Privacy Policy
In effect since April 2026. Last updated October 14, 2026. Applies to atriumhotels.ai and the Atrium product.
1. Who we are
Atrium is operated by Atrium AI Inc., a company based in Ontario, Canada.
Shahyn Kamali is accountable for how Atrium handles personal information. Write to shahyn@atriumhotels.ai with any privacy question or request, and a person will answer.
This policy covers people who visit this website, people who use Atrium, and people named in the documents hotels send us.
2. What we collect
On this website
We use Google Analytics to understand how visitors use the site: pages viewed, approximate location, and how you found us. We also use IP-based company identification services to understand which businesses visit our site. This tells us the name of an organization associated with a network, not the identity of any individual person. We use this for business-to-business sales and marketing purposes only.
We do not sell visitor data, and we do not use advertising trackers that follow you across other websites.
When you open a page on this site, our server also records your IP address, your browser, the page, the website that sent you, and any campaign tags in the link. We look up which organization the IP address belongs to, and we post that organization's name to an internal Slack channel.
If you send us your work email through a form on this site, it is emailed to our team so a person can reply. We do not add it to a database.
Your account
To create an account, you give us your name, your work email and a password. We store the password only as a one-way hash, never in readable form.
If you sign in with Microsoft, Microsoft tells us your name, your email address and the IDs of your Microsoft account and organization. We do not get access to your mailbox or calendar.
When you set up a hotel, we collect its name, address, phone number, property type and room count, and the email addresses and roles of the people you invite.
Each time you sign in, and each time your session renews, we record the IP address and browser you used.
What hotels send us
Everything a hotel forwards or uploads: invoices, credit notes, delivery receipts and packing slips, supplier agreements, photos of invoices, and forwarded emails with their sender, subject, text and attachments.
These documents contain names and contact details. Examples are supplier sales representatives and, on uniform-rental invoices, the names of the employees the uniforms belong to. They can also contain payment details as printed, such as the last digits of a card.
We may also store contact details for a hotel's suppliers: a sales representative's name, email and phone number, and the hotel's account number with that supplier.
Ask Atrium
The questions you ask Atrium, in the app or by email to ask@atriumhotels.ai, and the answers it gives. We keep the conversation. A spreadsheet attached to an answer is emailed to you and not stored.
3. How we use it
We use this information to:
- Read and check the documents hotels send: pull out each line, compare prices with past invoices and agreements, and flag duplicates and exceptions.
- Answer Ask Atrium questions using the hotel's own data.
- Send product email: alerts, digests, reports, invitations, password resets and Ask Atrium answers.
- Send a dispute or a purchase order to a supplier when a hotel user asks us to. A dispute email attaches the invoice and receipt, and the supplier's reply goes to that user.
- Give support. Our staff can open a hotel's account to help.
- Keep Atrium secure, using sign-in records, limits on repeated requests, and error records.
- Improve the product: fix mistakes, and get better at reading documents and matching the same product across suppliers.
- Understand who visits this website, and follow up with companies that may want Atrium.
We do not sell personal information, and we do not use it for advertising.
4. AI
Atrium uses Anthropic's Claude models to read invoices, receipts, supplier agreements and forwarded emails. It also answers Ask Atrium questions and writes report summaries using the hotel's data.
Atrium also uses OpenAI to turn product names, descriptions and categories into embeddings: numbers that let it match the same product across suppliers. Only that product text goes to OpenAI. No documents, emails or images do.
Under Anthropic's commercial terms, Anthropic may not train its models on this data, and it processes the data only to provide its service to us. Anthropic says it deletes the data within 30 days. It can keep data longer if the data is flagged for breaking Anthropic's usage policy (up to 2 years), or if the law requires it. Anthropic stores data in the United States, and may process it in other countries, including in Europe, Asia and Australia.
OpenAI does not use data sent through its API to train its models unless the customer opts in. It keeps the data for up to 30 days to check for abuse, or longer if the law requires it.
Atrium does not train its own AI models on your data.
5. Service providers
We use these companies to run Atrium. Each one receives information only for the job listed.
Anthropic
Its Claude models read the documents and emails hotels send, and answer Ask Atrium questions.
