Legal
Privacy Policy
DRAFT — to be reviewed by a qualified lawyer before launch. Effective date: [effective date].
This policy explains how [Legal entity name] ("ATLAS", "we") collects and uses personal data when you use the Service, and your rights under the EU/UK GDPR and similar laws. The data controller is [Legal entity name], [registered address]. You can reach us at [privacy contact email].
1. Data we collect
Account — your email address, and (if you sign in with Google) your name and profile image as provided by Google. Preferences — your locale and theme. Consent — the time you accepted the Terms. Authentication — the identifiers and tokens needed to keep you signed in (for Google sign-in, the provider account ID and OAuth tokens). Billing — a Stripe customer ID plus your plan and subscription status; we never see or store your full card number. Usage — minimal counters such as your daily assistant-query count, used to enforce plan limits. Administration — limited records of administrative actions (for example a refund or an account erasure) kept for accountability. Technical — standard server logs (such as IP address and timestamps) kept short-term by our hosting for security and debugging.
2. Cookies
The only cookies ATLAS sets are strictly necessary: a session cookie and a CSRF/security token to sign you in and protect forms, a short-lived cookie that records your acceptance of the Terms at sign-in, and a cookie that remembers you have seen this notice. There are no advertising, profiling, or cross-site tracking cookies. Because these are essential to deliver a service you have asked for, they do not require consent under EU/ePrivacy rules; you can block cookies in your browser, but sign-in will not work without them. For analytics we use Plausible — a privacy-friendly tool that counts aggregate page views WITHOUT setting any cookies, without collecting personal data, and without tracking you across sites or devices — so it requires no consent. If we ever introduce non-essential cookies, we will ask for your consent first.
3. How we use data & legal bases
We use your data to: provide and secure your account and the Service, and process sign-in (performance of our contract with you); process payments and prevent fraud (contract, legitimate interests, and legal obligation); enforce plan limits and protect the Service from abuse (legitimate interests); and comply with legal, tax, and accounting obligations (legal obligation). Any optional feature that needs more would rely on your consent. We do not sell your personal data and we do not make automated decisions that produce legal effects about you.
4. The AI assistant
When you use the assistant, your question and the engine's model-derived match context are sent to our language-model provider to generate a reply. On most plans nothing is stored and only your current question is sent. On the Edge plan, saved chat history is enabled: your conversation is stored to your account so it reloads across sessions, and recent turns are sent with each question for context. You can clear it at any time from the assistant; it is included in your data export and is permanently deleted when you delete your account. Please do not enter sensitive personal information in chat.
5. Sharing & sub-processors
We share data only with service providers acting on our behalf: Stripe (payments and billing), our football-data provider (fixtures and results — no personal data), our language-model provider (assistant replies), Google (only if you choose Google sign-in), Plausible (privacy-friendly, cookieless analytics — aggregate page views only, no personal data), an error-monitoring/diagnostics provider (used only for security and debugging, when enabled — its reports may include technical identifiers such as your IP address), and our hosting, database, and email providers. Some may process data outside your country; where they do, appropriate safeguards (such as EU Standard Contractual Clauses) apply. We do not sell or rent your data to anyone.
6. Retention
We keep account data for as long as your account exists. Usage counters are short-lived. Billing records are kept for as long as tax and accounting law requires. Server logs are kept short-term. When you delete your account, your personal data is erased and any active subscription is cancelled; we may retain limited records where the law requires.
7. Your rights
Subject to law, you have the right to access, correct, delete, export (data portability), restrict, or object to the processing of your personal data, and to withdraw any consent. You can export all of your data, or permanently delete your account, at any time from your account page, or contact us at [privacy contact email]. You also have the right to complain to your local data-protection supervisory authority.
8. Children
ATLAS is for adults (18+) and is not directed at children. We do not knowingly collect data from anyone under 18.
9. Security & changes
We use appropriate technical and organisational measures to protect your data, though no system is perfectly secure. We may update this policy; material changes will be notified by reasonable means and shown with a new effective date.
10. Contact
Data controller: [Legal entity name], [registered address]. Privacy contact: [privacy contact email].