Privacy Policy

Version 1.7Effective 14 November 2026Governing law: Ireland and the EU GDPR

This Privacy Policy explains how Atlantic Agentic Labs, a trading name of Reevre Limited ("we", "us", "our"), collects, uses, shares and protects personal data when you visit atlanticagenticlabs.com or our documentation site, ask Octy a question on either, contact us, or deal with us as a client, prospective client, partner or supplier. It is written to meet the requirements of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Acts 1988 to 2018, and the ePrivacy Regulations (S.I. No. 336 of 2011).

1. Who we are

The controller of the personal data described in this policy is:

We are a small company and have not appointed a Data Protection Officer, as the GDPR does not require one for our processing. A named director is responsible for data protection and answers every request personally.

2. Personal data we collect

Information you give us

• Contact form: your name, work email address, company (optional), the subject you are interested in, your timeline (optional), and your message.
• Challenge us: your name, work email address, organisation, what you are sending, a response deadline (optional), your description of the challenge, whether you want our NDA first, and any documents you upload. Documents may contain personal data about other people, such as names in a tender pack; please send only what we need to understand the challenge.
• Signing our mutual NDA online: your organisation's name, registration number, place of incorporation and registered office; your name, title and work email; the name you type as your signature; the time; and the country your request came from. We keep a signed copy of the agreement.
• Business dealings: names, job titles, business contact details and correspondence of people at our clients, prospective clients, partners and suppliers, and any information needed to agree and perform a contract, such as billing details.

Information collected automatically

• Security data: when you use the contact form or ask Octy for an explained answer, Cloudflare Turnstile processes technical signals from your browser and your IP address to check that the form is being sent by a person. When you visit any page, our host Cloudflare processes your IP address and request details to deliver the page and protect the site from attack.
• Your cookie choice: stored in your own browser, not on our systems.
• Your display choices: the site remembers your theme, your view (Enterprise, Conversational or Agent) and how Octy shows text (Reader or Raw) in your own browser only; they are never sent to us.
• Visit counts: Cloudflare Web Analytics counts visits to this site without cookies or any identifier stored on your device: the page, the referring site, browser and device type, and country, from which no individual visitor can be recognised. It runs for every visitor, because it reads nothing from and writes nothing to your browser. Our basis is our legitimate interest in knowing which pages are read (6(1)(f)).
• Usage data, only with your consent: if you turn on Analytics, Microsoft Clarity records how you use the site: pages viewed, clicks, scrolling, device and browser type, approximate location from your IP address, and recordings of your visit with anything typed into forms masked.

Questions asked on the documentation site

The documentation site at docs.atlanticagenticlabs.com has an "Ask Octy" panel in which you can ask questions about the documentation. We keep the questions to improve the documentation and our products. Before a question is stored, automatic redaction removes email addresses, telephone numbers, keys, tokens and anything else that looks like a secret. We keep:

• the text of the question after redaction;
• the kind of answer given, and the documentation pages it cited;
• the model used, where the answer came from a model, and the cost and response time of the answer.

We do not keep your IP address, a session identifier, a cookie, your browser's user agent, or anything else that links a question to you. Rate limiting uses your IP address briefly, in memory and at Cloudflare, and does not store it. Before an "Explain the steps" answer, Cloudflare Turnstile checks that the request comes from a person, as it does on the contact form, and Cloudflare acts as our processor for that check. Answers that use a model are generated by models run through Amazon Bedrock in the EU. Questions are kept for 12 months and then deleted automatically, and only our staff can read them. Please do not put personal data in a question; redaction is automatic and may not catch everything.

Questions asked on this website

This website has an "Ask Octy" panel in which you can ask about Atlantic Agentic Labs, our platform, how we deploy and protect data, our partners and how engagements run. Answers come from our public documentation and from knowledge we have chosen to publish. We keep the questions to improve the website, the documentation and our products. Before a question is stored, the same automatic redaction removes email addresses, telephone numbers, keys, tokens and anything else that looks like a secret. We keep:

• the text of the question after redaction;
• the kind of answer given, the sources it cited, and whether it offered to put you in touch with our team;
• the model used, where the answer came from a model, the cost and response time of the answer, and a fingerprint of the answer used for its signed receipt.

We do not keep your IP address, a session identifier, a cookie, your browser's user agent, or anything else that links a question to you. Rate limiting uses your IP address briefly, in memory and at Cloudflare, and a short-lived signed cookie on our answering service; neither is stored with a question. Before an answer that uses a model, Cloudflare Turnstile checks that the request comes from a person, and Cloudflare acts as our processor for that check. Answers that use a model are generated by models run through Amazon Bedrock in the EU. Questions are kept for 12 months and then deleted automatically, and only our staff can read them.

Octy never asks for your name, email address or telephone number. If you choose "Talk to the team", the panel copies your question into the contact form on this page, held in your browser for that tab only; nothing is sent to us until you complete and submit the form yourself, and the form's data is then handled as described above for contact enquiries.

At your choice, the contact form can be prefilled from your Octy conversation: your question, or for a challenge you bring, a note Octy drafts from your words, the capability areas and the pages it cited. Nothing is sent until you edit and submit the form yourself. For a challenge you may also pick a sector and where it would run; those two choices are kept with the question, as the options you picked.

