Privacy Policy

This Privacy Policy explains how mlxar GmbH, trading as Atlas (“Atlas,” “we,” “our,” or “us”), collects, uses, shares, and protects your personal data when you visit our website at atlas.design (the “Website”) and when you use the Atlas platform at app.atlas.design and its APIs (together with the Website, the “Service”).

We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). By using the Service, you acknowledge the practices described in this Privacy Policy.

1. Who We Are

2. Information We Collect

We collect the following categories of information:

a. Account Information

• Name, email address, and login credentials, and the sign-in method you use (email and password, or an identity provider such as Google or Apple).
• Billing and payment details, processed through our payment provider. We do not store full card numbers.

b. Workflow & Usage Data

• Prompts, configurations, reference material, and workflow designs you provide.
• Assets generated through the Service and stored in your workspace.
• Metadata about workflows (timestamps, API calls, node executions, credit usage, performance logs).
• System-generated logs (e.g., errors, usage analytics).

c. Third-Party Services

When you connect third-party APIs or services to the platform, Atlas may collect:

• API keys or tokens (if provided).
• Logs of API calls initiated through the Service.
• Metadata on third-party responses (not necessarily the full output unless stored as part of the workflow).

d. Device & Technical Data

• IP address, browser type, operating system, screen size, and device identifiers.
• Cookies and similar technologies for authentication, preferences, and analytics.

e. Website Visit & Marketing Data

• Pages viewed, referring website, and the campaign parameters in the link you arrived with (for example utm_* values and advertising click IDs).
• Your cookie consent choice.
• Your country, derived from your IP address by our hosting provider, used only to decide whether the consent banner must be shown.

3. How We Use Your Information and On What Legal Basis

We use collected data to:

• Provide, operate, and improve the Service, including executing your workflows and managing API integrations (performance of a contract, Art. 6(1)(b) GDPR).
• Authenticate users, secure accounts, and monitor misuse, fraud, or violations of our Terms (legitimate interests, Art. 6(1)(f) GDPR).
• Analyze usage trends to improve system performance and product design (legitimate interests, Art. 6(1)(f) GDPR, and, where cookies are involved, your consent).
• Measure the reach of our marketing campaigns and reach people who have visited the Website with relevant ads (consent, Art. 6(1)(a) GDPR and §165 para. 3 TKG 2021).
• Send service announcements and, where you have opted in, product news. You can unsubscribe from product news at any time.
• Comply with legal obligations such as tax and accounting law (Art. 6(1)(c) GDPR).

Unless explicitly stated, we do not use your private inputs or outputs for model training.

4. Cookies and Tracking on the Website

Consent: On your first visit from the European Economic Area, the United Kingdom, or Switzerland, the Website shows a banner with two choices, “Accept all” and “Only essential.” No analytics or advertising tool loads before you accept. Your choice is stored in your browser and shared with app.atlas.design so the platform can honour it too. In countries whose law does not require prior consent, these tools run by default and you can opt out as described below.

Essential: The consent record itself (atlas-consent-v1, 180 days, whichever choice you made) and, once you have accepted, a first-party visitor ID (atlas_uid) and campaign attribution cookies (atlas_att, atlas_click). These are set by our own server, live on the atlas.design domain, and are not shared with anyone except the tools you have consented to.

Analytics: PostHog (PostHog Inc.), hosted on PostHog's EU cloud in Frankfurt and loaded through our own subdomain. Records page views, interactions with the Website, and the campaign you arrived from, tied to an anonymous visitor ID that is later linked to your account if you sign up. Cookie lifetime up to 12 months.

Advertising measurement: When you have accepted, the following partners receive events such as “page viewed,” “sign-up started,” and, after you subscribe, “purchase completed.” Where we send an email address, it is hashed (SHA-256) before it leaves our server; we never send prompts, assets, or workflow content.

• Meta Pixel and Conversions API — Meta Platforms Ireland Ltd. Cookies _fbp and _fbc, 90 days. Meta's privacy policy: facebook.com/privacy/policy.
• Google Ads — Google Ireland Ltd. Cookies _gcl_aw and _gcl_au, 90 days. Google's privacy policy: policies.google.com/privacy.
• Reddit Pixel and Conversions API — Reddit, Inc. Cookie _rdt_uuid, 90 days. Reddit's privacy policy: reddit.com/policies/privacy-policy.
• X Pixel — X Corp. Cookie atlas_tw, 90 days. X's privacy policy: x.com/privacy.

Meta, Google, Reddit, and X may combine this data with data they hold about you and process it in the United States; see section 8.

Opting out or withdrawing consent: Clear the cookies and site data for atlas.design in your browser and the banner will ask again on your next visit. You can also block these tools through the partners' own opt-out pages linked above, or write to legal@atlas.design. Withdrawing consent does not affect processing that took place before.

On the platform: app.atlas.design uses strictly necessary cookies for sign-in and session state, and PostHog for product analytics, error reporting, and session replay under the same consent choice. Session replay masks password fields; payment details are entered on pages hosted by Stripe and are never recorded.

5. Sharing of Information

We share information only in the following cases:

• With Third-Party AI and API Providers: When you run a workflow, the prompts, reference material, and assets that node needs are sent to the model or API provider that executes it (for example Google, Meshy, Tripo, Kling, or ElevenLabs, depending on the node; the full list is on our AI Models page) solely to produce your result.
• With Vendors and Service Providers: For hosting (Google Cloud and Firebase for the platform, Vercel for the Website), payment processing (Stripe), transactional email (Resend), analytics and advertising measurement (section 4), and customer support tools. Each is bound by a data processing agreement.
• Within Your Workspace: Workspace owners and members you collaborate with can see the projects, assets, and usage that belong to that workspace.
• For Legal Compliance: To comply with applicable law, enforce our Terms, or respond to legal process.
• Business Transfers: If Atlas is involved in a merger, acquisition, or sale of assets.

We do not sell personal information to third parties.

6. Data Retention

• Account data is retained for as long as your account exists and is deleted when you delete your account, unless a legal obligation requires us to keep it longer.
• Workflow logs and metadata are retained as long as necessary to provide the Service, prevent abuse, and meet legal requirements.
• Invoices and payment records are retained for seven years under Austrian tax law.
• Website cookies expire after the lifetimes stated in section 4; the first-party visitor ID expires after 24 months.
• You may request deletion of your account and associated personal data at any time (subject to legal obligations).

7. Your Rights

Under the GDPR and, depending on your jurisdiction, other laws such as the California CCPA/CPRA, you have the right to:

• Access the personal data we hold about you.
• Request correction, deletion, or restriction of processing.
• Object to processing based on our legitimate interests, including profiling for direct marketing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
• Opt out of sale or sharing of personal information (where applicable).
• Lodge a complaint with a supervisory authority. Ours is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

To exercise these rights, contact us at legal@atlas.design. We respond within one month.

8. International Data Transfers

The platform is hosted in the European Union. Some of our providers, including the advertising partners in section 4 and certain AI model providers, process data in the United States or other countries outside the EEA. Where that happens we rely on the EU–US Data Privacy Framework for certified providers and on the European Commission's Standard Contractual Clauses otherwise.

9. Security

We use reasonable organizational and technical safeguards (encryption in transit and at rest, access controls, monitoring) to protect your information. However, no system is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect data from minors. If we learn that a minor has provided data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The effective date at the top of this page tells you when it was last revised.

12. Contact Us

If you have questions about this Privacy Policy or your data, contact us at: