Privacy Policy

The controller of personal data processed through Atlas is:

Controller

NSAT SARL (Nouvelle Société d'Affaires et de Transactions)

Address

05 BP 2387 ABIDJAN 05, Côte d'Ivoire

RCCM

CI-ABJ-2017-B-15826

Tax identification number

1728777N

Legal representative

ALIOU MAGUIRAGA, Managing Director

Email

support@validatlas.com

Telephone

+225 05 05 33 44 64

Website

validatlas.com

This Privacy Policy explains what personal data Atlas processes, why it is processed, which service providers may be involved, and the rights available to users.

Atlas applies principles of necessity, proportionality, security and transparency when processing personal data.

Depending on use of the service, Atlas may process:

A. Account data

• name;
• email address;
• technical account identifier;
• authentication-related information;
• interface language;
• plan or subscription status.

Passwords are managed through Supabase authentication. Atlas does not display or store users' plaintext passwords in its business application data.

B. Business idea and project data

Users may provide:

• descriptions of ideas or projects;
• business sector;
• intended market or customers;
• business model;
• questionnaire responses;
• positioning information;
• offer and pricing information;
• acquisition strategy;
• other information voluntarily entered into service fields.

This information may contain personal data where a user chooses to include it.

Users should avoid providing sensitive or unnecessary personal information about themselves or third parties.

C. Atlas-generated results

Depending on the features used, Atlas may retain:

• diagnostics;
• Atlas Score™;
• pillar scores;
• verdicts and confidence levels;
• reports;
• strengths, weaknesses and risks;
• action plans;
• Positioning;
• Offer & Pricing;
• Acquisition;
• related versions and reanalyses.

D. Subscription information

Atlas may retain:

• subscription status;
• technical Paddle identifiers required to reconcile the subscription;
• plan;
• currency;
• current subscription period;
• cancellation or renewal status where available.

Atlas/NSAT SARL does not directly store full card numbers, CVVs or other complete payment card credentials used during checkout.

E. Technical information

Use of the service may generate technical information such as:

• IP address or a technical/hashed representation depending on the service;
• request date and time;
• requested URL or page;
• browser type or user-agent;
• information required for security, error diagnosis and infrastructure operation.

Data may be processed to:

• create and secure user accounts;
• authenticate users;
• provide the Atlas service;
• analyze submitted responses;
• generate diagnostics, reports and modules;
• retain history and versions;
• enable reanalysis;
• manage quotas and access rights;
• manage subscriptions;
• provide requested exports and features;
• maintain security and prevent abuse;
• diagnose technical errors;
• respond to support requests;
• enable users to exercise data protection rights;
• comply with applicable legal obligations.

Certain Atlas features use the OpenAI API.

When generating results, Atlas may send OpenAI information necessary for the requested analysis, including:

• questionnaire responses;
• project descriptions;
• positioning information;
• offer and pricing information;
• acquisition information;
• relevant context from preceding modules.

Atlas does not intentionally send a user's name, email address, Atlas user identifier or Paddle identifiers to OpenAI solely to identify the user.

However, free-text fields may themselves contain information that identifies a person.

Atlas currently uses OpenAI API services with project residency set to “Global”.

According to OpenAI's published policies, business/API data is not used to train its models by default unless the customer explicitly opts in.

Under the standard API configuration currently applicable, OpenAI may retain API inputs and outputs for up to 30 days for service provision and abuse monitoring, unless a legal requirement or different contractual configuration applies.

Atlas also records counting data about generations, for technical monitoring and cost control:

• module concerned;
• model used;
• input token count;
• output token count;
• total token count;
• call type.

This monitoring records no request content and no response content.

Users should avoid entering sensitive or confidential information that is not necessary for the requested analysis.

Atlas relies in particular on:

Supabase

Supabase

Purpose: authentication; database infrastructure; functions associated with Atlas data storage.

The primary region currently configured for the Atlas database is EU Central (Frankfurt), Germany.

This primary database location does not necessarily mean that every technical processing activity performed by the provider occurs exclusively in Germany.

OpenAI

OpenAI

Purpose: AI generation and analysis.

Atlas project residency currently configured: Global.

Paddle

Paddle

Purpose: payment; subscription management; invoicing and related functions.

Paddle acts as Merchant of Record for relevant transactions.

Paddle may directly process information necessary for payment, billing, tax obligations, fraud prevention and transaction-related support.

Full payment card details are processed within Paddle's payment environment and are not directly stored by Atlas.

Lovable and Cloudflare

Lovable · Cloudflare

Purpose: application publishing and hosting; network distribution; serverless execution; application security and operation.

This infrastructure may be geographically distributed.

Atlas does not currently have a basis for stating that all such processing takes place exclusively within one region.

Use of Atlas may involve processing or transfers of personal data outside Côte d'Ivoire and, depending on the provider, outside the European Economic Area.

