Atlas Maps Privacy Policy

This Privacy Policy covers personal information processed through:

• atlasmaps.app, the Atlas Maps marketing site, waitlist, and design-partner intake (see Section 3.1 and Section 3.4);
• the Console (console.atlasmaps.app), the Atlas Maps product dashboard for signup, onboarding, and account management, described at a high level here, with its own account-level notices shown at signup;
• atlasmaps3d.com, the Atlas Maps 3D Figma plugin site and checkout (see Section 3.3).

This Policy does not cover third-party sites or services we link to, including the map-data providers described in Section 5, Figma's own platform, or our payment processors. Each governs its own data practices under its own privacy policy, linked where relevant below.

• "Personal information" means information that identifies, relates to, or could reasonably be linked with you. We use this term the way the CCPA/CPRA, GDPR, and the other laws named in this Policy use it.
• "Precise geolocation data" means location information precise enough to identify a specific point rather than a broad area, such as a city or postal code. The exact radius differs by law; see Section 6.
• "Sale" and "share" have the meanings used in the CCPA/CPRA and comparable state laws: a sale is any exchange of personal information for money or other valuable consideration; a share specifically means making personal information available to a third party for cross-context behavioral advertising, whether or not money changes hands. See Section 13.
• "Service" means, depending on context, the Atlas Maps platform, Atlas Maps 3D, or Atlas Maps Integration, as described in Section 1.
• "Console" means console.atlasmaps.app, the Atlas Maps product dashboard.
• "Business customer" means an organization that uses the Atlas Maps API through the Console, as distinct from that organization's own end users, whose data we generally process only as instructed by, and on behalf of, the business customer. See Section 3.2.
• "Subprocessor" means a third party we engage to process personal information on our behalf so we can provide the Service. See Section 7.2.

3.1 Atlas Maps marketing site and Console

On the marketing site (atlasmaps.app). We do not set our own cookies here. If you join the waitlist, that flow happens on the Console and is governed by the account-level notice shown there; this site only links to it. The only form here that collects information directly is the Atlas Maps Integration intake, covered in Section 3.4.

On the Console. When you sign up for or use an Atlas Maps account, we collect account information (name, email, and authentication details through our identity provider), the API keys or configuration you give us for the map-data providers you choose, and usage and billing information tied to your account.

Analytics. We use Plausible Analytics, a cookieless tool that does not use persistent identifiers and does not track you across other websites, to understand overall traffic to our marketing site. Plausible does not collect personal information as this Policy defines it.

Visitor identification. We use a company-identification tool that matches marketing-site visitors' IP addresses against business databases, so we can prioritize follow-up with organizations already in our sales pipeline. It works from your IP address rather than a cookie and identifies companies, not individuals.

In plain terms: if you just browse the marketing site, we don't collect anything that identifies you personally. If you're browsing from a company network, we may be able to tell which company that is, so our sales team can follow up with the right organization. If you create an account, we collect what we need to run that account.

3.2 If you are an end user of an Atlas Maps business customer

Atlas Maps is developer infrastructure. Most of the people whose location data passes through our routing layer are not our direct customers; they are the end users of a business that built an application on top of the Atlas Maps API. For that data, we act as a processor (service provider) on behalf of our business customer, and we handle it only as that customer instructs, and only to provide the routing service. We do not use this data for our own marketing or advertising, and we do not sell or share it; see Section 7.5 and Section 13. If you have a question about how your location data was used by a specific application, the business that runs that application is the right party to contact; we can help route your request if you reach us at privacy@atlasmaps.app.

Our Terms require every business customer to confirm that its own use of the Service, including any location-based feature it builds for its own end users, such as geofencing, follows applicable law. This specifically includes not using our routing infrastructure to build a virtual boundary around a health care facility in a way that would violate Washington's My Health My Data Act or a similar geofence restriction in another state. If a business customer needs a written data processing agreement, for example to meet its own GDPR Article 28 duties to its end users, contact privacy@atlasmaps.app; a standard agreement is available on request. That agreement includes read access to records of how we handled your requests, which can help with the customer's own recordkeeping duties under GDPR Article 30 and its own responses to access requests under Article 15.

3.3 Atlas Maps 3D (Figma plugin)

When you install and use the Atlas Maps 3D plugin, we collect the information needed to run it, such as your Figma account identifier as Figma provides it, your plugin configuration, and usage data about how you interact with the plugin. If you buy a paid plan, we also collect billing information processed by Lemon Squeezy. See Section 7.3.

If you hold an active Atlas Maps 3D Pro subscription, you may connect your own map-provider API key inside the plugin. When you do, we process that key and the related configuration the same way we process a business customer's provider key on the main platform: connecting your own key does not remove us from that flow. See Section 5 for how this works generally.

