Privacy Policy

1. Who we are and scope of this policy

ATOM Signatures (the "Service") is a centralized email signature management service for Microsoft 365, operated by ATOM Solutions (NEQ 1182200098) ("we", "us"), available at signatures.atomsolutions.ca, and including an add-in for Microsoft Outlook.

This policy applies to information processed by the Service: information about administrators who manage a client-organization account or a reseller account (a partner that offers the Service to its own clients), and information about the staff of those organizations whose directory attributes are used to compose signatures. It does not cover Microsoft's practices, nor those of other websites we link to.

2. Privacy officer

In accordance with Québec's Law 25, the President of ATOM Solutions, acting as the person in charge of the protection of personal information, can be reached at info@atomsolutions.ca. Any question, access request or complaint related to this policy may be addressed to them.

3. Information we collect

a) Administrator account and reseller account

When an administrator — or a reseller partner — signs in to the console with their Microsoft account (Microsoft Entra SSO), we receive their name, work email address and their organization's identifier (Microsoft 365 tenant). A reseller invited by ATOM receives a single-use invitation link, valid for 7 days, whose token is stored in hashed form. A reseller who joins the Stripe Connect payout program provides its identity and banking information directly to Stripe, on Stripe's pages: we do not receive or store it. We keep only its Stripe account identifier, the activation status of its payments and payouts, its prices and the history of amounts paid out to it, Stripe fees included. We use the email address of its Stripe account to notify it of each payout; ATOM does not store it (it is passed to our email delivery provider for that message only). As the platform, ATOM Solutions can view in its Stripe workspace the information Stripe displays about connected accounts.

b) Organization directory (Microsoft Graph)

With an administrator's consent, we read certain attributes of the organization's Microsoft 365 directory on a read-only basis, solely to compose signatures: first and last name, job title, department, phone numbers, email address, office location, group membership and, where applicable, organization-defined extension attributes.

c) Outlook add-in usage

When a user composes or sends an email, the add-in transmits the sender's email address to our service to determine the applicable signature and count the licenses (seats) in use. The platform used (desktop, web browser or mobile) and these calls are timestamped and logged.

d) The "My signature" pane

When an employee opens the "My signature" pane in Outlook and signs in (delegated Microsoft authentication, with no password of ATOM's own), we receive their sign-in identifier. If they choose a signature among the ones offered to them, that choice is kept. If their administrator allows it, they may also override certain contact details shown in their signature (phone number, title, address, etc.); these personalized values are then kept and take precedence over the directory's values.

e) Shared mailboxes and individual targeting

When an employee sends an email on behalf of a shared mailbox, that mailbox's address is transmitted to us in order to apply the right signature; it never uses up a seat. An administrator may also manually record their organization's shared mailboxes, or target a signature to a specific individual address rather than a group; these choices are kept.

f) Support requests

When you write to us through the support form, we receive your name, email address, message and organization name, sent by email to our team.

g) Administrator consents

When an administrator authorizes access to their organization's directory or approves another processing required by the Service, we keep a record of that consent: who gave it, for what, when, and from which IP address.

h) Billing

Billing is processed by Stripe. We keep the subscription identifier, the number of seats and the payment status. We never store payment card numbers.

i) Technical logs

Like any online service, we log technical events (IP address, browser type, timestamp, action performed) for security, troubleshooting and audit purposes. Our audit logs are append-only.

j) Audience, performance and ad measurement (Google Analytics, Microsoft Advertising, Meta, OpenAI, Cloudflare Web Analytics, HeyCatch, in-house measurement)

On our public pages (marketing website), we use Google Analytics 4 to measure traffic in aggregate (page views, referral source, device type). This tool sets cookies only after you consent, collected through the banner shown on your first visit (Google Consent Mode v2). Until you accept, no measurement cookie is set. Data is processed by Google LLC, which may involve a transfer outside Canada; we enable no advertising features (no profiling or targeting). You can withdraw or change your choice at any time through the "Manage cookies" link in the footer, by clearing this site's data in your browser or by contacting us. The administration console (authenticated area) does not use Google Analytics.

We also use the Microsoft Advertising UET tag (Microsoft Corporation) to measure the effectiveness of our ads on Microsoft's search network (Bing): it records the public pages viewed and the actions that follow a click on one of our ads (conversions), and may be used to show our ads to people who have already visited our site (remarketing). This tag is loaded and sets cookies only after you consent, collected through the same banner; until you accept, no request is sent to Microsoft. Data is processed by Microsoft Corporation, which may involve a transfer outside Canada, and Microsoft may link it to information it already holds about you under its own privacy policy. You withdraw or change this choice the same way as for Google Analytics. The administration console does not use this tag.

We also use the Meta Pixel (Meta Platforms, Inc.) to measure the effectiveness of our ads on Facebook and Instagram: it records the public pages viewed, and may be used to show our ads to people who have already visited our site (remarketing). This pixel is loaded and sets cookies only after you consent, collected through the same banner; until you accept, no request is sent to Meta. Data is processed by Meta, which may involve a transfer outside Canada, and Meta may link it to information it already holds about you under its own privacy policy. You withdraw or change this choice the same way as for Google Analytics. The administration console does not use this pixel.

Finally, we use the OpenAI Ads pixel (OpenAI, L.L.C.) to measure the effectiveness of our ads in ChatGPT: it records the public pages viewed, arrivals from one of our ads and the start of a free trial (sign-up confirmation page, where the same banner is shown to you). When you arrive through one of our ads, the click identifier OpenAI adds to the address (oppref) travels with your sign-up link to our application domain and is kept only for the duration of sign-up, in your session; it is sent to OpenAI only after you consent. When a free trial actually starts, our server also reports it directly to OpenAI (Conversions API): if you had accepted the banner on our site before following the trial link, this signal includes the click identifier along with your email address and your organization identifier, the latter two only in hashed form (SHA-256); otherwise, it includes only the start date, with no information about you or your organization. This pixel is loaded and sets cookies only after you consent, collected through the same banner; until you accept, no request is sent to OpenAI. Data is processed by OpenAI, which may involve a transfer outside Canada, and OpenAI may link it to information it already holds about you under its own privacy policy. You withdraw or change this choice the same way as for Google Analytics. The administration console does not use this pixel.

We also use Cloudflare Web Analytics to measure traffic and loading speed on our web pages (page viewed, referring page, browser and device type, country, loading time). This tool sets no cookies, uses no browser storage and does not identify visitors: it is therefore not subject to the consent banner. The IP address, received by Cloudflare when the measurement is sent, is discarded at the nearest data center and is not retained; measurements may be processed outside Canada.

Finally, we use HeyCatch to measure audience on our public pages and how visitors move through them (pages viewed, clicks on the page, referring page and campaign parameters, browser and device type). Unlike the tools above, HeyCatch is loaded as soon as the page opens, without waiting for the consent banner: it assigns your browser a random identifier, kept in a cookie and in local storage (section 13), which links your visits together. It is not used for advertising and the administration console does not use it. Data is processed by HeyCatch and its providers, which may involve a transfer outside Canada. The “Manage cookies” link does not apply to this tool: you can erase this data by clearing this site's data in your browser, or by writing to us.

Finally, we run our own audience measurement, on our public pages only (never in the console), which relies on no third party: the data is sent only to our servers, and no third party receives it, apart from the encrypted transit through Cloudflare (sections 6 and 7), which sees the traffic but does not store it. It sets no cookies, uses no browser storage and works whether you accepted or declined the consent banner. When you leave the page or send it to the background, your browser sends our servers a single message stating the page viewed (without its address parameters), the domain name of the referring site (never the full address), the campaign parameters of the address, the page language, the lowest section you reached, the action buttons you clicked and display-speed measurements. From these we derive the device type (phone, tablet or computer) and the country (from the IP address, by Cloudflare). No IP address and no browser identifier is recorded. To count each visitor only once a day, we compute, in memory only, a fingerprint from the IP address, the browser type and a random value that changes every day at midnight (Eastern time): this fingerprint is never written to a database, a file or a log, and it is forgotten at midnight or when the server restarts. A visitor can therefore be recognised for one day at most, never from one day to the next. Only daily totals are kept (page views and visitors by page, referrer, country, device, language, button and section, distribution of speed measurements), with no individual row, for at most 25 months (section 8). We count the steps of the sign-up journey in the same way, as numbers only (by day and by referrer), with no link to an organization or a person; the referrer (referring site or campaign) is added to the sign-up link and is kept only in your session, until it expires (after 8 hours of inactivity).

