Privacy Policy

The Service is operated by the Operator. AtlasAI is the consumer-facing product name of the Service; it is not a separate company. For privacy inquiries, contact hello@weareatlas.ai. Our public website is https://weareatlas.ai.

“Operator,” “we,” “us,” and “our” mean the natural person or legal entity that operates the AtlasAI service, publishes the mobile application, is listed as the developer or seller on the applicable app marketplace (for example the Apple App Store), and is contactable at hello@weareatlas.ai. AtlasAI is a product name only and is not a separate legal entity. The Operator may update its registered business name or transfer the Service to a successor; continued use after notice constitutes acceptance to the maximum extent permitted by law.

This Policy applies to personal information we process as a controller (or equivalent) in connection with the Service. For certain group-trip features, users invite others and post content; in those cases, the inviting user and trip members may also determine how information is shared inside a trip. We are not responsible for how other users process, copy, screenshot, or further disclose information they obtain through the Service. Other users’ privacy practices are outside our control.

The Service is not directed to children under the minimum age stated in our Terms. We do not knowingly collect personal information from children below that age.

This Policy does not apply to third-party websites, apps, booking sites, map providers, app stores, or services that we do not control, even if linked from the Service.

We collect information in the categories below, depending on how you use the Service. Not all categories apply to every user (for example, waitlist-only visitors provide less data than active trip members).

Account and identity. Email address; display name or handle; profile photo or avatar you upload; authentication tokens and magic-link session data; account settings and preferences (including language).

Waitlist and marketing site. Email address; signup source; referrer URL; user-agent; approximate network metadata used for abuse prevention (such as IP-derived rate limiting).

Trip and group content. Trip names, destinations, dates, itineraries, notes, votes, RSVP/commitment states, deposits or contribution records you enter, chat messages (including messages directed to @Atlas), attachments, photos, maps pins, and other user-generated content you or trip members create.

Expenses and settlement data. Amounts, currencies, payers, split rules, IOUs, settlement status, and related free-text notes. This information is provided by users for coordination; unless we expressly state otherwise, we are not a bank, money transmitter, or payment processor for peer-to-peer settlements between travelers.

Location and map data. Precise or approximate location if you grant device permission; map search queries; place selections; route and navigation-related inputs. Location permission is optional where the platform allows, but some mid-trip features may not work fully without it.

Device and usage. Device type, OS version, app version, language, time zone, crash logs, performance diagnostics, feature interaction events, and similar analytics needed to operate, secure, and improve the Service.

Communications. Support requests, feedback, abuse reports, and email correspondence with us.

Payments for our Service (if offered). If you purchase a subscription or paid feature through Apple, Google, or another platform, those platforms process payment instruments. We typically receive transaction identifiers, product identifiers, and entitlement status—not full card numbers.

AI interaction content. Prompts, trip context, and messages you send to Atlas (our AI copilot), and model outputs returned in the Service. See Section 7.

• You, when you create an account, join the waitlist, complete forms, or post content.
• Other users, when they invite you, mention you, add you to a trip, or share content that includes your information.
• Your device and the Service automatically, through logs, SDKs, cookies or similar technologies, and permissions you grant.
• Service providers and platforms (for example App Store receipt validation, map providers, cloud infrastructure, analytics, email delivery).
• Public or third-party sources only if needed to provide a feature you request (for example place metadata for a destination you select).

We use information to:

• Provide, operate, maintain, and improve the Service (including group planning, chat, maps, itineraries, expense ledgers, and AI assistance).
• Authenticate users, maintain sessions, and secure accounts (including magic-link sign-in).
• Personalize content and surface relevant trip context (for example live trip vs upcoming trip).
• Process waitlist requests and send operational messages (invite readiness, security notices, service changes).
• Communicate about the Service, including support responses and important product or legal notices.
• Monitor, prevent, and investigate fraud, abuse, spam, security incidents, and violations of our Terms.
• Comply with law, enforce our agreements, and protect rights, safety, and property of users and the Operator (as defined above).
• Develop new features; de-identify or aggregate data for analytics, research, and product improvement where permitted by law.
• Process transactions and manage entitlements if paid features are offered.

