This Privacy Policy explains what data Atlas Photo collects, why we collect it, who we share it with, and the rights you have over it.
1. Who we are
Atlas Photo is a digital asset management service based in Utah, USA. For any question, request, or complaint about this policy, email support@atlas-photo.com.
In this policy, “Atlas Photo,” “we,” “us,” and “our” refer to the service and the team operating it. “You” refers to the person using the service, whether as a workspace owner, an invited team member, someone uploading through a workspace's upload link, or a visitor to atlas-photo.com.
2. What we collect
- Account information. Your email address and display name. If you sign in with Google or GitHub, we receive your name, email, and profile image from that provider. If you sign in with an email and password, the password is hashed with bcrypt before it is stored.
- The files you upload. Your photos and videos plus the details you attach to them: file names, tags, alt text, collections, and folders. When someone uploads through a workspace's upload link, we also keep the name they enter.
- Activity in your workspace. An audit log of uploads, deletes, exports, invitations, and permission changes, used for security review and the activity feed.
- Connected accounts. If you connect Dropbox, Google Drive, or Shopify, we store the access token that service gives us so we can import from it or send images to your store.
- Usage and performance data. Pages viewed, features used, and page load timings, tied to your user and workspace IDs. We use this to see which features work and to find slow pages. It is never sold or used for advertising.
- Payment metadata. Your Stripe customer ID, your subscription state (plan, status, period end), and the email Stripe has on file. Card numbers, CVCs, and billing addresses stay with Stripe; we never see or store them.
- Messages you send us. Support emails and feature requests, along with your name and email so we can reply.
3. How we use it
Strictly to operate Atlas Photo. That means:
- Running the service: storing your files, showing them to the people in your workspace, keeping you signed in, and making your library searchable.
- Sending email through Resend: workspace invitations, the welcome email if you join the waitlist, and a follow-up if you try the live demo and then sign up. Receipts and invoices come from Stripe.
- Billing you through Stripe: charging your card on the cadence you picked, sending invoices, handling refunds.
- Providing support. When you report a problem, or when we need to fix one, the operator may open your workspace to see what you see. That access is limited to the operator and is logged.
- Detecting and preventing abuse, fraud, or violation of our Terms of Service.
- Complying with legal obligations (tax records, valid law-enforcement requests).
We do not sell your data. We do not share it with advertisers. We do not train AI models on your files or anything else you put in Atlas Photo. We do not use your data for any purpose unrelated to operating Atlas Photo.
How the AI features work. Alt text and image search run on models inside Atlas Photo's own servers. These library features do not send your photos to an outside AI service. A few text features use Groq to understand language: smart search sends your search query, Ask Atlas sends your question with the names, alt text, and tags of matching photos, and smart filters send alt text and tags. Groq does not receive your images.
Studio requests and workspace boundaries
When you use Studio, we send the instructions and reference media needed for your request to its orchestration and media-generation providers. This can include the text, images, video or audio you choose for that request. This processing creates or edits the assets you requested.
Studio retrieves private content only from your authorized workspace. Another customer's files, avatars, projects, conversations and private production recipes are not available to your orchestrator. Content you explicitly share remains subject to the sharing permissions you choose.
Anonymous method learning
Learning which production methods work is a core part of delivering and improving Studio's output quality. Our shared method library contains company-authored techniques and anonymous aggregate counts of method attempts and successful outcomes. For example, it can learn that separating reference roles or checking an output against a measured guide improves a workflow.
Shared learning contains fixed method identifiers and aggregate counts. It excludes your files, generated media, prompts, descriptions, project content, names, account identifiers, conversation identifiers, asset identifiers, links and private recipe records. It does not reveal what you created or requested. Your workspace's private recipes remain scoped to that workspace and its authorized users.
This method learning helps the orchestrator select and check production techniques. It does not use your creative content to train shared model weights or give another account access to your content. Normal creation replies focus on the assets being made; these background operations are described here so you can understand how Studio improves.
4. Who we share it with
To run Atlas Photo, we send certain data to a short list of vendors (subprocessors). Each handles your data only to provide its service to us and is required to keep it secure.
- Vercel hosts the Atlas Photo web application and provides page-view analytics.
- Cloudflare stores your files and their backup copies in R2 and delivers them to your browser.
- Neon runs the PostgreSQL database that holds your account, workspace, file details, and audit log.
- Upstash provides the Redis instance used for rate limiting and sign-out, and the queue that processes new uploads.
- Groq processes the text described in section 3 for smart search, Ask Atlas, and smart filters.
- Studio inference and generation providers. Depending on the models selected for your request, Studio uses OpenAI, Anthropic, Google and Kie.ai. They receive the instructions and reference content needed to provide that requested inference or generation. This request processing is separate from Atlas Photo's anonymous method learning.
- PostHog receives product usage events tagged with user and workspace IDs. Session recording is off.
- Better Stack stores application logs we use to find and fix errors.
- Hetzner hosts our operations server in Oregon, which runs maintenance jobs such as the nightly database backup and receives error reports.