This may involve infrastructure and services provided by Supabase, OpenAI, Paddle, Lovable and Cloudflare.

Relevant providers may use contractual mechanisms and safeguards applicable to international transfers under their respective legal and regulatory commitments.

Atlas does not represent that its entire infrastructure is located exclusively in Côte d'Ivoire or the European Union.

Atlas applies the following principles:

Account and Atlas content: retained for as long as necessary to provide the service and while the user keeps the relevant data in their account, subject to applicable legal obligations.

Diagnostic deletion: when a user deletes a diagnostic through Atlas, application data associated with that diagnostic is deleted according to the service architecture.

Account deletion: when account deletion is permitted and confirmed, Atlas deletes application data associated with the account through its account-deletion process.

An active subscription may need to end before account deletion can be completed.

Information Paddle must retain for its own contractual, accounting, tax, anti-fraud or legal obligations may not necessarily be deleted when an Atlas account is deleted.

Infrastructure providers may also temporarily retain certain technical information, logs or backups according to their own policies and obligations.

OpenAI: under the standard API configuration currently used, API inputs and outputs may be retained for up to 30 days, subject to applicable exceptions or legal requirements.

Atlas does not promise a specific retention period for a provider's logs or backups where that period is not controlled or demonstrably known by NSAT.

Atlas uses browser local storage for certain service functions, including:

• session/authentication maintenance;
• language preference;
• drafts or temporary states required for Atlas functionality.

During normal sign-out, Atlas clears account-related Atlas local data according to its privacy mechanism while the language preference may remain.

Account deletion performs a more complete purge of Atlas local state.

Cloudflare infrastructure may set the technical __cf_bm cookie used for bot detection and mitigation.

According to Cloudflare documentation, this cookie is necessary for its bot protection solutions and expires after approximately 30 minutes of inactivity.

Atlas performs an internal, aggregated audience measurement carried out server-side only, with no cookie and no tracking script in the browser.

For each page viewed, Atlas increments a counter storing only: the calendar day, the normalized page path (without query parameters or identifiers), the two-letter country code provided by Cloudflare, and a view count.

No IP address, visitor identifier, user agent, account identifier or user content is stored by this measurement. Atlas does not compute unique visitors.

These counters do not, on their own and by reasonable means, allow a person to be re-identified. They nevertheless rely on the transient processing of a request and of approximate location data provided by Cloudflare: Atlas therefore does not claim this processing is entirely unrelated to any person.

These aggregated statistics are accessible only to the Atlas administrator.

Atlas uses Meta Pixel for the existing PageView and CompleteRegistration events and adds QuestionnaireStarted when the Africa questionnaire starts. This new event sends Meta its name, a technical event ID and information processed by Pixel (page, browser, IP address and any cookies), never questionnaire answers, account name or email. It measures ads and may support ad optimization after configuration in Meta. Atlas does not use Google Analytics, TikTok Pixel, Hotjar or PostHog.

Without a new banner, QuestionnaireStarted is blocked in the EEA, the UK, Switzerland and when the country is unknown. Elsewhere it honors Global Privacy Control and Do Not Track: enable these browser signals to opt out of future sends of this event. This block applies only to the new event; existing tracking is unchanged.

For privacy or objection requests, contact support@validatlas.com. Any future measurement requiring advertising consent must retain evidence of the choice and allow withdrawal before activation.

NSAT implements technical and organizational measures intended to protect data processed through Atlas.

These include:

• user authentication;
• access controls;
• database-level security policies;
• separation of user data;
• limitation of client-side data exposure;
• server-side management of keys and secrets;
• verification of payment communications;
• application log minimization;
• data export and deletion procedures.

No information system can guarantee absolute security.

Depending on applicable law, users may have rights relating to their personal data, including:

• right to information;
• right of access;
• right to rectification;
• right to object where applicable;
• right to erasure/deletion where applicable.

Atlas provides, among other things:

• viewing account name and email;
• changing the account name;
• a secure email-change process;
• Atlas data export;
• diagnostic deletion;
• account deletion, subject in particular to the status of an active subscription.

For requests or assistance:

Email

support@validatlas.com

NSAT may request information reasonably necessary to verify the identity of a person before acting on a personal-data request.

Users should not provide personal information about third parties where it is unnecessary or where they do not have the right to use that information.

Users remain responsible for information they choose to enter in free-text fields.

Atlas may be used from multiple countries.

Where mandatory data-protection rules applicable to a user provide additional rights, those rights remain available in accordance with applicable law.

This policy may be updated to reflect:

• changes to the service;
• changes in service providers;
• new features;
• regulatory developments.

The latest update date is shown at the top of this page.

For privacy questions or to exercise a data protection right:

Email

support@validatlas.com

Address

NSAT SARL, 05 BP 2387 ABIDJAN 05, Côte d'Ivoire

Telephone

+225 05 05 33 44 64