We do not sell your personal information for money. We do not share personal information for cross-context behavioral advertising as those terms are commonly defined under U.S. state privacy laws, unless we update this Policy and provide any required opt-out mechanism before doing so.

We may create de-identified, anonymized, or aggregated data from personal information. Once data is de-identified so it is no longer personal information under applicable law, we may use and disclose it for any lawful purpose without further notice or consent, to the maximum extent permitted by law, and we will maintain it in de-identified form and not attempt to re-identify it except as permitted by law.

Where required (including GDPR/UK GDPR and Brazil’s LGPD), we process personal information under one or more of: (a) performance of a contract with you or steps at your request before a contract; (b) legitimate interests (security, fraud prevention, product improvement, limited analytics, defending claims, network integrity) balanced against your rights; (c) consent (for example certain device permissions, optional marketing where required); (d) legal obligation; and (e) establishment, exercise, or defense of legal claims. You may withdraw consent where processing is consent-based, without affecting prior lawful processing.

Where automated processing (including AI features) helps personalize or generate content, we do not make solely automated decisions that produce legal or similarly significant effects about you without a lawful basis and any required human review. Trip suggestions and AI chat are assistive tools, not credit, employment, or similar regulated decisions.

AtlasAI includes Atlas, an AI copilot that can read trip context you and your crew make available (for example itinerary items, chat, destinations) and generate suggestions, re-routes, summaries, or other outputs.

• AI outputs may be incomplete, outdated, biased, or wrong. They are not professional travel, legal, medical, safety, immigration, or financial advice.
• You should independently verify critical information (visas, opening hours, prices, transport, safety, accessibility, weather, and local rules) before relying on it.
• We may use third-party model providers to generate outputs. Content you send to Atlas may be processed by those providers solely to provide the feature, subject to our contracts with them and applicable law.
• We may use de-identified or aggregated interaction data to improve the Service. We do not use your private trip content to train public foundation models for unrelated third parties unless we obtain a lawful basis and update this Policy if required.
• Do not submit sensitive personal data (for example government ID numbers, precise health data, or payment card numbers) to Atlas unless a specific product feature expressly requires it and discloses the purpose.
• We are not responsible for personal data other trip members include about you in prompts, notes, expenses, or chat. If you believe another user has posted your data improperly, contact us and the trip members as appropriate.
• AI providers may process content in jurisdictions outside your country subject to Section 9 (international transfers).

We may share information as follows:

• Trip members and invitees: content and activity inside a trip are visible to members of that trip according to product permissions. If you join a group, other members will see information you contribute.
• Service providers: cloud hosting, databases, email, analytics, crash reporting, maps/geocoding, AI inference, customer support tooling, and similar processors under contractual confidentiality and use limits.
• Platform providers: Apple, Google, and similar stores for distribution, payments, and fraud prevention.
• Legal and safety: if we believe disclosure is required by law, regulation, legal process, or governmental request, or is reasonably necessary to protect rights, safety, or security.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality.
• With your direction: when you use sharing features, export data, or ask us to send information to a third party.

We do not control third-party websites, booking sites, maps basemaps, or services you open from the Service. Their privacy practices govern those experiences.

We may process and store information in the United States and other countries where we or our providers operate. Those countries may have different data-protection laws than your home country. Where required, we use appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) for cross-border transfers.

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security. Retention periods vary by data type. For example, account data is generally kept while your account is active; waitlist emails may be kept until you request removal or we close the list; security logs may be kept for a limited period; and backups may persist for a short additional window.

When you delete content or your account, residual copies may remain in backups or caches for a limited time, and we may retain certain information if required by law or for legitimate dispute-resolution and fraud-prevention purposes.

