generates the technical logs described above.

Form delivery, which receives submissions from the enquiry forms on this site and forwards them to our inbox.

Email, which we use for all correspondence with enquiries and clients.

File storage, used during engagements to receive and hold material you send us.

Payment and invoicing services, used to issue invoices and receive payment. Card and bank details are handled by those providers, not by us — we never see or store full payment credentials.

For systems we build for clients, additional providers may be involved depending on what the system does. Those are documented in the client's own agreement rather than here.

We choose providers that offer encryption in transit and at rest as standard, and we review this list as our stack changes.

Atlys Labs operates from India and serves clients primarily in the United States and Canada. Our service providers operate infrastructure in multiple countries.

This means information you send us, including correspondence and files, may be stored or processed outside your own country. Where you need data to remain in a particular jurisdiction, tell us at the start of the engagement — for systems we build, we can usually configure storage regions to meet that requirement.

We rely on the safeguards our service providers put in place for international transfers, and we limit what crosses borders by keeping the amount of information we hold small.

We use encrypted connections for the transfer of information, restrict access to systems to the people who need it, use unique credentials with multi-factor authentication where the provider supports it, and keep secrets and access tokens in a dedicated secrets store rather than in code or configuration files.

We keep the amount of information we hold deliberately small. The most reliable protection for data is not collecting or retaining it in the first place, and we design engagements around that principle.

No system is perfectly secure and we will not claim otherwise. If we become aware of a breach affecting your information, we will tell you promptly, describe what happened and what we know about the scope, and tell you what we are doing about it. We will not delay disclosure to manage embarrassment.

If you believe you have found a security issue with this site or a system we built, email us. We will respond and will not pursue anyone who reports a genuine issue in good faith.

Enquiry correspondence is kept while there is an active conversation, and for a reasonable period afterwards in case you return to it. If an enquiry does not lead anywhere, we remove it in the ordinary course.

Client engagement records, including contracts and invoices, are kept for as long as required for tax, accounting and contractual purposes.

Technical files you send us are kept only for the duration of the work, and deleted at the end of the engagement or on request, whichever comes first.

Website technical logs are retained for the period our hosting provider retains them by default, which is short.

You can ask us to delete your enquiry and any files you have sent at any point, and we will, except where we are required to retain something for legal or accounting reasons. In that case we will tell you what we are keeping and why.

You can ask us what information we hold about you, and we will tell you.

You can ask us to correct anything inaccurate.

You can ask us to delete your information, subject to the retention exceptions above.

You can ask us to stop using your information for a particular purpose, or object to processing based on legitimate interests.

You can withdraw consent you have given, at any time, without needing to justify it.

You can ask for a copy of information you have provided in a portable format.

Depending on where you live you may have additional statutory rights under laws such as the GDPR, the UK GDPR, Canadian privacy legislation, or state privacy laws in the United States. Rather than argue about which regime applies to a given request, we will honour valid requests from anyone, regardless of jurisdiction.

To exercise any of this, email us. We do not require a specific form or template. We aim to respond within thirty days and will tell you if we need longer.

This is a business-to-business service. It is not directed at children and we do not knowingly collect information from anyone under 18. If you believe a child has sent us information, tell us and we will delete it.

If we change how we handle information, we will update this page and change the date shown below. We do not backdate revisions or make material changes quietly.

For clients under an active agreement, any change that materially affects how we handle your data will be communicated directly rather than left for you to discover here.

For any question, request or complaint about privacy, email legal@atlyslabs.com. Privacy requests are handled by our team directly, not routed through a support queue.

If you are not satisfied with how we have handled a privacy request, you may have the right to complain to a data protection authority in your country.