Where: United States, and other countries including in Europe, Asia and Australia
OpenAI
Turns product names, descriptions and categories into embeddings, so Atrium can match the same product across suppliers.
Where: United States and other countries where OpenAI operates
Hetzner
Hosts the servers that run this website, the app, our main database and our background jobs, and keeps about a week of database backups.
Where: United States
Cloudflare R2
Stores the files hotels upload or forward, and copies of our nightly database backups.
Where: Eastern North America
Twilio SendGrid
Sends our email and receives email forwarded to Atrium's addresses.
Where: United States
Microsoft
Runs the mailboxes for atriumhotels.ai, so email sent to Atrium's addresses passes through Microsoft 365 first. It also provides Microsoft sign-in.
Where: North America
Resend
Delivers messages from the forms on this website to our inbox.
Where: United States
Google
Google Analytics measures how the website and app are used. Google Fonts serves a typeface on every page. Google Maps Platform suggests addresses when you set up a hotel.
Where: United States and other countries where Google operates
Leadfeeder (Dealfront)
Identifies the companies that visit this website.
Where: European Union (Ireland)
ipinfo.io
Looks up which organization an IP address belongs to.
Where: United States
Slack
Carries internal alerts to our team. An alert can include a new user's name and email, the sender and subject of a forwarded email, an Ask Atrium question and answer, or the name of a company visiting this website.
Where: United States
Stripe
Bills hotels for Atrium. Hotels pay through Stripe, so their card details go to Stripe, not to Atrium. Stripe also lets a supplier connect its Stripe account, and we send it the supplier's email and business name.
Where: United States and other countries where Stripe and its service providers operate
Calendly
Books calls with us.
Where: United States
If you are in Canada, your information may be processed outside Canada, including in the United States. While it is there, it is subject to the laws of that country, and authorities there may be able to access it.
6. Pricing data across hotels
Atrium compares the prices you pay with two kinds of outside prices.
Comparable-supplier prices
To suggest a comparable product from another supplier, Atrium uses supplier catalog prices and your own invoices. It never uses another hotel's invoices for this.
Market benchmark
To compare what you pay for an item with what other hotels pay, Atrium uses other hotels' invoices from the last 90 days. It shows you only the middle price, and only when at least three other hotels bought the same item, or an equivalent one, in that time. It never names those hotels or shows their invoices. Your own prices are left out of the price you see.
Your invoice prices count toward other hotels' benchmarks in the same way: only inside a middle price from at least three hotels, and never with your hotel's name.
We never publish a hotel's results without its permission.
7. How long we keep it
While a hotel's account is open, we keep its documents, the data we pull from them, its Ask Atrium conversations and its account details.
Some things are deleted sooner:
- Forwarded email: the original message is deleted after about 30 days, and our record of the email and its attachment after 90 days. A document filed as an invoice or receipt keeps its own copy while the account is open.
- Our copy of each email we send you, with its recipient, subject and text: 90 days.
- Error records: 7 to 60 days.
- Sign-in records with IP address and browser: 12 months.
- Website visit records with IP address: 12 months.
- Server logs: our server keeps a fixed amount of logs for each service. Once that fills, the oldest entries are deleted as new ones arrive.
To close an account, email shahyn@atriumhotels.ai. We delete the hotel's data within 30 days of the request, except what the law requires us to keep.
We back up our databases every night and delete each backup within 30 days.
8. Security
- Every connection to this website and to our API uses HTTPS.
- Passwords are stored only as one-way hashes.
- We store only a hash of your long-lived sign-in token, and we replace it each time it is used. If an old one is used again, we cancel all of that user's long-lived sign-in tokens.
- Each hotel's users can see only the hotels they belong to.
- A small number of our staff can access accounts to support customers and run the service. When staff sign in as a user to help, it lasts at most one hour, and each time is logged.
- Documents are kept in private storage and opened through links that expire after 15 minutes.
No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada.
9. Your choices
Email shahyn@atriumhotels.ai to see the personal information we hold about you, to correct it, to delete it, or to get a copy. We may ask you to confirm who you are first.
In the app, you can change your password, and download your hotel's invoices, line items, price changes and compliance exceptions as Excel, CSV or PDF files.
If we email you and you would rather not hear from us, reply and say so. We stop.
Complaints
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.