k) Tracked links and signature statistics

When a signature, a "reply" version or a campaign banner contains a link, that link first points to our application domain before redirecting to its real destination. Each redirection feeds statistics aggregated by day (two-letter country, derived from the IP address at the time of the click, device type, share attributed to bots): the IP address is never stored, nor is any individual event, and we never identify the person who clicked. This redirection sets no cookie (see section 13). We also count, just as much in aggregate, the number of emails sent (to compute a click-through rate), with no detail beyond the day and the internal sender. These statistics are kept for at most 25 months (see section 8), and the Customer's administrator can disable this tracking at any time from the console's Settings; links already sent then keep redirecting normally, simply without being counted any further.

l) Employee profile photo (optional)

This feature is off by default: only the organization's administrator can turn it on, in the console Settings, and turn it off at any time. When it is on and a signature uses the "Photo (employee)" token, the employee's profile photo in the Microsoft 365 directory is read (read-only, at the moment a recipient displays the email, not when it is sent), cropped to a 192 × 192 pixel circle and shown in the signature. The image is served from a signed address that contains neither an email address nor a readable identifier; anyone who receives the email can therefore display the image. A cropped copy is kept temporarily (about 24 hours) on our servers in Québec to avoid reading the directory each time the image is displayed; it is deleted as soon as the administrator turns the setting off, and with the organization's other data at the end of the subscription (section 8). When the setting is off, or when the employee has no photo in the directory, a neutral avatar, identical for everyone, is shown instead, without indicating whether the account exists. The photo is never sent to an artificial-intelligence service or to any third party, and is never logged. It is the organization's responsibility to inform its employees of this use. Exception: if the organization turns on the "Images embedded in the message" option, the photo (and the name shown as an image) are then attached to the email when it is sent, and the read at display time, the neutral avatar and the deletion of copies described above no longer apply to those emails: a copy of the image stays in the sender's sent items and with the recipients, and turning off the photo or the embedding afterwards only affects later emails. Copies already kept by a recipient's email client (for example by an image proxy server) are beyond our control.

m) Contact card (vCard) and QR code (optional)

When a signature uses the "vCard link" token ("Add to my contacts" button) or the "QR code" token, the email recipient can download or scan a contact card for the sender. That card contains only the contact details shown in that signature: the name is always included, while the job title, department, company, phone, mobile number, postal address or email are included only if the signature displays them; the organization's website address is added when it is set in the brand. The details are placed, encrypted, in a signed address that contains no readable contact detail: we do not keep them in a database for this purpose. That address is valid for 12 months from its issue, then refuses to open; each new send issues an up-to-date address. It is not cached by the content delivery network (CDN), stops working if the organization is deactivated or its subscription is unpaid, is not subject to click tracking and is never logged. Anyone who receives the email can open that address; a card already saved in a recipient's address book is beyond our control. It is up to the organization to inform its employees of this use.

n) Authorized partner access (managed service provider)

A Microsoft 365 administrator of your organization can authorize a partner — a reseller of the Service, for example the IT service provider that manages your environment — to administer your console on your behalf, without a guest account or shared password. This access exists only if an administrator of your organization explicitly approves it, from a link sent by the partner (single use, valid for 7 days, with its token stored in hashed form). The administrator chooses the role granted ("Editor" or "Administrator"). Access remains valid until it is revoked: your organization can revoke it or lower its role at any time in the console's "Console access" section, the partner can give it up on its side, and ATOM may also revoke it, in particular if the partner stops being a reseller of the Service. A revocation takes effect immediately.