The plugin runs inside Figma. Your use of Figma itself, including your Figma account, the files you open, and Figma's own automatic data collection such as cookies, is governed by Figma's Privacy Policy, not this one. We are responsible for the privacy, security, and integrity of the data our plugin itself processes ("Integration Data," in Figma's terms), not for Figma's platform-level data collection.

3.4 Atlas Maps Integration intake

If you submit a project through our design-partner intake form on atlasmaps.app, we collect what you provide: your full name, email address, phone number, company (optional), project-sizing details such as API request volume and estimated monthly bill, and any notes you add.

In plain terms: when you submit this form, we record it in our customer relationship management and support systems so our team can review it and follow up with you. We may also use the contact information you provide to send you information about Atlas Maps, including by email or through advertising, as described in Section 4 and Section 13.

We apply automated safeguards to validate the information you provide and to detect and prevent spam and abuse. We treat your name, email, and phone number as personal information covered by this Policy.

We use personal information only for the purposes below. Where GDPR or UK GDPR applies, each purpose has a legal basis under Article 6:

Marketing and advertising applies only to information you give us directly, through the marketing site, the Console signup, or the Integration intake. It does not apply to the location or routing data we process for a business customer's end users, described in Section 3.2 and Section 5, which we use only to provide the Service.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you. Atlas Maps' machine-learning routing features are not live in production as of this Policy's last-updated date. If that changes, we will update this section to explain how those features work and what choices you have.

Atlas Maps sends geo-routing requests to a number of third-party map-data providers. Depending on your business customer's setup, your request, which may include precise location data, can go to one or more of these providers. Even where our customers bring their own key ("BYOK") to a provider, Atlas Maps still handles the request in transit as part of the routing layer. BYOK does not remove us from the flow of data.

These providers differ in where they can process data. Some can guarantee that your data stays in a particular region; others cannot, and one supports it only through self-hosting. A smaller subset also carry the kind of contractual transfer instrument, such as Standard Contractual Clauses, that our EU-residency feature depends on. Because this is not uniform across our providers, we cannot promise blanket EU-only or US-only processing for every routed request, only for requests we can route to a provider whose setup supports it. If your account is configured for EU data residency (an Atlas Maps Enterprise feature), we honor that promise per provider, consistent with this variation.

Each provider's own terms set the outer limit on what we can promise about that provider's handling of your data. For example, liability caps and permitted-use restrictions in a provider's terms bind what we can offer you downstream.

Our current map-data providers are: Google Maps, Mapbox, HERE, TomTom, Amazon Location Service (AWS), Azure Maps, MapTiler, Stadia Maps, Geoapify, GraphHopper, and Foursquare. Each provider handles routed data under its own terms and privacy policy, published on that provider's own site. We update this list when our provider set changes.

Because Atlas Maps routes precise location data as its core function, we are giving this its own section rather than folding it into a general list.

What "precise" means, and why the threshold matters. Several of the laws that apply to us define "precise geolocation data" using a specific radius:

• Connecticut defines it as identifying a location with precision and accuracy within a radius of 1,750 feet, and separately classifies it as sensitive data.
• Washington's My Health My Data Act uses the same 1,750-foot radius for "precise location information," and separately restricts geofencing, a virtual boundary of 2,000 feet or less around a physical location, when used to infer that someone sought health care services.
• California's CPRA treats "precise geolocation" as sensitive personal information, giving you the right to limit its use to what is necessary to provide the service you asked for.

To describe what we disclose clearly, we borrowed a plain-language model from the digital advertising industry's Transparency and Consent Framework, which has a "Special Feature 1" for the use of precise geolocation data within a small radius. We are not saying or implying that Atlas Maps takes part in that framework, runs a Consent Management Platform, or is registered with the IAB. We do none of those things. We borrowed its way of describing precision and purpose, not its compliance system.

What we do with it. We use precise location data only to route your request, or your business customer's request, to the map-data provider selected for that request, and to return the result. We do not use precise location data to build advertising profiles, and we do not sell it.

We do not sell precise geolocation data. We do not exchange precise geolocation data for money or anything else of value with any third party. Routing your request to a map-data provider you, or your business customer, selected, for the sole purpose of completing that request, is not a sale.

We do not sell your personal information for money. We share personal information in the situations below, including, for some information you give us directly, with advertising and marketing partners as described in Section 7.5. Depending on your jurisdiction, some of that sharing may be legally treated as a "sale" or "share" even without a payment; see Section 13 for your rights.

7.1 Map data providers

As described in Section 5, routing your request necessarily involves sending the relevant data to the map-data provider selected for that request.

