Atriomio.

Privacy policy

Updated on 24 October 2026

This policy explains how Atriomio.com processes personal data when providing accounts, bookings, video calls, documents and payments. For privacy questions or to exercise your rights, contact hello@atriomio.com. The professional hosting a session may process data to provide their own service and should explain the purposes and conditions of that processing.

We process information you provide, including your name, email, profile and billing details, bookings, messages, documents and agreement acceptances. For passkey authentication, we store the public key and required identifiers; your private key and the biometric data used by your device are not sent to Atriomio. We also process technical connection data, attendance, usage, financial operations and security information, including your browser and, when supplied by the infrastructure, IP address and approximate country.

Data needed to create an account, organise sessions and carry out requested operations is processed to provide the service and perform the contractual relationship. Security records support the legitimate interest in preventing fraud, abuse and unauthorised access, while respecting users’ rights. Legal obligations may require financial information and evidence to be retained. Where a purpose requires consent, it must be requested specifically and can be withdrawn; withdrawal does not invalidate earlier processing. Information required for authentication or an operation is necessary to complete that operation.

Audio, video and shared content are transmitted to authorised participants through the video service. The application does not provide automatic call recording or transcription. Messages and uploaded documents may form part of the session history. Presenting a file directly from your device does not itself upload it to the library. Confidentiality agreements and their acceptances may generate evidence records. Share only data and documents you are authorised to disclose; a confidentiality agreement does not replace other data protection obligations.

Access depends on identity and permissions: professionals access their organisation’s data, and participants access information intended for them. We use hosting and email providers to operate the service, Daily for video calls and Stripe for payments when those features are used. Full card details are collected by the payment provider, not by Atriomio. When available and requested, electronic signature workflows may involve SignNow and the designated signatories. These services may process data in other countries; their policies explain their processing. Using a provider is not a guarantee of storage exclusively within the European Union.

Retention periods depend on the purpose: session cookies expire after 12 hours, authentication challenges after a few minutes and the language preference after one year. Expiry of access does not automatically delete the associated history. Accounts, documents, messages, evidence and financial records do not all share the same automatic deletion process. Erasure requests must be assessed against the need for the data, third-party rights and obligations to retain information or defend legal claims. We use access controls and private storage; no system offers absolute security.

Under applicable rules, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests and withdraw consent. Send requests to hello@atriomio.com, identifying your account and the right you wish to exercise, without sending passwords, codes or full payment details. We may request proportionate information to confirm your identity. You may also complain to Portugal’s CNPD or another competent supervisory authority.

The cookies page explains browser storage and the notice shown in the application. Reading that notice does not accept these terms or provide blanket consent to data processing. Policy updates are published on this page with their date; changes requiring new information or consent must be communicated before the new processing begins.