While access is active, the partner's technicians, signed in with their own Microsoft account (section 3a), see and change in your console what the granted role allows, including your employees' directory attributes displayed there (section 3b). A partner can never manage access to your console, approve another partner, or create a token or access key that would survive revocation. For this feature, we keep: the partner organization's name and domain, the request label and the sign-in identifier of the person who created it, the sign-in identifier of the administrator who approved the access, the role, the approval and revocation dates, and who revoked it. The actions of the partner's technicians in your console — changes, as well as sensitive views such as exports and employee lists — are recorded in your audit log with their identifier and their organization's name; your administrator views this log in the console. An email notifies the approver and the request's creator upon approval, and the other party upon a revocation.

o) Apple Wallet and Google Wallet business card (optional)

This feature is off by default: only the organization's administrator can turn it on, in the console Settings, and turn it off at any time. When it is on, each employee can, from the Outlook "My signature" pane, add their own business card to Apple Wallet or Google Wallet; no card is created without this step by the employee. The add link is single-use, valid for 15 minutes, and stored in hashed form. The card contains: the name, job title, department, company, mobile number, office phone, email (the email address, never the sign-in identifier), the organization's website address, the brand colors and logo, and a QR code that opens the employee's contact page. The administrator can customize the card's appearance: colors, the card's logo (an image uploaded by the organization, otherwise the brand logo), field labels, displayed fields (they can hide the department, mobile number, office phone, email or website, or show the employee's appointment-booking link), up to three free-text fields (a label and a text, the same for all the organization's employees), the code (its shape, what it opens and the text shown under it), a banner (an image uploaded by the organization, for Google Wallet only) and, if they turn it on, the employee's profile photo, shown as a thumbnail on the Apple Wallet card only. This photo is read from the organization's Microsoft 365 directory each time the card is created or updated; it is neither kept in our database nor cached on our servers, and it is never sent to Google. The appointment-booking link and the free-text fields, if displayed, are part of the card: they appear on the Apple Wallet card, on the employee's contact page and in the content sent to Google for the Google Wallet card; the booking link can also be what the code opens, if the administrator chooses so. This information is read from the directory (section 3b) and from the contact details entered in the pane (section 3d) when the card is added and at each update: we do not keep it in our database. We keep there only the employee's sign-in identifier, random card identifiers, a fingerprint of the content (to detect a change), the creation and revocation dates, a hashed authentication token and, for Apple, the device identifier and the notification token that the device gives us so it can receive updates.

Where the card lives. With Apple Wallet, the employee's device downloads the card directly from our servers and keeps it: our servers do not send its content to Apple, only an update notification with no content passes through Apple's notification service. With Google Wallet, our servers send the card's content (name, job title, department, company, displayed contact details, appointment-booking link and free-text fields if displayed, labels chosen by the administrator, color, logo, banner if there is one, and what the code contains and displays) to Google, but never the employee's photo, which keeps it on its own servers, possibly outside Québec (section 7). What the employee's device or account then does with the card is up to Apple and Google.

Contact page. Anyone who scans the card's QR code or opens its address can see these contact details and save the contact card. The page is not indexed by search engines, is not cached by the content delivery network (CDN), sets no cookie, is not subject to click tracking, and no contact detail is written to the logs. A card already saved in a person's address book is beyond our control.

Updates and revocation. The card updates automatically when the directory, the pane's contact details or the organization's brand change, generally within a few hours. The employee can remove their card at any time from the pane; the administrator can revoke any employee's card from the console, or turn the setting off, which revokes all of the organization's cards. A card is also revoked automatically when the employee no longer exists in the directory. A revoked card stops working: the contact page no longer responds, the Apple card is marked as void on the device at its next update, and the Google card is deactivated, then emptied of its content at the end of the subscription with the organization's other data (section 8). The page and updates also stop if the organization is deactivated or its subscription is unpaid. It is up to the organization to inform its employees of this use.

4. What we never collect

• No email content: we never read, store or transmit the body or subject of your messages, nor the address or name of their recipients. Only one piece of recipient information is transmitted: when a message is sent, with Outlook on desktop or on the web, the add-in sends our service only the recipients' domains (To, Cc, Bcc), in order to choose between an internal and an external signature. These domains are used only for that comparison with your organization's domains: they are neither written to our database nor recorded in our application logs. With Outlook mobile, no recipient is read. The add-in inserts the signature locally, within Outlook.
• No passwords: authentication is handled entirely by Microsoft Entra.
• No advertising data: no ad tracking, no sale of personal information, no profiling — the aggregated, anonymous tracked-link statistics (section 3k) are used solely to measure the effectiveness of your organization's signatures and banners, never for advertising purposes, and your administrator can disable them at any time.

