Firebird Solutions Limited · NZBN 9429054006225 · Auckland, New Zealand
Effective date: 9 October 2026 Last updated: 9 October 2026 Version: 2.1
The rest of this policy is the precise version. Where the two differ, the precise version governs.
This policy applies to the hosted Atamaia service at atamaia.ai, including its REST API, MCP interfaces and web dashboard (the "Hosted Service"), operated by Firebird Solutions Limited, trading as Firebird Solutions.
It also applies to the atamaia.ai website and the early-access interest form. If you register interest without creating an account, we collect your email address and anything else you choose to tell us, on the basis of your consent, and use it only to contact you about early access. We keep it until you ask us to remove it or until 24 months, whichever is sooner. Ask us to remove it at any time at [email protected].
This policy does not apply to Self-Hosted Deployments. If you run the Atamaia source code on your own infrastructure, we have no access to it and no role in your data. You are the operator, and your own privacy obligations apply.
We handle personal information in two distinct capacities, and it matters which one applies:
| We are the controller / agency | We are the processor | |
|---|---|---|
| What | Your account details, billing, support correspondence, request telemetry, security logs | The content you store — memories, facts, documents, tasks, messages, identity configurations |
| Meaning | We decide why and how it is handled | You decide; we act on your instructions |
| Your rights | Exercise directly with us (section 11) | You control it directly through the API and dashboard |
Where you store personal information about other people in Atamaia, you are the controller of that information and we process it on your behalf. You are responsible for having a lawful basis to collect and store it, and for giving those people any notice their local law requires. If you are a business customer subject to GDPR or similar law, our Data Processing Addendum governs that relationship.
| Category | Examples | Why |
|---|---|---|
| Account information | Email address, name, password hash | Create and secure your account |
| Organisation information | Tenant name, organisational units, groups, user roles | Operate multi-user access control |
| Billing information | Plan, billing address, tax details, transaction history | Charge you and meet tax obligations |
| Support correspondence | Emails and messages you send us | Answer you, and keep a record |
Payment card details never reach us. Payments are processed by Stripe, Inc. We receive a token, a card brand and last four digits, and transaction status — never a full card number.
This is the substance of the service: memories, facts, documents, tasks, projects, messages between identities, chat sessions, AI identity configurations and preferences, standing rules, session handoffs, and the relationships between them in the memory graph.
We do not inspect, mine, analyse or profile the substance of Customer Content, other than the automated processing needed to make the service work — indexing, embedding for retrieval, graph relationship building, and enforcing quotas — all of which runs on infrastructure we operate.
How embeddings are generated. Retrieval works by converting your content into numeric vectors. Atamaia generates these using a model running on hardware we operate — currently a local inference engine on our own hardware, with an in-process open-weights model (Qwen, run on CPU) as the fallback. Your content is not sent to any third-party embedding service to do this.
This is a platform-level configuration that we control. If we ever change it to use a third-party service, that service would become a subprocessor, and we would list it at /subprocessors and give at least 30 days' notice before the change takes effect — see section 5.1.
Customer Content may contain personal information about you or about other people. What it contains is entirely your choice, subject to the limits in our Terms of Service (section 9.6 — do not store HIPAA-regulated health information, full payment card numbers, or government identity credentials).
We write one telemetry record per HTTP request to the Hosted Service. Each record can contain:
Requests to /health, /openapi and /swagger are not logged this way.
These records capture that a request happened. They do not capture the content of what you stored, read or changed. The substance of a memory does not appear in a telemetry record.
We also record:
We set exactly one cookie: __Host-atamaia_oauth_bind, a browser-binding cookie used only during
OAuth sign-in flows (it prevents another browser from completing a sign-in started by yours). It is
strictly necessary, host-only, expires with the sign-in attempt, and requires no consent.
Authentication tokens are not stored in cookies. Your session token is kept in your browser's local storage by the dashboard. This keeps tokens out of ordinary cross-site request paths; the trade-off is that local storage is readable by any script that successfully runs on the page, which is why we run no third-party scripts or analytics at all. Authentication is thereby confined to first-party code only.
We use no analytics or advertising cookies of any kind, so there is no consent banner — there is nothing to consent to.
For customers in the EEA and UK, the lawful bases under the GDPR are:
| What we do | Lawful basis |
|---|---|
| Provide the Hosted Service and store your content | Performance of a contract (Art. 6(1)(b)) |
| Authenticate you and secure accounts | Contract; legitimate interests in security (Art. 6(1)(f)) |
| Enforce quotas and bill you | Contract; legal obligation for tax records (Art. 6(1)(c)) |
| Request telemetry, security logging, abuse detection | Legitimate interests in operating a secure, reliable service (Art. 6(1)(f)) |
| Service and security communications | Contract; legal obligation |
| Marketing communications | Consent (Art. 6(1)(a)) — opt-in only, withdrawable at any time |
| Respond to legal process | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interest in running a secure and functional service does not override your rights, principally because telemetry excludes the substance of your content and access is restricted and logged.
