The short version
This summary is here to help you read the policy. The full policy below is what counts.- We collect what we need to run your account: your name, email, sign-in details, plan and how you use the app.
- Your brand’s content is yours. We hold it for you and act on your instructions (see the Data Processing Agreement).
- We never sell your data, and we do not use advertising trackers or analytics cookies.
- Our usage analytics are our own, kept in our own database.
- A small number of outside companies help us run Brand Atlas. They are all listed on the Subprocessors page.
- You can ask to see, correct, export or delete your data at any time.
1. Who we are
Brand Atlas is run by [TEAM TO CONFIRM: the legal name of the company, its registered address and its company number]. We are registered with the UK Information Commissioner’s Office under number [TEAM TO CONFIRM: ICO registration number]. For anything about your data, write to [TEAM TO CONFIRM: privacy contact email].2. What this policy covers, and our two roles
Where we decide (we are the controller). This policy covers personal data about the people who use Brand Atlas and visit our sites: account holders, team members, people who join our waitlist or newsletter, and people who open a share link. Where you decide (we are the processor). The content you put into your brand can include personal data about other people, for example names and photos on a contacts page. We handle that only on your behalf and on your instructions. The Data Processing Agreement covers it, and your own privacy notice covers your relationship with those people.3. What we collect
4. Why we use it, and our lawful basis
5. Who we share it with
We share personal data only with the outside companies that help us run Brand Atlas, and only what each needs. Each is listed, with what it does and where, on the Subprocessors page. We also share data when the law requires it, or as part of a sale or reorganisation of our business, in which case we will tell you. We never sell your personal data, and we do not share it for advertising. If you connect your own AI app, or add your own OpenAI or Gemini key for Henry, the content you choose to send goes to that provider under your own agreement with them. See the AI terms.6. International transfers
Our database is in Frankfurt, Germany, and your files are stored in the EU. Some of our providers process data in the United States, among them our hosting provider, our payment provider and our AI provider. When personal data leaves the UK or the EU, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or on an adequacy decision, such as the UK-US data bridge and the EU-US Data Privacy Framework for certified companies. [TEAM TO CONFIRM: the safeguard in place with each provider.]7. Cookies and similar technology
We use only the cookies Brand Atlas needs to work:
Your light or dark theme choice is kept in your browser’s own storage, and so is the session number our analytics uses, which is cleared when you close the tab.
We use no advertising or analytics cookies. Our sign-up, sign-in and waitlist forms use Cloudflare Turnstile to check you are a person, which loads a script from Cloudflare. When you preview a Google font in the font picker, your browser loads it from Google, which sees your IP address; once you publish, the font is served by us.
[TEAM TO CONFIRM: that no cookie consent banner is needed, as only strictly necessary cookies are set.]
8. How long we keep it
[TEAM TO CONFIRM: the retention periods we promise.]
9. Security
How we protect your data is set out on the Security page.10. Your rights
You have the right to:- see the personal data we hold about you, and get a copy;
- correct it if it is wrong;
- delete it, which you can do yourself by deleting your brand or account in Settings;
- take it with you, which you can do yourself by downloading your files and exporting your brand as an ATLAS.md file;
- object to, or ask us to limit, how we use it;
- withdraw consent where we rely on it, for example by unsubscribing from the newsletter.
11. If you live in the United States
Some US states give their residents extra rights, such as to know what we collect, to delete it, and to correct it. The categories we collect, and why, are in sections 3 and 4. We do not sell or share personal information for advertising, and we do not use sensitive personal information to infer things about you. To use your rights, write to [TEAM TO CONFIRM: privacy contact email]. We will not treat you differently for doing so.12. Children
Brand Atlas is for businesses and is not meant for anyone under 18. We do not knowingly collect data about children.13. Changes to this policy
When we make a change that matters, we will tell you by email or in the app before it applies. Each change is listed at the end of this page.14. Contact, and our EU representative
Write to [TEAM TO CONFIRM: privacy contact email], or post to [TEAM TO CONFIRM: registered address]. [TEAM TO CONFIRM: whether we appoint an EU representative, and their details.]Changes
- 4 October 2026: first draft.