- Resend sends the emails listed in section 3.
- Stripe processes payments, stores card details, handles tax calculation, and issues invoices.
If you connect Dropbox, Google Drive, or Shopify, we exchange data with that service on your instruction: reading the files you pick to import, or adding the images you choose to your Shopify products. You can disconnect any of them in Settings.
Anyone you share a link with can see what that link contains until it expires or you revoke it.
We may also disclose data if compelled by valid legal process (a subpoena, court order, or law-enforcement request that we've reviewed for validity), or if Atlas Photo is involved in a merger, acquisition, or sale of assets. In the latter case we'll notify affected users by email before any transfer takes effect.
YouTube connections
If you connect YouTube in Social, we receive and store your channel ID, name, handle, and profile image URL. We store the authorization credentials that let Atlas access that channel in encrypted form. We use this data to identify your connected channel and check whether the connection still works.
When you publish or schedule a YouTube post, Atlas sends YouTube the video you selected from your library, its title and description, and the connection's visibility setting. If you remove a published video through Atlas, we send YouTube a request to delete that video. Your workspace keeps publishing records, including video IDs, links, status, and errors.
You can revoke Atlas's access in your Google Account connections. Revoking access does not delete videos already published to YouTube or the publishing records in Atlas. Contact support@atlas-photo.com to request deletion of data held by Atlas.
5. Cookies and browser storage
Atlas Photo uses first-party cookies and your browser's local storage. None are for advertising, retargeting, or cross-site tracking.
- Sign-in. A session cookie keeps you signed in, and another remembers which workspace you have open. A support session cookie is set only while the operator is viewing a workspace to help with a problem, and it expires within 8 hours.
- Preferences. Your light or dark theme, sidebar state, library tile size, and similar display choices.
- Uploads. Your browser keeps a list of in-progress uploads, and the files of failed ones, so you can resume them. These stay on your device.
- Connecting services. Short-lived cookies protect the sign-in step when you connect Dropbox, Google Drive, or Shopify.
- Referrals and the demo. If you arrive through a partner's referral link, a cookie remembers that partner for 90 days so they get credit if you subscribe. Taking the live demo sets a cookie so we can follow up after you sign up.
6. Data retention
- Files. Kept for as long as they are in your library. A deleted file stays in your trash for 30 days, where you can restore it, unless you empty the trash sooner. After it leaves the trash, its backup copy is kept for 30 more days and then permanently removed.
- Account and workspace data. Kept while the account exists. Email us to close your account and we'll permanently remove your data within 30 days, minus records we're legally required to keep.
- Audit logs. Kept for as long as the workspace exists.
- Performance data. Page load timings are deleted after 30 days.
- Billing records. Kept as long as US tax law requires (currently 7 years for invoices), held by Stripe under their retention rules.
- Backups. Every original file is copied to a separate storage location within minutes of upload. The database is backed up every night, and each backup is kept for 35 days. A deleted record can remain in a database backup until that backup expires.
7. Your rights
Whether you're covered by the EU's GDPR, California's CCPA, or neither, we honor the same rights for every Atlas Photo user:
- Access. You can request a copy of the personal data we hold about you.
- Correction. Email us and we'll correct your name, email, or anything else we hold about you.
- Deletion. Email us from the address on your account and we'll delete your account and data within 30 days, minus records we're legally required to keep (tax history, fraud-prevention logs).
- Portability. You can download your original files at any time from the library, in bulk or one by one.
- Objection. You can object to specific processing activities (for example, follow-up emails) by emailing us. Some processing is necessary to run the service and can't be opted out of without closing the account.
- Complaint. EU residents may lodge a complaint with their national data protection authority.
To exercise any of these rights, email support@atlas-photo.com from the address on your account. We'll respond within 30 days.
8. Children
Atlas Photo is a B2B tool. It is not directed at, and we do not knowingly collect data from, anyone under 13 (or under 16 where local law sets a higher threshold). If you believe a child has signed up for Atlas Photo, email us and we'll remove the account.
9. International data transfers
Atlas Photo is operated from the United States, and your data is held by US-based providers in North American data centers. If you're in the European Economic Area, your data is transferred to the US under Standard Contractual Clauses with each subprocessor.
10. Security
Every connection between you, Atlas Photo, and our subprocessors uses TLS, and stored files and the database are encrypted at rest. Passwords are hashed with bcrypt, and API keys are stored hashed and shown only once, when they're created. Each workspace's files are kept separate from every other workspace, and roles control who can upload, delete, or manage the team. Backups live in a separate location that is locked against deletion for 30 days. Access to production systems is limited to the operator. No system is perfectly secure, and we can't guarantee zero breaches, but we take care to protect your files and will tell you promptly if your data is ever affected.
11. Changes
If we make a material change to this policy, we'll notify active users by email and post a banner inside the app at least 14 days before the change takes effect. Non-material changes (typo fixes, clarifications) update the “Last updated” date at the top of this page without further notice.
12. Contact
Questions, requests, or concerns: support@atlas-photo.com.