Identity, PII & the DPA
How Atune separates broadly-captured behavior from personal data, which flows only under a data-processing agreement.
Atune draws a firm line between behavior and identity. Understanding this line is how you stay on the right side of privacy by default.
Behavior vs. identity
| Behavior | Identity | |
|---|---|---|
| What | How accounts and users act — requests, events | Names, emails, company names |
| How captured | Automatically, broadly, from the middleware | Only what you send, via identify() / group() |
| Gate | On by default | Requires an accepted DPA |
Behavior is captured broadly so understanding has something to rest on. Identity is never inferred or scraped — it is only ever the data you choose to send.
Sending identity
import { identify, group } from "atune";
await identify("u_123", { name: "Kari Nordmann", email: "kari@acme.no" }, { accountId: "acme" });
await group("acme", { company: "Acme AS" });This is what lets answers read "Kari at Acme" instead of "user u_123". Until you send it, Atune works fine on opaque IDs — identity only makes answers more legible.
Anonymous activity
Atune accepts events even when a request has no user identity yet. Anonymous activity is still useful behavior signal: it can show that an account is active, which flows are being touched, and where intent is building.
Anonymous activity should not become a parallel user model. Atune does not turn
anonymousId values into users, and you should not send names or emails through
capture. Instead:
- keep behavior flowing through
/api/v1/events; - call
identify()once the user is known, usually after login or session creation; - call
group()once the account, workspace, company, or tenant is known.
The product surfaces this as identity coverage on each account. Low coverage is a setup signal, not an ingestion failure.
Personal data needs a DPA
identify() and group() accept personal data (name, email, company). That
data flows only under an accepted data-processing agreement. Behavior capture
never reads request bodies, so it carries no such payload.
Keep sensitive data out of properties
Event properties are free-form and stored as you send them. Send ids and categories, never:
- health, religion, political views or other special-category data,
- national ID numbers, passwords or payment details,
- free text your users typed.
The DPA prohibits these, and they make your own risk assessment harder.
Roles and residency
- You are the controller. Atune is the processor. You decide what personal data is sent; Atune processes it on your behalf under the DPA.
- Primary data is stored in the EU. The database runs in Frankfurt (Neon,
eu-central-1) and the app in Vercel's Frankfurt region (fra1). Vercel, Neon and Cloudflare are US companies, so the DPA covers transfers with the EU-US Data Privacy Framework or standard contractual clauses. Atune calls no AI model with your data by default: your own assistant does that work over MCP. - Running a DPIA? Ask privacy@useatune.com for Atune's DPIA support pack.
That division is deliberate: you keep control of personal data, and Atune keeps the infrastructure that turns behavior into understanding.