5. Why we use this information (purposes)

• To compose and apply your organization's email signatures;
• To target signatures by group, shared mailbox or individual address, and fill dynamic fields (name, title, phone, etc.);
• To count seats in use and bill the subscription, including, for a reseller's clients, billing at the price the reseller sets and paying out its margin through Stripe Connect;
• To secure the Service, prevent abuse and diagnose incidents;
• To allow a partner your organization has authorized to administer the console on its behalf, and to keep a record of its actions (section 3n);
• To let employees, when the organization turns this feature on, add their business card to Apple Wallet or Google Wallet and keep it up to date (section 3o);
• To respond to support requests;
• To comply with our legal obligations.

We do not use this information for any other purpose without your consent.

6. Disclosure to third parties (subprocessors)

We do not sell or rent personal information. Our infrastructure (servers, database, files) is operated directly by ATOM Solutions, in Québec: it is therefore not an outside subprocessor. We rely on a limited number of subprocessors for specific functions:

These subprocessors are bound by contractual confidentiality obligations and may only use the information for the intended purposes.

Partner authorized by your organization (section 3n): when your organization approves a partner's access, that partner accesses the information in your console according to the role granted. This partner is not a subprocessor of ATOM Solutions: your organization chooses it, authorizes it and can revoke its access at any time, and it is up to your organization to govern that relationship and inform its employees as needed.

7. Hosting and transfers outside Québec

The Service's infrastructure (database, files, application servers) is operated by ATOM Solutions itself, in Québec. Traffic passes through a Cloudflare tunnel: Cloudflare terminates TLS encryption and therefore sees the traffic in transit, but does not store it. Backup copies, encrypted before leaving our servers, are stored in Canada, in Toronto (Ontario). Some subprocessors (Stripe for payment, Google LLC and Cloudflare for audience measurement, Microsoft Corporation for ad measurement) may process information outside Québec or Canada. The same applies to Google LLC when an employee adds their business card to Google Wallet (section 3o): the card's content is then kept on Google's servers, possibly outside Québec. Before any communication of information outside Québec, we assess the privacy factors involved and govern it by contract, in accordance with Law 25.

8. Retention

• Your organization's own data (signatures, configuration, directory attributes, employee preferences) is kept for the duration of the subscription, then automatically deleted within 30 days of the cancellation taking effect;
• Exceptions to this deletion: billing records, kept for the periods required by tax laws, and audit logs and consent records, kept for at most 12 months;
• Technical application logs are kept for at most 12 months;
• A signature deleted in the console is first placed in a trash bin, then permanently purged 30 days after its deletion;
• Aggregated click and send statistics related to tracked links (section 3k) are kept for at most 25 months, then automatically purged, independently of the subscription's fate;
• The daily totals of our in-house audience measurement (section 3j) are kept for at most 25 months, then automatically purged;
• The cropped copy of an employee profile photo (section 3l), when this feature is on, is kept for about 24 hours, and deleted immediately if the administrator turns the setting off (except images attached to emails when the organization turns on the embedding of images in the message, see section 3l);
• For Wallet business cards (section 3o), the information we keep (the employee's sign-in identifier, card identifiers, hashed authentication token, fingerprint, dates) is kept while the card is active, then until it is deleted with the organization's other data at the end of the subscription; the device identifier and the notification token are kept until the card is removed from the device, at the latest at the end of the subscription; an unused add link expires after 15 minutes;
• For partner access (section 3n), an access request is deleted 90 days after it expires, is used or is revoked, unless the access it created is still in effect; a revoked access is deleted 2 years after its revocation. Requests and accesses are also deleted with the rest of the organization's data at the end of the subscription, whether that organization is the client or the partner;
• Backup copies are renewed according to their rotation cycle; deleted data disappears from them over the course of that cycle;
• You can request an export of your data before the end of your subscription or before a deletion, by writing to info@atomsolutions.ca.