Our public MCP server

Atlantic Agentic Labs runs a public MCP server at ask.atlanticagenticlabs.com/mcp, through which AI assistants and agents can search and read our public documentation and the knowledge we have chosen to publish. It is read-only and needs no account. For each tool call we keep:

• the text of the query after redaction, which removes secrets, email addresses, telephone numbers and other personal data;
• the kind of result returned;
• the pages returned.

We do not keep an IP address, a session identifier, a cookie, a user agent or the name of the client software, or anything else that identifies the caller. Rate limiting uses a keyed hash of the caller's address, under a key that changes every day. The hash is held only for the length of the limit window, which is at most a day, and the address itself is never stored. The server sets no cookies. No AI model is called to serve a request, and we share nothing with third parties for this purpose. Records are kept for 12 months and then deleted automatically, and only our staff can read them. Please do not put personal data in a query; redaction is automatic and may not catch everything.

We do not use advertising cookies or tracking pixels, and we do not buy personal data from third parties.

3. How we use personal data

• To answer your enquiry and continue the conversation you started.
• To prepare proposals and, if we work together, to enter into and perform our contract with you or your organisation.
• To keep the website and our systems secure and to prevent spam and abuse of the contact form.
• To keep records we are legally required to keep, such as accounting and tax records.
• To establish, exercise or defend legal claims.

We do not sell personal data, use it for advertising, or use it to train AI models. The legal basis for each use is set out in the table in section 14.

4. When we act for our clients

When we build or operate systems for a client, the client usually decides what personal data those systems process and why. In that case the client is the controller and we act as its processor under a written data processing agreement (GDPR Article 28). That data is handled under the client's instructions and its own privacy notice, not this policy. The data processing agreement lists the sub-processors involved, which may include Amazon Web Services and the AI model providers above, and the client decides whether models run inside its own cloud account or are called through a provider's service. Our systems are built to keep each client's data within its own environment and isolated from every other client's.

5. Who we share it with

We share personal data only with the service providers we need to run our business, under contracts that require them to protect it and use it only on our instructions:

We use AI model providers only on their business and API terms, under which they act as our processors, do not train their models on our data, and may keep it only for a short period for abuse and safety monitoring, as set out in their data processing terms. Where a model is available inside AWS, we prefer to run it there, so the data stays within our AWS environment and the region we choose.

We may also disclose personal data where the law requires it, to protect our rights or the safety of others, or to a buyer or successor if our business is reorganised or sold, in which case this policy will continue to apply.

6. International transfers

Proton stores email in Switzerland, which the European Commission recognises as providing adequate protection. We run our AWS workloads in EU regions wherever we can, including AI models run through Amazon Bedrock. Cloudflare, Microsoft, Resend, Amazon Web Services and the AI model providers may process data in the United States or other countries outside the European Economic Area, in particular when a model is called through the provider's own service rather than inside AWS. Those transfers are covered by the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise by the European Commission's Standard Contractual Clauses. You can ask us for details of these safeguards using the contact details in section 13.

7. Retention and security

When data is no longer needed we delete it or anonymise it. We protect personal data with encryption in transit and at rest, multi-factor authentication on every account that holds it, access limited to those who need it, and an engineering practice built to the controls of ISO/IEC 27001 and SOC 2. No method of transmission or storage is completely secure, and we will notify you and the Data Protection Commission of a breach where the law requires.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy (Article 15)
• Rectify data that is inaccurate or incomplete (Article 16)
• Erase your data, in certain circumstances (Article 17)
• Restrict how we use it, in certain circumstances (Article 18)
• Data portability, to receive data you gave us in a portable format (Article 20)
• Object to processing based on our legitimate interests, and at any time to direct marketing (Article 21)
• Withdraw consent at any time where we rely on it, without affecting what was done before

To exercise a right, send a request through our contact form, choosing "Something else", or write to us at the address in section 1. We may need to confirm your identity. We will respond within one month, which may be extended by two further months for complex or numerous requests; if so, we will tell you why within the first month. Exercising your rights is free unless a request is manifestly unfounded or excessive.

9. Automated decisions and AI

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing, including profiling (Article 22). We do not use your messages to train AI models. Where we use AI models in our own work, including to help read and draft correspondence, they are the providers and terms described in section 5, and a person reviews anything that affects you.

10. Cookies

This website uses what it needs to work and stay secure: Cloudflare Turnstile on the contact form and the Ask Octy panel, the Ask Octy service's rate-limiting cookie, and a record of your cookie choice. If you turn on Analytics, it also uses Microsoft Clarity, which sets cookies. We use no advertising cookies. Details are in our Cookie notice, and you can change your choice at any time from Cookie preferences.

11. Children

Our website and services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as our services or the law change. We will update the version and effective date at the top of this page, and where a change is material we will tell people we are in contact with before it takes effect.

13. Contact and complaints

For any question about this policy or your personal data, use our contact form or write to Atlantic Agentic Labs (Reevre Limited), Lisloughrey, Cong, Co. Mayo, F31 YA43, Ireland.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work or where an alleged infringement took place. Our lead supervisory authority is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, dataprotection.ie. We would appreciate the chance to resolve your concern first.

14. Legal bases for processing

Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can ask us for that assessment, and you can object at any time.