Atrium developer privacy notice
This notice, effective from 8th October 2026, explains how Company For Life Ltd, trading as COHO (“we”, “us”), uses personal information about developers on Atrium, the COHO app store. It covers you if you’re a developer who is a sole trader, and anyone whose details we receive about a developer business, such as its directors, owners, staff and contacts.
We are the controller of this information. Our main privacy policy explains how we use personal information more generally, and how to contact us.
This notice doesn’t cover customer data your app processes. That’s covered by the Atrium standard app data processing agreement.
What we collect
| Information | Examples |
| Account and contact details | Name, business name, email address, phone number, address |
| Business and ownership details | Company number, directors, people with significant control, country of business |
| Verification and sanctions checks | The results of our checks against Companies House, the UK sanctions list and HMRC’s VAT records |
| Tax and payment details | VAT number, bank account details, the results of our bank’s account name check, payout and invoice records |
| Developer fee payments | Payment records – card details are collected and held by Stripe, not by us |
| Insurance | Your professional indemnity certificate: insurer, limit and expiry date |
| Apps and listings | App details, listing content, support contacts, review notes and decisions |
| Technical information | Developer account activity, API usage, API keys issued, IP addresses and logs |
| Communications | Emails, support requests and messages between you and us |
Where we get it from
- From you, when you register, set up payouts, list an app or contact us.
- From public sources: Companies House, the UK sanctions list and HMRC’s VAT number checker.
- From our bank, when it checks that your account name matches.
- From Stripe, when you pay your developer fee and, in future, if we use Stripe to verify developers and make payouts.
- From our systems, when you use your developer account or our API.
How we use it, and why
| What we do | Our lawful basis |
| Run your developer account, review and publish your apps, and provide support | Performing our contract with you |
| Pay you, collect your developer fee, and process invoices | Performing our contract with you |
| Check sanctions lists, and keep records of payments and VAT | Our legal obligations |
| Verify your identity and business, and check your bank details and insurance | Our legitimate interests in preventing fraud, protecting customers and keeping Atrium safe |
| Monitor API usage, and keep the platform and customer data secure | Our legitimate interests in security |
| Tell you about changes to Atrium, our API and our terms | Performing our contract with you |
| Send you news about Atrium and COHO | Our legitimate interests. You can opt out at any time. |
| Deal with complaints, disputes and legal claims | Our legitimate interests in protecting our business |
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. If that changes, for example if a payment provider carries out automated identity checks for us, we’ll update this notice.
Who we share it with
- Atrium customers. The developer name, support contact and other details shown on your app’s listing.
- Stripe. Our payment provider, for developer fee payments and, in future, identity checks and payouts.
- Our bank. To make payments and check account details.
- HMRC and other authorities. Where the law requires it.
- Our professional advisers, insurers and auditors. Where they need it to advise or protect us.
- Our service providers. Such as hosting, email and accounting providers, under contract and only on our instructions. These are listed in our Sub-processor list.
- A buyer of our business. If COHO or Atrium is sold or reorganised.
We don’t sell your personal information.
Information outside the UK
Some of our providers, including Stripe, may process information outside the UK. When they do, we make sure there’s a safeguard recognised under UK law, such as UK adequacy regulations or the UK International Data Transfer Agreement.
How long we keep it
| Information | How long |
| Account, payment, tax and verification records | Six years after your developer account closes, to meet tax, accounting and legal requirements |
| Insurance certificates | Six years after your developer account closes |
| Applications that don’t result in an account | 12 months |
| API and access logs | 12 months |
| Communications | Six years after your developer account closes |
Your rights
You have rights over your personal information, including to:
- access it;
- correct it;
- have it deleted, or its use restricted, in some circumstances;
- object to how we use it, including for news about Atrium and COHO;
- receive it in a portable format, in some circumstances.
Some rights don’t apply where we need to keep information to meet a legal obligation, such as tax records or sanctions checks.
To use any of these rights, contact us using the details in our privacy policy.
If you’re unhappy with how we’ve used your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office, at ico.org.uk.
If you give us other people’s details
If you give us details about other people, such as your directors, owners or staff, please make sure they know, and point them to this notice.
Changes to this notice
We may update this notice from time to time. The effective date at the top shows when it was last changed.