9. Roles and responsibilities

For your organization's directory and employee information, your organization remains the party responsible under the law; ATOM Solutions acts as its mandatary (section 18.3 of Law 25), following your instructions and within the limits strictly necessary to provide the Service.

When your organization authorizes a partner (section 3n), it remains responsible for the information that partner accesses on its behalf; ATOM Solutions only enforces the authorization given, the role chosen and their revocation.

In the event of a confidentiality incident affecting this information, we notify your organization without delay and assist it in its steps; it is up to your organization to notify the Commission d'accès à l'information and the individuals concerned. For information we are ourselves responsible for — administrator and reseller accounts, billing, public website data — we directly notify the Commission d'accès à l'information and the individuals concerned, in accordance with Law 25.

10. Security

• TLS encryption for all communications;
• Strict isolation of each organization's data (per-tenant partitioning, database-level controls);
• Least-privilege access; Microsoft directory access is read-only;
• The token used by the Outlook add-in to authenticate with the Service is stored in hashed form, never in the clear;
• A partner's access (section 3n) is checked again on every request: a revocation or a role downgrade takes effect immediately;
• Regular backups, encrypted before leaving the server and stored in Canada (Toronto);
• Append-only audit logs;
• Rate limiting and abuse protections.

11. Your rights

Under Law 25 and applicable Canadian laws, you may:

• request access to the personal information we hold about you;
• request its correction if it is inaccurate or incomplete;
• request its deletion (cessation of dissemination) where the law allows;
• withdraw your consent at any time;
• request the portability of the computerized personal information you provided to us;
• file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

To exercise these rights, write to info@atomsolutions.ca. If you are a staff member of a client organization, we may redirect you to your employer, which remains responsible for its directory information.

12. Privacy incidents

Any confidentiality incident presenting a risk of serious injury is recorded in our incident register. Depending on the responsibilities described in section 9, it is either reported directly by us to the Commission d'accès à l'information and to the individuals concerned, or your organization is notified without delay so that it can make those notifications itself.

13. Cookies and local storage

The Service uses the following cookies and local storage:

• an essential session cookie to keep you signed in to the console (expires after 8 hours);
• an essential language preference cookie (atom_lang, 12 months);
• browser local storage, on our public pages, to remember your display language (atom:lang) and your audience- and ad-measurement consent choice (atom:analytics-consent, atom:consent-version);
• browser session storage (sessionStorage), in the console, specific to the tab and cleared when it closes: to keep a partner's approval link while the administrator signs in (atom:partner-approve, 30 minutes at most) and, for a partner, the list of its client organizations (name and identifier) shown in its switcher (atom:partner-clients);
• Google Analytics 4 audience-measurement cookies (_ga, _ga_*), set only after you consent to the banner shown on our public pages, and never on the administration console;
• Microsoft Advertising cookies (_uetsid, 1 day; _uetvid, 13 months; plus those Microsoft sets on its own domains), set only after you consent to the same banner, and never on the administration console;
• Meta cookies (_fbp, 3 months; plus those Meta sets on its own domains), set only after you consent to the same banner, and never on the administration console;
• OpenAI advertising cookies (__oppref, 30 days; __obref and __oaiq_consent), set only after you consent to the same banner, and never on the administration console;
• Cloudflare Web Analytics measurement (section 3j) sets no cookie and uses no browser storage;
• HeyCatch audience measurement (section 3j), on our public pages only, sets as soon as the page opens, without waiting for the banner, a cookie (ph_*_posthog, 12 months) and local and session storage entries holding the same random identifier;
• our in-house audience measurement (section 3j), on our public pages only, sets no cookie and uses no browser storage;
• tracked-link redirection (section 3k) sets no cookie: it never depends on the console's session.

No other advertising cookies are used.

14. Changes to this policy

We may update this policy to reflect changes to the Service or to legal requirements. The update date appears at the top of this page; in the event of a material change, administrators of client organizations will be notified.

15. Contact us

ATOM Solutions (NEQ 1182200098) — info@atomsolutions.ca — atomsolutions.ca