This Privacy Policy explains what data Atlas Photo collects, why we collect it, who we share it with, and the rights you have over it. Plain English first, defined terms second.
1. Who we are
Atlas Photo is a digital asset management service based in Utah, USA. For any question, request, or complaint about this policy, email support@atlas-photo.com.
In this policy, “Atlas Photo,” “we,” “us,” and “our” refer to the service and the team operating it. “You” refers to the person using the service, whether as a workspace owner, an invited team member, or a visitor to atlas-photo.com.
2. What we collect
We collect four buckets of data, no more:
- Account information. Your email address and display name. If you sign in with Google or GitHub, we receive your name, email, and profile image from that OAuth provider. If you sign in with email + password, your password is hashed with bcrypt before it touches our database.
- The assets you upload. The files themselves (images, videos, documents, etc.) plus the metadata you attach to them (filenames, tags, collection assignments, descriptions). Assets live in our Cloudflare R2 bucket and are served through Cloudflare's CDN.
- Basic usage data. An audit log of who did what and when inside your workspace: uploads, deletes, exports, invitations, permission changes, sign-ins. We use this for security review and to show the activity feed in the dashboard.
- Payment metadata. Your Stripe customer ID, your subscription state (plan, status, period end), and the email Stripe has on file. Card numbers, CVCs, and billing addresses live entirely with Stripe; we never see or store them.
3. How we use it
Strictly to operate Atlas Photo. That means:
- Running the service: storing your assets, serving them when you request them, keeping you signed in.
- Sending transactional email through Resend: sign-in confirmations, invitations, billing receipts, password resets.
- Billing you through Stripe: charging your card on the cadence you picked, sending invoices, handling refunds.
- Responding to support requests you initiate.
- Detecting and preventing abuse, fraud, or violation of our Terms of Service.
- Complying with legal obligations (tax records, valid law-enforcement requests).
We do not sell your data. We do not share it with advertisers. We do not train AI models on the assets you upload. We do not use your data for any purpose unrelated to operating Atlas Photo.
4. Who we share it with
To run Atlas Photo, we send certain data to a short list of vendors (subprocessors). Each is contractually obligated to handle your data only on our instructions and to keep it secure.
- Vercel hosts the Atlas Photo web application and serves its pages and API endpoints.
- Cloudflare R2 stores the assets you upload and delivers them through the Cloudflare CDN.
- Neon runs the PostgreSQL database that holds your account, workspace, asset metadata, and audit log.
- Upstash provides the Redis instance used for rate limiting on signups, sign-ins, and the public API.
- Resend sends transactional email (sign-in, invitations, receipts).
- Stripe processes payments, stores card details, handles tax calculation, and issues invoices.
We may also disclose data if compelled by valid legal process (a subpoena, court order, or law-enforcement request that we've reviewed for validity), or if Atlas Photo is involved in a merger, acquisition, or sale of assets. In the latter case we'll notify affected users by email before any transfer takes effect.
5. Cookies
Atlas Photo uses a small set of first-party cookies. None are for advertising, retargeting, or cross-site tracking.
- NextAuth session cookie keeps you signed in. Required for the dashboard to function.
- Theme preference remembers your light/dark mode choice.
- Sidebar collapse preference remembers whether you've collapsed the dashboard sidebar.
- Impersonation cookie set only when a super-admin is viewing a workspace as one of its users, for support purposes. Cleared the moment impersonation ends.
6. Data retention
- Assets. Kept for as long as your account is active. Deleted within 30 days of account cancellation or asset deletion. Cloudflare R2's lifecycle rules also purge old multipart upload parts on a 7-day cadence.
- Account data. Kept while the account exists. Permanently removed within 30 days of an account deletion request.
- Audit logs. Kept for 12 months, then deleted.
- Billing records. Kept as long as US tax law requires (currently 7 years for invoices), held by Stripe under their retention rules.
- Backups. Database snapshots roll on a 7-day window. A deleted record can persist in a snapshot until the snapshot itself rolls off.
7. Your rights
Whether you're covered by the EU's GDPR, California's CCPA, or neither, we honor the same rights for every Atlas Photo user:
- Access. You can request a copy of the personal data we hold about you.
- Correction. You can update your name and email from Settings, or email us if you need help.
- Deletion. You can delete your account from Settings, or email us. We'll purge your data within 30 days, minus records we're legally required to keep (tax history, fraud-prevention logs).
- Portability. You can export your assets and metadata at any time from the dashboard. Workspace exports include the file contents plus a JSON dump of the metadata.
- Objection. You can object to specific processing activities (for example, transactional email) by emailing us. Some processing is necessary to run the service and can't be opted out of without closing the account.
- Complaint. EU residents may lodge a complaint with their national data protection authority.
To exercise any of these rights, email support@atlas-photo.com from the address on your account. We'll respond within 30 days.
8. Children
Atlas Photo is a B2B tool. It is not directed at, and we do not knowingly collect data from, anyone under 13 (or under 16 where local law sets a higher threshold). If you believe a child has signed up for Atlas Photo, email us and we'll remove the account.
9. International data transfers
Atlas Photo is operated from the United States and our subprocessors store data in US and EU regions. If you're in the European Economic Area, your data is transferred to the US under Standard Contractual Clauses with each subprocessor.
10. Security
We use TLS for every connection between you, Atlas Photo, and our subprocessors. Passwords are hashed with bcrypt. Database connections are encrypted. API keys are stored hashed with a one-time-shown plain value at creation. Access to production infrastructure is limited to the operator. No system is perfectly secure, and we can't guarantee zero breaches, but we treat security as a first-class concern.
11. Changes
If we make a material change to this policy, we'll notify active users by email and post a banner inside the app at least 14 days before the change takes effect. Non-material changes (typo fixes, clarifications) update the “Last updated” date at the top of this page without further notice.
12. Contact
Questions, requests, or concerns: support@atlas-photo.com.