On your server. AtarCMS keeps content in your own MariaDB database and files in the site's storage/uploads/ folder; nothing is sent to us or to any cloud service. Backups are a database dump plus that folder, the site key and the .env file.
The site loads no third-party scripts or fonts. Statistics counters are off unless you add one, and then visitors are asked first.