This policy explains what Atlas collects, why we collect it, how we use it, and the rights you have over your data. Atlas is operated from Australia; if you are in the EU/UK, the GDPR applies and we honour it in full.
1. Who we are
Atlas is a workspace platform for creative teams at brands. It is provided by the operator of atlas.mjsons.net (“we”, “us”, “the operator”). You can reach us at support@atlas.mjsons.net.
2. What we collect
2.1 Account data
- Your email address (used for sign-in via magic link)
- Your first name, last name, craft role, and responsibilities
- The workspace(s) you belong to and your role within each
2.2 Workspace data
- Everything you and your teammates create inside Atlas – shoots, mindmaps, docs, shot lists, mood boards, connections between nodes, comments, and uploaded images (workspace logos)
- Timestamps for who created and last updated each record
2.3 Technical data
- Browser type and version, device and OS (for compatibility)
- IP address (for rate limiting and abuse prevention)
- Cookies and local storage — see our cookie policy
3. Why we collect it
- To provide the Atlas service you and your workspace pay for
- To authenticate you securely (via Supabase Auth) and prevent unauthorized access
- To respond to support requests and diagnose issues you report
- To send transactional emails (magic-link sign-in, invite links); we do not send marketing emails without explicit opt-in
4. Who we share it with
We never sell your data. We share it only with the vendors we need to run Atlas:
- Supabase — hosted PostgreSQL database, authentication, and file storage. Data is stored in Supabase’s Sydney region.
- Vercel — application hosting; server-rendered pages and serverless functions.
- Google Places API (optional) — when you type a location into a shoot, the substring you type is sent to Google to fetch autocomplete suggestions. Disabled unless a Google Maps API key is set for your workspace.
5. How long we keep it
- Workspace data is retained for as long as the workspace is active. When you delete a workspace, all associated records are permanently removed within 30 days.
- Account data is retained until you delete your account. Deleted accounts are purged within 30 days.
- Rate-limit counters and IP logs are retained for 30 days.
6. Your rights
- Access — request a copy of all data we hold about you.
- Correction — you can edit most fields directly in Atlas.
- Deletion — email us to close your account; we will delete within 30 days.
- Portability — request an export of your workspace as JSON.
- Objection — you can object to specific processing at any time.
To exercise any of these rights, email privacy@atlas.mjsons.net. We respond within 14 days.
7. Security
Data in transit is TLS-encrypted. Data at rest is encrypted by Supabase. Passwordless magic-link authentication removes the risk of leaked credentials. Row-Level Security policies scope every database query to the member’s workspace.
8. Changes to this policy
We will notify workspace owners by email at least 14 days before any material change takes effect.