Where you store special-category data (health, biometric, and similar) about other people, you must establish the Article 9 condition. We process it only on your instructions as processor.
We do not:
We share personal information only in these circumstances.
Service providers who process data on our behalf under contract. The current list, what each does and where it is located, is at /subprocessors. We will give at least 30 days' notice before adding a new subprocessor that processes Customer Content; business customers under the DPA may object.
See section 6. This only happens if you set it up.
Other users in your tenant see what your access controls allow them to see. See section 7.1.
We may disclose information where required by valid legal process or where necessary to protect rights, safety or property. We will notify you before disclosing your information in response to legal process unless we are legally prohibited from doing so, or there is a risk to life or safety. We will challenge requests that appear overbroad or unlawful.
If we are involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction. We will give notice before your information becomes subject to a different privacy policy, and you will be able to export and delete beforehand.
Atamaia does not send your content to any third-party AI model, embedding or inference provider. Model inference performed by the platform itself — including the embedding generation described in section 2.2 — runs on infrastructure we operate.
You may choose to connect an External Provider by supplying your own credentials. If you do:
We will show you which External Providers are configured for your tenant. We recommend you check this before storing anything sensitive.
What we record about these calls: that the call happened, its duration and its token cost, for billing and diagnostics — the usage records are held on our New Zealand infrastructure. Note that where the call is made by an agent, the agent execution trace described in §2.3 may also record the request and response content, and those traces are retained per §8.3.
Every record in Atamaia belongs to a tenant, and tenant scoping is enforced at the data layer as a global filter rather than left to individual queries. Within your tenant:
Personnel may access Customer Content only where you ask us to for support, where strictly necessary to investigate a security incident or fault, or where required by law. Access requires a privileged permission, is limited to those who need it, and is logged.
No system is perfectly secure. We cannot guarantee that unauthorised access will never occur.
If a privacy breach occurs that is likely to cause serious harm, we will:
Customer Content is retained for as long as your account is active, or until you delete it.
You can export everything at any time through the dashboard or API. We recommend exporting before deleting anything you may want back.
During the life of your account, deletion is deliberately recoverable. Deleting an item (memory, document, task, message) removes it from every view, search index and model context you use immediately; it is retained flagged-as-deleted so that an accidental deletion — or a deletion made under transient state — can be restored. Nothing you delete by hand is permanently erased while your account remains open.
Why recoverability is the design, stated plainly. This is a memory product, and real memory does not work by deletion:
Working alongside this, every consequential action is recorded — what changed, when, and by whom (attributed to the user and credential that did it) — so the history of your data is always inspectable, not reconstructable after the fact.
When you close your account, everything is deleted. Account closure runs a complete, irreversible erasure: all Customer Content — memories, facts, documents, tasks, messages, chat sessions, agent traces, the knowledge graph, and your AI identities' memories — is deleted from our systems by cascade, including the content of your AI identities. This applies to every plan: paid accounts are purged immediately on closure; free accounts are purged within 30 days. Closure is self-service from the dashboard and requires your password confirmation: you are offered an export first, and a deletion receipt confirming what was destroyed and when is emailed to you when the erasure completes.
Backups. Deleted data is removed from live systems as above and from encrypted backups as they roll off their retention cycle — currently 30 days. Backups are age-encrypted and stored only on hardware we own.
Personal memories. Items you discard from your private memory store enter a quarantine window (default 7 days) and are then physically destroyed, row gone, unrecoverable — the one place in the product where deletion is immediate by design.
Request telemetry and audit records are pruned from the live tables by an automated job on the windows below. Pruned records move to encrypted archive storage on hardware we operate, where they are retained for security investigation and dispute resolution only.
| Record type | Retention |
|---|---|
| Request telemetry (including IP) | 30 days for noise-level records, 90 days for reads and 400 days for writes in live tables, then encrypted archive |
| Unauthenticated / scanner traffic | 30 days in live tables, then encrypted archive |
| Audit records (who did what) | 400 days in live tables, then encrypted archive |
| Agent execution traces | kept while the account is active; deleted at account close (section 8.2) |
| Billing and tax records | 7 years (Tax Administration Act 1994) |
| Backups | 30 days (backups are age-encrypted and roll off 30 days after creation) |
| Account records (email, name, password hash, org structure) | deleted with the account at account close (section 8.2) |
| Support correspondence | 24 months |
| Early-access interest form entries | 24 months |
Deleted content may persist in encrypted backups until they roll off on the schedule above. Backups are not used to restore individual deleted records except at your request.