We implement technical and organizational measures designed to protect personal information (for example encryption in transit, access controls, and rate limiting). No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Responsibility as between you and us for the Service, including any limitations of liability, is governed by our Terms of Service.

You are responsible for safeguarding devices and access to your email inbox used for magic-link authentication, for using the Service only on devices you control or trust, and for promptly notifying us of suspected compromise. We may suspend accounts we reasonably believe are compromised.

If a personal data breach occurs that requires notification under applicable law, we will notify you and/or regulators as required by law, using the contact information associated with your account when notice to individuals is required.

Depending on your location, you may have rights to access, correct, delete, port, restrict, or object to certain processing of your personal information, and to withdraw consent. You may also have the right to appeal a denial and to lodge a complaint with a supervisory authority.

To exercise rights, email hello@weareatlas.ai from the address associated with your account (or waitlist signup) and describe your request. We may need to verify your identity. We will not discriminate against you for exercising rights available under applicable law.

Account deletion. You may request deletion of your account via in-app settings (when available) or by emailing support. Deletion removes or de-identifies personal data associated with your account subject to legal retention needs. Content you posted in shared trips may remain visible to other members in anonymized or residual form (for example a historical expense you created that other members still need for settlement), or may be deleted depending on product design and group ownership rules.

Device permissions. You can revoke location, notifications, photos, or similar permissions in OS settings. Doing so may limit features.

Marketing. Transactional and service messages are not marketing. Where we send optional marketing, you can unsubscribe via the message or by contacting us.

Do Not Track. The Service does not currently respond to browser DNT signals in a uniform way; we manage cookies and similar technologies as described here and in any cookie notice we publish.

Cookies and similar technologies. We and our providers may use cookies, local storage, pixels, SDKs, and similar technologies for authentication, preferences, security, analytics, and performance. You can control some cookies through browser or OS settings; blocking them may break sign-in or other features.

We may deny requests that are unfounded, excessive, require disproportionate effort, conflict with legal obligations, or risk the rights of others (including other trip members’ legitimate interest in shared ledgers). We may charge a reasonable fee where permitted by law for excessive or repetitive requests.

If you are a resident of California or another U.S. state with a comprehensive privacy law, this section supplements the rest of this Policy.

Categories collected (last 12 months, as applicable): identifiers (email, IP, device IDs); customer records (account profile); commercial information (subscription entitlements if any); internet/network activity (usage logs); geolocation data (if permitted); sensory data (user-uploaded images); inferences limited to product personalization; and user content you provide. We collect these categories from the sources and for the purposes described above. We disclose these categories to service providers and as otherwise described in Section 8.

We do not “sell” personal information for monetary consideration. We do not “share” personal information for cross-context behavioral advertising unless we update this Policy and provide required opt-outs. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA beyond what is necessary to provide the Service you request.

To exercise access, deletion, correction, or appeal rights, contact hello@weareatlas.ai. Authorized agents may submit requests with proof of authority as permitted by law. We verify requests using account and contact information we already hold. We will respond within the time required by applicable law.

California “Shine the Light.” We do not disclose personal information to third parties for their own direct marketing purposes in a manner that would require a separate Shine the Light list under California Civil Code § 1798.83. If that changes, we will update this Policy and honor applicable requests.

The Service is not intended for children under 16. If you believe we have collected personal information from a child under 16, contact hello@weareatlas.ai and we will take appropriate steps to delete it.

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where required, provide additional notice (for example in-app or by email). Continued use of the Service after the effective date of changes constitutes acceptance of the revised Policy, to the maximum extent permitted by law. If you do not agree, stop using the Service and request account deletion.

Privacy questions and rights requests: hello@weareatlas.ai

General support: hello@weareatlas.ai

Website: https://weareatlas.ai

Controlling language. The English version of this Privacy Policy controls. Any translation is provided for convenience only.