Privacy
What atta stores, who else sees it, and how long it stays.
Last updated November 6, 2026
What we store
Your name, email address and a hash of your password. What you do in a workspace: requests, orders, budgets, approvals, stock, suppliers, destinations and their addresses, invoices. Which tools the agent ran for you, with their inputs, amounts and outcomes. What each person's model use cost.
Conversations and photos
Conversations with the agent are kept so you can come back to them. A photo you add is shrunk on your device, sent to the model with your message, and kept with that conversation.
Who in your workspace can see it
Workspace members with the right role can see the workspace's requests and orders. A private conversation or request hides its title and contents from the others. The amount, time and outcome stay visible, because a budget has to add up.
Who else receives it
The services on the subprocessors page receive what each one needs to do its job. Web searches go to Exa. Messages and photos go to the model provider. An address goes to the geocoder only when geocoding is switched on, and only the address string is sent. We don't sell your data.
Logs
Our logs hold ids, statuses, amounts and currencies. They are written not to hold item titles, notes or message bodies. A database or provider error message can quote a value, and it would appear in the log as written.
How long we keep it
Usage records: about 25 months. Agent activity: seven years. Photos on conversations from before our current agent runtime: 90 days. Read notifications: 90 days, and any notification: one year. Everything else stays until you or your workspace removes it. Backups follow the database host's schedule.
Your choices
You can delete or export your account and your workspace's data in Settings. An e-invoice may have to outlive that, where tax law requires it. Tell us if you want a copy or a correction you can't make yourself.
Cookies
A session cookie keeps you signed in, and a locale cookie remembers your language. We set no advertising or analytics cookies. Public pages count visits with our own Umami, which sets no cookie and stores no IP address.