Privacy Policy

Because of how Atlas works, we act in two different data-protection roles at the same time:

• As a Data Controller for account data we collect directly from you (the Photographer) — your name, email, payment status, usage data, support requests.
• As a Data Processor for the photographs and any associated metadata you upload through Atlas (event photos, FTP camera ingests, tagged names, etc.), which typically depict or relate to your End Clients. In that relationship, you (the Photographer) are the Data Controller, and Atlas processes that data only on your instructions, for the purpose of providing the Service (storage, duplicate detection, print lab delivery, gallery hosting). A separate Data Processing Agreement (DPA) governs this relationship in detail and forms part of your contract with us.

a) Account & billing information (collected directly from you):

• Name, email address, phone number (optional)
• Studio/business name
• Login credentials
• Subscription tier, storage usage, number of connected cameras, number of team seats
• Payment status and invoice history (the actual card/payment details are processed by Polar.sh, our payment provider — see Section 5)

b) Content you upload or ingest through the Service:

• Photographs uploaded via the web app or ingested automatically via FTP from connected cameras
• EXIF/metadata embedded in image files (e.g., camera model, timestamp, and GPS coordinates if your camera embeds them)
• Any names, tags, or notes you or your End Clients add to galleries or individual images
• Files sent to connected Fujifilm Frontier print lab integrations

c) Technical & usage data (collected automatically):

• IP address, browser type, device identifiers
• Log data (pages visited, actions taken, error logs)
• Cookies and similar technologies (see our Cookie Policy)

d) Communications:

• Support requests, emails, and any feedback you send us

We do not sell your data or your End Clients' images to third parties, and we do not use uploaded photographs to train third-party AI models without your explicit, separate opt-in consent.

Atlas may, in future versions, offer AI-assisted features (such as duplicate detection or smart tagging) built on our own models and/or third-party AI providers. Where third-party AI providers are used to process your images, they will be listed as subprocessors in Section 5 before that feature is enabled for your account, and processing will be limited to what is strictly necessary to deliver the feature. We will update this policy and notify Photographers before any such feature goes live.

We use the following infrastructure and service providers ("subprocessors") to operate Atlas. Each is bound by a data processing agreement and/or standard contractual clauses where applicable:

We will update this table as our infrastructure evolves and will notify Photographers of material changes to subprocessors used for photo/personal data processing, consistent with our DPA.

Our infrastructure providers may store or process data outside your country, including outside the European Economic Area. Where this happens, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) or equivalent mechanisms offered by our subprocessors.

• Active accounts: we retain your account data and uploaded photographs for as long as your subscription is active.
• After cancellation: your data, including photographs, is retained for 30 days after account cancellation or non-renewal, allowing you to export your data or reactivate. After 30 days, data is permanently deleted from our production systems, subject to standard backup rotation cycles.
• Legal/financial records: billing records may be retained longer where required by law or by Polar.sh's own recordkeeping obligations as Merchant of Record.

Depending on your location, you may have the right to:

• Access, correct, or delete your personal data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise these rights, contact legal@atlas.saramandic.com. If you are an End Client of a Photographer using Atlas, please direct data requests to the Photographer first, as they are the Data Controller for your images; we will assist them in fulfilling such requests as required under our DPA.

We apply reasonable technical and organizational measures to protect data — including encryption in transit, access controls, and infrastructure hardening. No system is 100% secure, and we cannot guarantee absolute security of information transmitted to the Service.

Atlas is intended for use by professional photographers and is not directed at children. We do not knowingly collect account data from individuals under 18. Photographs uploaded by Photographers may depict minors (e.g., at family or school events); Photographers are responsible for obtaining appropriate consent from parents/guardians for such photography and its processing through Atlas.

We use cookies and similar technologies as described in our Cookie Policy.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice before they take effect.

Atlas

Operated by: [Full Legal Name]

Republic of Serbia

Email: legal@atlas.saramandic.com