Privacy Policy

This Privacy Policy explains how Combat Waffle Studios ("Combat Waffle", "we", "us", or "our") collects, uses, stores, shares, and protects information in connection with ATLAS (the "Service"), our internal operations platform. We are the data controller for the information processed through the Service. By accessing or using ATLAS you acknowledge the practices described here.

1. Scope & who can use ATLAS

ATLAS is a private, internal business tool. Access is restricted to authorized Combat Waffle Studios personnel and partners we explicitly invite; it is not a consumer product, is not directed to the general public, and is not intended for children. This policy applies to all information processed through the Service, including data from connected third-party accounts.

2. Information we collect

• Account & identity information — when you sign in with Microsoft (single sign-on) or, for invited partners, an email and password, we receive your name, email address, account identifier, and authentication tokens needed to verify you. Partner passwords are stored only as salted, hashed values (scrypt) — never in plain text.
• Work content — the tasks, projects, documents, comments, files, images, schedules, requests, performance notes, and other content you or your team create in ATLAS.
• Connected third-party accounts — if an authorized manager connects a social or business account (for example Facebook, Instagram, X, TikTok, Microsoft 365/Outlook, or other integrations we offer), we receive the access/refresh tokens and basic profile details (such as account name, handle, and ID) required to provide the connected feature and display the account's status.
• Usage & technical data — limited operational logs such as IP address, browser/device type, timestamps, and actions taken, used to operate, secure, and troubleshoot the Service.
• Cookies — a single, strictly-necessary session cookie that keeps you signed in. See "Cookies" below.

3. How we use information & legal bases

We process information to: (a) operate, maintain, and secure the Service and authenticate users (legitimate interests / performance of our internal operations); (b) provide the features you use, including publishing content your team authors and approves to accounts you connect, at the times you schedule; (c) detect, prevent, and respond to security incidents, fraud, and misuse; and (d) comply with legal obligations. We do not use your information for advertising and we do not sell it.

4. Cookies & similar technologies

ATLAS uses a single, signed, HTTP-only session cookie that is strictly necessary to keep you authenticated. We do not use advertising, analytics, or third-party tracking cookies. Because the cookie is essential to the Service, it cannot be disabled while using ATLAS.

5. Third-party services & sub-processors

We rely on a small set of vetted providers to run ATLAS. They process data only as needed to provide their service to us:

• Microsoft Azure — cloud hosting, storage, and backups.
• Microsoft Identity / Microsoft 365 — authentication and, where you connect it, mailbox and calendar features.
• Connected social platforms (Facebook, Instagram, X, TikTok, and any others you connect) — only to publish and manage the content your team creates.
• AI provider — when you use AI assistant features, the relevant prompt text is sent to our AI provider to generate a response; it is not used to train third-party models.

6. Connected-platform data (all integrations)

For every platform you connect, ATLAS accesses that platform's data solely to provide the feature you enabled — for example, publishing posts you create, reading the minimum profile or account information required by the platform's API, and showing the connection's health. We do not use connected-platform data for advertising or profiling, do not sell or rent it, and do not share it except with the platform itself and the infrastructure providers listed above. This applies equally to TikTok, Meta (Facebook/Instagram), X, Microsoft, and any future integration. Each platform's own handling of your data is governed by that platform's privacy policy.

7. How we share information

We do not sell personal information. We disclose information only: (a) to the sub-processors above; (b) to the platforms you explicitly connect; (c) to comply with law, legal process, or enforceable governmental requests; (d) to protect the rights, safety, and security of Combat Waffle Studios, our users, or the public; and (e) in connection with a merger, acquisition, or sale of assets, subject to this policy.

8. International transfers

We are based in the United States and process data there. If you access ATLAS from outside the U.S., you understand your information may be transferred to and processed in the U.S. and other countries where our providers operate, with appropriate safeguards where required by law.

9. Data retention

We retain information for as long as your account is active and as needed to operate the Service, then delete or anonymize it within a reasonable period unless a longer retention is required for legal, security, backup, or recordkeeping purposes. Encrypted database backups are rotated on a rolling schedule.

10. Security

We take protecting this information seriously because the Service contains confidential business data. Safeguards include: encryption in transit (HTTPS/TLS) and encryption at rest for credentials and tokens; access restricted to authenticated, authorized accounts with role-based permissions; hashed (never plain-text) partner passwords; encrypted off-site backups; least-privilege access to infrastructure; and continuous automated health and integrity monitoring. No method of transmission or storage is 100% secure, but we work to protect your information and to respond promptly to any incident.

11. Your rights & choices

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information, to object to processing, and to data portability (for example under GDPR or CCPA/CPRA). Authorized managers can disconnect any connected account at any time from Social → Accounts, which revokes ATLAS's stored access for that account. To exercise any right, or to request deletion of your data, contact us using the details below; we will respond as required by applicable law. We do not "sell" or "share" personal information as those terms are defined under U.S. state privacy laws.

12. Children's privacy

ATLAS is an internal business tool and is not directed to, or intended for use by, anyone under 16. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice. Continued use of the Service after an update constitutes acceptance.

14. Contact

Combat Waffle Studios — privacy questions and requests: support@combatwaffle.com.