7.2 Subprocessors

We use third-party vendors to run the Service, in the following general categories. Each acts as our subprocessor, bound by its own commercial terms and, where it applies, a data processing agreement:

We describe these categories at the category level rather than naming every vendor, since a public document that names our exact infrastructure stack is more useful to someone probing that stack than it is to you. If you need the full vendor list for a due-diligence or security review, contact privacy@atlasmaps.app.

7.3 Payment processors

Paid Atlas Maps subscriptions are billed through Stripe. Paid Atlas Maps 3D subscriptions are billed through Lemon Squeezy, acting as merchant of record. In both cases, the payment processor collects and handles your payment information directly; we do not receive or store your full card details. See each processor's own privacy policy for how it handles your payment data.

7.4 Legal, safety, and business-transfer disclosures

We may disclose personal information where the law, a subpoena, or other legal process requires it; to protect the rights, property, or safety of Atlas Maps, our users, or the public; or in connection with a proposed or actual merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets or business, including during due diligence, subject to standard confidentiality protections. If a change of ownership happens, personal information may be one of the assets transferred, and we will let you know by email or another reasonable means if that changes how your information is handled.

7.5 Advertising and marketing partners

We work with advertising platforms, such as social media advertising networks, and communications tools to promote Atlas Maps. We may share contact information you give us directly, for example through our waitlist, Console signup, or Integration intake, with these partners so we can run ads and send you communications, and to measure how well those campaigns perform. We do not share the location or routing data described in Section 3.2 and Section 5 with advertising or marketing partners. See Section 13 for how to opt out.

We do not currently set advertising or tracking cookies on atlasmaps.app or the Console. The Console sets a session cookie scoped to that host only, needed to keep you signed in. This is a strictly necessary cookie, not a tracking cookie, and it is not shared with atlasmaps.app. Our analytics tool, Plausible, does not use cookies.

We plan to begin using advertising cookies and pixels from social media advertising platforms on our marketing site, to run and measure ads. Before we do, we will update this section with more detail and, where the law requires it, such as for visitors in the EU/UK, ask for your consent first. Where consent isn't required, you can opt out as described in Section 13.

The Atlas Maps 3D marketing site (atlasmaps3d.com) embeds Mapbox GL to render map previews. Mapbox GL loads map tiles and styles directly from Mapbox's servers, so Mapbox receives your IP address and map-interaction requests when you view those previews, governed by Mapbox's Privacy Policy. We do not set our own tracking cookies on atlasmaps3d.com.

We honor the Global Privacy Control signal as described in Section 13.

We host in the United States today. If you are located in the UK, the EU or EEA, Canada, Australia, or New Zealand, your information may be transferred to and processed in the US.

EU/EEA and UK. GDPR and UK GDPR already apply to us today, because of our EU-data-residency Enterprise feature, regardless of when we expand more broadly outside the US. For these transfers, we rely on the EU Standard Contractual Clauses (SCC Decision 2021/914), and, for UK transfers, the UK International Data Transfer Addendum, following ICO guidance. Our map-data providers differ in what transfer instruments they support; only a subset carry an SCC-backed data processing agreement today, so we limit provider routing for EU-residency accounts to providers where an adequate transfer mechanism exists. See also the EU/UK representative note in Section 16.

Canada. We handle personal information about people in Canada consistent with our accountability duties under PIPEDA, including using contract protections with any party outside Canada that processes it on our behalf. If you are in Quebec, Law 25 applies in addition to PIPEDA. The person responsible for privacy matters at Atlas Maps can be reached at privacy@atlasmaps.app.

Australia. For personal information we handle on behalf of Australian business customers and their end users, we take reasonable steps, consistent with Australian Privacy Principle 8, to make sure any overseas recipient, including our US infrastructure and the map providers involved, handles that information consistently with the Australian Privacy Principles.

New Zealand. Consistent with the overseas-disclosure principle in the Privacy Act 2020 (Information Privacy Principle 12), we transfer personal information overseas only where the recipient is subject to comparable safeguards or another exception applies. Because we sometimes receive personal information about you indirectly, for example from the business customer whose application you use rather than from you directly, Information Privacy Principle 3A may require that business to notify you of the collection. We support that duty by contract, but the business customer is best placed to notify you directly.

Retention. We keep personal information for as long as necessary to provide the Service, meet our legal duties, including tax, accounting, and security recordkeeping, resolve disputes, and enforce our agreements. In practice: account and usage information for as long as your account is active, plus a limited period afterward; Integration-intake submissions for as long as we reasonably need them to evaluate and follow up, or until you ask us to delete them; and billing records for as long as tax and accounting law requires. Once we no longer need personal information for these purposes, we delete or de-identify it.

