Privacy Policy

LAST UPDATED: JUNE 2026

This Privacy Policy explains how Atlas Capitalis ("Atlas Capitalis", "we", "us", or "our") collects, uses, shares, and protects your personal data when you visit atlascapitalis.com, create an account, or receive our daily brief (together, the "Service"). It also describes the rights you have over your data. Please read it alongside our Terms of Service.

We act as the data controller for the personal data described in this policy. If you have any question about it, you can reach us through the contact page.

1. Who this policy applies to

This policy applies to everyone who uses the Service, wherever you are located. Atlas Capitalis is operated from the United Kingdom, so we apply the standards of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 as our baseline. Where the EU GDPR, or the privacy laws of your own country, give you additional rights, we seek to honour those too. If you access the Service from outside the UK, you understand that your data will be processed in the UK and other countries as described in this policy.

2. What we collect

We deliberately keep the data we collect to the minimum needed to run the Service:

• Account data: your email address and a securely hashed password, created when you sign up. We do not store your password in readable form.
• Watchlist data: the stock tickers you choose to follow, so we can assemble your brief.
• Subscription and billing data: if you take a paid plan, our payment processor collects and processes your payment details. We receive only limited information such as your plan, billing status, and the last four digits and type of your card. We never see or store your full card number.
• Communication data: any message you send us through the contact page or by email, and our replies.
• Technical data: a session token stored in your browser so you stay logged in, your IP address, and standard server and email-delivery logs (for example, whether an email was delivered or bounced).

3. How we use your data, and our legal bases

Where UK or EU GDPR applies, we rely on the following legal bases:

• To provide the Service (sending your brief, saving your watchlist, keeping you logged in, and operating any paid plan): performance of our contract with you.
• To take and manage payments: performance of our contract, and compliance with our legal and accounting obligations.
• To respond to your messages and provide support: our legitimate interest in helping users, and performance of our contract.
• To keep the Service secure and prevent abuse or fraud: our legitimate interest in protecting the Service and our users.
• To send service messages (such as confirmations, password resets, and important notices): performance of our contract.

We do not sell your personal data, we do not share it with advertisers, and we do not use it to build advertising profiles of you.

4. The daily brief and automated analysis

Your brief summarises publicly available news about the stocks on your watchlist. We gather that news from public sources and use automated tools, including AI language models, to summarise it and describe the general tone of coverage. This processing is driven by the tickers you choose. It is not used to make decisions that produce legal or similarly significant effects about you as an individual, and it is not used to profile you. The content of the brief is general information only and is not personal advice. Please see our Terms of Service for the full position on this.

5. Who we share data with

We use a small number of trusted providers ("processors") to operate the Service. Each processes data on our behalf under appropriate data-processing terms:

• Supabase stores your account, watchlist, and authentication data.
• Resend delivers our emails, including confirmations, password resets, and your daily brief.
• Hostinger provides website hosting and infrastructure.
• Our payment processor (for example, Stripe) handles payments if you take a paid plan, acting as an independent controller of your payment data under its own privacy policy.

We share your data with these providers only as needed to run the Service. We may also disclose data where we are required to do so by law, to enforce our Terms, or to protect the rights, safety, or property of our users or ourselves. If the Service is ever transferred to another owner, your data may be transferred as part of that, subject to this policy.

6. International data transfers

Because we and our providers operate across different countries, your data may be stored and processed outside your home country, including in the United Kingdom, the European Economic Area, and the United States. Where data leaves the UK or EEA, we rely on recognised safeguards for those transfers, such as adequacy decisions or standard contractual clauses, so that your data continues to be protected to an equivalent standard.

7. How long we keep it

We keep your account and watchlist data for as long as your account is active. If you delete your account, we remove your personal data from our active systems within a reasonable period, except where we are required to keep limited records (for example, billing and tax records) for a period set by law. Backups are overwritten on a rolling basis.

8. Your rights

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data (the "right to erasure").
• Restrict or object to certain processing.
• Receive a copy of your data in a portable, machine-readable format.
• Withdraw consent at any time, where we rely on consent.
• Unsubscribe from the brief at any time using the link in every email.

To exercise any of these, contact us through the contact page. We will respond within the time required by the law that applies to you. If you are in the UK, you also have the right to complain to the Information Commissioner's Office (ICO). If you are in the EEA, you may complain to your local data protection authority.

9. Cookies and local storage

We do not use advertising or third-party tracking cookies. We use a single item of browser storage to keep you securely logged in between visits. Removing it simply logs you out. Our payment processor may set its own cookies during checkout, governed by its own policy.

10. Security

Passwords are hashed and never stored in readable form. Access to your account data is protected by row-level security so that you can only read and change your own records. We use encryption in transit. No online service can be guaranteed perfectly secure, but we take reasonable technical and organisational measures to protect your information, and we will notify you and the relevant authority of a data breach where the law requires it.

11. Children

The Service is intended for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you by email. Continuing to use the Service after a change means you accept the updated policy.

13. Contact

For any privacy question or request, reach us through the contact page. You may also write to us at the contact details we publish there.