Privacy Policy

1. Operator

WE.FIT GmbH, Zugerstrasse 22, 8820 Wädenswil, Switzerland ("WE.FIT", "we", "us") operates the Atlas platform at atlas.we.fit.

2. What Data We Process

Atlas is an internal business tool for WE.FIT staff. We process:

• Staff account data: Google Workspace profile (name, email, profile picture) obtained via Google OAuth sign-in. Only @we.fit accounts are accepted.
• Connected Google Workspace data: When an admin connects a Google Workspace account, we cache Gmail messages, Google Calendar events, and Google Drive file metadata in our database to enable the customer timeline, AI chatbot, and calendar features.
• Member and customer data: Synced from Wodify, Bexio, and Shopify to provide business analytics and customer relationship management.
• Usage data: Session cookies for authentication. No analytics or tracking.

3. Google Workspace Data

Atlas requests the following Google API scopes when connecting a Workspace account:

• Gmail: Read and send email on behalf of the connected account.
• Calendar: Read and write calendar events.
• Tasks: Read and write tasks.
• Drive: Read and write files in Google Drive.

Email content, calendar events, and Drive file metadata are cached in our Cloudflare D1 database to enable fast search, timeline display, and AI-powered queries. Emails are stored with full body content so the AI chatbot can answer questions about customer correspondence.

Google Workspace accounts can be disconnected at any time from the Sync page, which deletes all cached data for that account.

4. How We Store Data

All data is stored in Cloudflare D1 (SQLite) within Cloudflare's European data centers. OAuth tokens are stored encrypted at rest. We do not share data with third parties except:

• Cloudflare: Infrastructure provider (data processing agreement in place).
• Anthropic: AI chatbot queries send database query results to Claude. No raw customer emails are sent — only structured query results.
• Resend: Newsletter delivery service receives recipient email addresses and newsletter content.

5. Data Retention

Cached Google data is refreshed on each sync cycle and retained as long as the Google account is connected. Disconnecting an account deletes all associated cached data immediately. User sessions expire after 7 days.

6. Your Rights

Under Swiss data protection law (nDSG) and GDPR where applicable, you have the right to access, correct, or delete your personal data. Contact [email protected] for any requests.

7. Contact

WE.FIT GmbH
Zugerstrasse 22
8820 Wädenswil, Switzerland
[email protected]