We also keep a separate compliance and audit record of how we handled each request, for example which provider we routed it to and what legal basis applied. This record does not include the content of your request, only information about how we processed it. We keep it for at least 395 days to meet our own security and regulatory obligations, and longer where the law, a regulator, or a litigation hold requires it. Because this record documents our own legal obligations rather than serving as a copy of your personal information, it is not covered by a deletion request in the way your account or submission data is, consistent with the legal-obligation exception under GDPR Article 17(3)(b) and comparable exceptions under other privacy laws named in this Policy.

Security. We use industry-standard technical and organizational safeguards, including encryption of data at rest and in transit, access controls limited to what each person or system actually needs, and internal records of how we process requests. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we learn of a security incident that compromises personal information in a way that triggers a notification duty under applicable law, we will notify affected people and any regulator the law requires, within the timeframe that law sets, for example without undue delay and, where feasible, within 72 hours of learning about it, where GDPR or UK GDPR applies. Where we act as a processor for a business customer (see Section 3.2), we will notify that business customer promptly so it can meet its own notification duties to its end users.

Atlas Maps, Atlas Maps 3D, and Atlas Maps Integration are not directed to children under 13, or the equivalent minimum age in your jurisdiction, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us at privacy@atlasmaps.app and we will delete it.

We do not sell personal information for money, and we never will. Depending on your jurisdiction, some of what we describe in Section 7.5 and Section 8, sharing contact information you give us directly with advertising partners, or, once live, using advertising cookies and pixels on our marketing site, so we can run ads or send you marketing, may be legally treated as a "sale" or "share" under laws like the CCPA/CPRA, even though no money changes hands. This does not apply to the location or routing data we process for business customers and their end users, described in Section 3.2 and Section 5, which we never sell or share.

Where sharing applies, you can opt out by emailing privacy@atlasmaps.app, using the "Do Not Sell or Share My Personal Information" link on atlasmaps.app, or turning on the Global Privacy Control signal, which we treat as a valid opt-out request when we detect it. After you opt out, we will wait at least 12 months before asking you to opt back in.

Depending on where you live, you may have the right to know what personal information we hold about you, request a copy of it, correct it, delete it, restrict or object to certain processing, or opt out of the sale or sharing described in Section 13. To exercise any of these rights, email privacy@atlasmaps.app. We may need to verify your identity before acting on a request, and we will respond within the timeframe your jurisdiction's law requires, for example 45 days under the CCPA, extendable once by another 45 days. You will not be charged a fee, and we will not treat you differently for exercising these rights.

If you are an end user of one of our business customers rather than an Atlas Maps account holder yourself, see Section 3.2; we will help route your request to the right party.

Regional summary:

• California (CCPA/CPRA): the rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information, including precise geolocation, plus the right to equal treatment for exercising them.
• EU/UK (GDPR/UK GDPR): the rights of access, correction, deletion, restriction, portability, and objection, and the right to complain to your local supervisory authority.
• Canada (PIPEDA/Law 25): rights grounded in the ten Fair Information Principles: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and the ability to challenge our compliance.
• Australia (Privacy Act/APPs): access and correction rights consistent with the Australian Privacy Principles.
• New Zealand (Privacy Act 2020): access and correction rights consistent with the Information Privacy Principles.

To ask us to delete your personal information specifically, see Section 17.

We may update this Policy from time to time. If we make a material change, we will update the "Last updated" date above and, where the law requires it, give additional notice. Continued use of the Service after a change takes effect means you accept the updated Policy.

Atlas Maps LLC is a Wyoming limited liability company, registered as a foreign limited liability company in Washington State. We are the controller of the personal information described in this Policy, except where we act as a processor (service provider) on behalf of a business customer; see Section 3.2.

This Policy, and any dispute about it, is governed by the same governing-law provision as our Terms and Conditions.

Registered agent for service of process (Wyoming, our state of formation): Registered Agents Inc, 30 N Gould St Ste R, Sheridan, WY 82801.

Registered agent for service of process (Washington, where we are registered as a foreign LLC and operate): Washington Commercial Registered Agent LLC, 100 N Howard ST STE R, Spokane, WA 99201.

EU/UK representative: We are evaluating whether our EU-data-residency Enterprise feature and our processing of location data require us to appoint a representative in the EU and a separate one in the UK under Article 27 of the GDPR and UK GDPR. If we appoint one, we will add their contact details here before any EU-residency account processes production traffic.

To ask us to delete your personal information, email privacy@atlasmaps.app with the email address tied to your account or submission. We will confirm we received your request and complete verified deletion requests within the timeframe the law requires, subject to the exceptions in Section 10, for example information we must keep for legal, tax, or security purposes.

Atlas Maps 3D does not have its own privacy mailbox. Privacy questions about the plugin go to privacy@atlasmaps.app, the same address that handles the platform.

Postal notices: Atlas Maps LLC, c/o Washington Commercial Registered Agent LLC, 100 N Howard ST STE R, Spokane, WA 99201, USA.