GDPR Compliance
Last updated: September 22, 2026
Atellier is committed to protecting personal data of individuals in the EEA, UK, and Switzerland and complying with the General Data Protection Regulation (Regulation (EU) 2016/679), the UK GDPR, and the Swiss FADP.
Roles
| Data | Atellier's Role | Customer's Role |
|---|---|---|
| Account Data (our paying customers and team members) | Controller | N/A |
| Customer Data (clients, deals, messages, files our customers upload) | Processor | Controller |
| Marketing & website data | Controller | N/A |
Lawful Bases
- Contract (Art. 6(1)(b)) — to deliver the Service.
- Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, product improvement.
- Consent (Art. 6(1)(a)) — marketing emails to non-customers and, if you choose "Allow analytics," first-party marketing-site analytics. We do not use advertising or third-party analytics cookies (see the Cookie Policy).
- Legal obligation (Art. 6(1)(c)) — tax, anti-fraud, lawful requests.
Data Subject Rights & Response Times
You have the rights of access, rectification, erasure, restriction, portability, and objection. We respond within 30 days of a verifiable request (extendable by 60 days for complex requests, with notice).
- Atellier account holders — self-serve from Settings.
- Portal users — Profile → Export My Data / Delete My Account.
- End users of our customers — contact the customer (Controller). We assist them in fulfilling your request.
- Other — email hello@meonneon.com with subject "Data Subject Request".
Data Processing Agreement
Our DPA is GDPR Art. 28-compliant and incorporates the EU SCCs (2021/914) and UK IDTA for international transfers. You can download it as PDF or email hello@meonneon.com for a countersigned copy.
International Transfers
Our infrastructure is in the United States. Transfers from the EEA, UK, and Switzerland are made under EU SCCs / UK IDTA, supported by a documented Transfer Impact Assessment and supplementary measures (encryption in transit and at rest, RLS, access controls, secret-management).
Sub-Processors
Each Sub-Processor is bound by data-protection terms no less protective than our DPA. Atellier remains liable to Customer for Sub-Processor performance.
| Sub-Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage, realtime | Account data, Customer Data, files, auth tokens | United States (AWS) |
| Stripe | Payment processing, subscriptions, invoicing | Name, email, billing address, payment method | United States |
| Twilio | SMS, voice calls, telephony | Phone numbers, message content, call metadata, recordings | United States |
| Resend | Transactional and marketing email delivery, open/click tracking | Recipient email, message content, engagement events | United States |
| OpenAI | AI features (Carl assistant, content generation) | Prompts plus the org records (deals, clients, messages, etc.) the Carl assistant retrieves to answer them, scoped to the requesting user's organization and permissions | United States |
| xAI | AI features (alternative model provider) | Prompts plus the org records the Carl assistant retrieves to answer them, scoped to the requesting user's organization and permissions | United States |
| Black Forest Labs (BFL) | AI image / mockup generation | Image prompts, reference images | Germany / United States |
| Lovable AI Gateway | AI request routing and inference | Prompts plus org records the Carl assistant retrieves, routed to the underlying model provider | United States / EU |
| Sentry (Functional Software, Inc.) | Error monitoring and masked error replays (signed-in app sessions only, captured when an error occurs) | Error details, stack traces, browser/device metadata, page URL, limited performance timings; replays with all text and inputs masked and media blocked | United States |
| GIPHY | GIF search (only when a user opens the GIF picker) | Search terms; the selected GIF is loaded from GIPHY, which receives the viewer's IP address and browser metadata | United States |
| Unsplash | Stock photo search and hotlinked images (only when a user searches or inserts Unsplash photos) | Search terms; images are loaded from Unsplash, which receives the viewer's IP address and browser metadata | Canada / United States |
| DeepL | Message translation (only when a user requests a translation) | Text of the message being translated | Germany / EU |
| Expo (650 Industries, Inc.) | Mobile push notification delivery | Device push tokens, notification title and body | United States |
| OpenStreetMap (Nominatim) | Address geocoding and map tiles for install/route maps | Job-site addresses being geocoded; map tiles are loaded from OpenStreetMap, which receives the viewer's IP address | United Kingdom / EU |
| Google Calendar sync, OAuth login, Maps | Email, calendar events, OAuth tokens, address geocoding | United States | |
| Meta (Facebook, Instagram, WhatsApp) | Inbox channels — DM and message sync | Page tokens, messages, contact identifiers | United States / Ireland |
| Shopify | E-commerce order and product sync | Orders, customers, products, store metadata | Canada / United States |
| QuickBooks (Intuit) | Accounting sync — invoices, payments, customers | Invoice data, payment records, customer records | United States |
| Xero | Accounting sync — invoices, payments, customers | Invoice data, payment records, customer records | New Zealand / United States |
| EasyPost | Live package tracking across carriers (UPS, FedEx, USPS, DHL and others) | Tracking numbers and carrier names; EasyPost returns the carrier's scan history, which can include delivery city/state | United States |
| ShipStation | Shipping label generation and order fulfillment | Shipping address, order details, recipient contact | United States |
| OpenPhone | Alternative telephony / SMS provider | Phone numbers, message and call metadata | United States |
| QUO | Telephony — click-to-call, screen pop, call logs | Phone numbers, call metadata, recordings | United States |
| Zapier | Customer-configured webhook automations (only when you enable) | Whatever fields you map into your Zap | United States |
| AWS | Underlying cloud infrastructure (via Supabase) | All data stored / processed by Supabase | United States |
| Cloudflare | CDN, DNS, edge caching, DDoS protection | IP addresses, request metadata | United States / Global edge |
We update this list as our infrastructure evolves. Material changes are reflected by updating the "Last updated" date on this page.
Breach Notification
Where Atellier is a Processor, we notify the Customer (Controller) without undue delay and within 72 hours of becoming aware of a Personal Data Breach. Where Atellier is a Controller, we notify the competent supervisory authority within 72 hours and affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
EU / UK Representatives
If we appoint a representative under GDPR / UK GDPR Art. 27, contact details will be published here. Until then, EU/UK data subjects may contact us directly at hello@meonneon.com.
Supervisory Authorities
- EU — list of national supervisory authorities at edpb.europa.eu
- UK — Information Commissioner's Office (ICO)
- Switzerland — Federal Data Protection and Information Commissioner (FDPIC)
Contact
Worldwide Signage Ltd. d/b/a Atellier
8405 W 54th Place
Arvada, Colorado 80002
United States