The Hosted Service operates from hardware we own and operate in Auckland, New Zealand. Your data sits on our own infrastructure — it is not held by a hyperscaler or a colocation provider.
We may move hosting as the service scales. If we do, the destination appears on the subprocessor list (see below) with 30 days' notice, and the same protections move with your data.
Subprocessors that touch data from outside New Zealand:
Cross-border disclosure. Where we disclose personal information to a party outside New Zealand, we comply with IPP 12 of the Privacy Act 2020 by ensuring the recipient is subject to comparable safeguards, through contractual terms.
EEA/UK transfers. Where we transfer personal information out of the EEA or UK, we rely on the Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with supplementary technical measures including encryption in transit and at rest. Business customers can request a copy of the transfer mechanism via [email protected].
We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.
Quota enforcement and abuse detection are automated but are limited to service access. If your access is restricted automatically, you can contact [email protected] for human review.
Note: AI systems you configure in Atamaia may make automated decisions. That is your processing, under your control, and you are responsible for the obligations that attach to it.
Rights differ by jurisdiction. Whichever applies to you, contact [email protected] — or use the API and dashboard, which give you direct access, export and deletion without needing to ask.
We respond within 20 working days (the NZ standard) and within one month where GDPR applies. We do not charge for reasonable requests. We may ask you to verify your identity.
You have the right to access the personal information we hold about you (IPP 6) and to request correction of it (IPP 7). If we refuse, we will tell you why and you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
Access; rectification; erasure; restriction of processing; data portability; objection to processing based on legitimate interests; withdrawal of consent; and the right not to be subject to solely automated decision-making with legal effect. You may lodge a complaint with your national supervisory authority, or the UK Information Commissioner's Office.
We do not have an establishment in the EEA or the UK. Before we offer the Hosted Service into those markets, we will appoint the representative that Article 27 of the EU GDPR requires, and the separate one that Article 27 of the UK GDPR requires, and update this section.
Right to know what is collected, used and disclosed; right to delete; right to correct; right to opt out of sale or sharing; right to limit use of sensitive personal information; and the right not to be discriminated against for exercising these rights.
We do not sell or share personal information, and have not in the preceding 12 months. We do not use or disclose sensitive personal information for purposes beyond providing the service.
Categories collected in the last 12 months, in CCPA terms: identifiers (email, name, IP address); commercial information (subscription and transaction records); internet activity (API request telemetry); and any category you yourself place into Customer Content. Sources: you, and your use of the service. Disclosed for business purposes to the subprocessors listed at /subprocessors.
An authorised agent may make a request on your behalf with written permission.
Access and correction under APPs 12 and 13. Complaints to us first at [email protected], then to the Office of the Australian Information Commissioner at oaic.gov.au.
If your personal information is in another customer's Atamaia tenant, they control it. Contact them. If you cannot identify or reach them, contact us at [email protected] and we will make reasonable efforts to forward your request.
The Hosted Service is not directed to children. You must be at least 16 to hold an account, or older where your jurisdiction requires. We do not knowingly collect personal information from children. If you believe a child has given us information, contact [email protected] and we will delete it.
If you store information about children in Customer Content, you are the controller of that information and are responsible for the additional obligations that attach to it.
We will send you service and security notices — these are part of the service and cannot be opted out of while you hold an account.
Marketing emails are opt-in only. Every one has an unsubscribe link, and unsubscribing does not affect your service.
We may update this policy. For material changes we will give at least 30 days' notice by email and in the dashboard before they take effect, and will publish the updated version with a new effective date. Past versions are available on request.
| Purpose | Address |
|---|---|
| Privacy questions and requests | [email protected] |
| Security reports | [email protected] |
| General support | [email protected] |
Firebird Solutions Limited 34 Rainsford Road, Pukekohe, Auckland 2120, New Zealand
If you are not satisfied with our response, you may complain to:
| Version | Date | Change |
|---|---|---|
| 2.1 | 9 October 2026 | Account closure is now self-service from the dashboard; deletion receipt is emailed on completion; export available through the dashboard as well as the API. |
| 2.0 | 8 October 2026 | Full rewrite. Added controller/processor split, lawful bases, telemetry disclosure, tenant isolation, retention schedule, jurisdiction-specific rights, breach notification. |
| 1.0 | March 2026 | Initial short-form policy. |