Privacy Policy

This Privacy Policy explains how The Atlas Project ("we") handles personal information in connection with SignalLocal. It applies to the Service and our marketing site. It does not cover third-party services you connect or that we rely on, which have their own policies.

The short version. We collect the minimum needed to run SignalLocal: your account and billing details, basic usage/log data, and the Segment queries you set up. We use essential cookies only (the sign-in session). We do not run analytics or advertising trackers, we do not build advertising profiles, and we do not sell or "share" personal information. The business information SignalLocal surfaces about local businesses is publicly available business-contact data gathered from third-party sources for a prospecting purpose.

1. Roles

For your Account and billing data, we act as a controller — we decide how it is handled to run the Service.

The local-business information SignalLocal surfaces (business names, public websites, map/listing data, review counts, rank observations) is publicly available business-contact data that we obtain from third-party sources and make available to you as a prospecting tool. It is not personal information you entrust to us as a processor, and SignalLocal is not a processor-role product. Where any such data relates to an identifiable individual (for example, a sole proprietor's name on a public listing), we handle it consistently with applicable law, and the data-subject rights in §9 may apply.

2. Categories of Information We Collect

We do not use analytics or advertising cookies or pixels, and we do not build advertising profiles. If this ever changes, we will update this Policy and, where required, obtain consent first.

3. How and Why We Use Information

• Provide the Service — authenticate you, run scans, compute Signals, and deliver counts, callable lists, and the live radar for your Segments.
• Billing — process subscriptions via Stripe.
• Communicate — send transactional and service messages (receipts, security notices, "your radar is live," product notices) via Resend. We send marketing email only where permitted and with an unsubscribe option.
• Secure and maintain — detect abuse, enforce plan limits and the payment gate, debug, and protect the Service and its data.
• Comply — meet legal obligations and enforce our Terms.
• Improve — understand feature usage in aggregate. We do not use your data to train generalized AI models. (SignalLocal does not use AI vision/extraction models; it computes Signals with deterministic rules over third-party and HTTP data.)

4. Legal Bases (GDPR / UK GDPR)

Where GDPR/UK GDPR applies, we rely on: performance of a contract (to provide the Service you signed up for); legitimate interests (to secure, maintain, and improve the Service, to send limited service communications, and to surface publicly available business-contact data for a business-prospecting purpose), balanced against affected individuals' rights; consent (where required, e.g., any future non-essential cookies or optional marketing); and legal obligation (e.g., tax and records).

Where you use SignalLocal to contact businesses, you are responsible for having a lawful basis for your own outreach and marketing.

5. Subprocessors and Third-Party Recipients

We use the following subprocessors and service providers for SignalLocal:

We enter data-processing terms with subprocessors where required and require appropriate safeguards. We will update this list and, where required, give notice before adding a subprocessor that materially changes processing of your data. We do not sell personal information and do not share it for cross-context behavioral advertising.

If you separately choose to enable an optional delivery integration in the future (for example, a GoHighLevel marketplace connection to receive Signals in your own CRM), that integration is enabled at your direction and is governed by that provider's own terms. It is not active by default.

6. OpenStreetMap / ODbL Attribution

Some map-derived data shown in the Service comes from OpenStreetMap. That data is © OpenStreetMap contributors and is made available under the Open Database License (ODbL). We display the required attribution on pages that show OSM-derived data. If you reuse OSM-derived data, you must comply with the ODbL, including its attribution and share-alike terms.

7. Cookies and Similar Technologies

We use essential cookies only — specifically, the Supabase authentication-session cookie needed to keep you signed in. We do not use analytics, advertising, or tracking cookies or pixels. Because we use only strictly-necessary cookies, we do not show a non-essential-cookie consent banner. If we ever introduce non-essential cookies, we will update this Policy and obtain consent where required.

8. Retention

We keep account and billing data for as long as your Account is active and as needed for legitimate business and legal purposes (e.g., tax records) after closure. Your Segment inputs and radar configuration are retained while your Account is active and deleted or de-identified on request or on termination, subject to residual backups purged on our ordinary cycle. Surfaced business data and scan snapshots are retained as needed to compute point-in-time Signals (which require comparing snapshots over time) and are refreshed and aged out on our ordinary cycle. Log and security data are kept for a limited period appropriate to security and debugging.

9. Security

We use reasonable technical and organizational measures appropriate to the risk, including encryption in transit, access controls, least-privilege access, row-level security separating each customer's entitlements, a server-side payment gate that keeps locked list data from being served to unpaid clients, and reliance on reputable infrastructure providers (Vercel, Supabase, Stripe). No system is perfectly secure; we cannot guarantee absolute security. We will notify affected users and regulators of a personal-data breach where required by law.

10. Your Privacy Rights

10.1 GDPR / UK GDPR (EEA/UK residents). Subject to conditions, you may request access, rectification, erasure, restriction, portability, and objection, and may withdraw consent where processing is based on consent. You may lodge a complaint with your supervisory authority.

10.2 CCPA / CPRA (California residents). You have rights to know/access, delete, and correct personal information, and to opt out of "sale" or "sharing." We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for purposes that would trigger a right-to-limit. We will not discriminate against you for exercising rights. Authorized agents may submit requests with proof of authorization.

10.3 Business-contact data nuance. SignalLocal surfaces business-contact information about local businesses. Where such data relates to an identifiable individual (for example, a sole proprietor named on a public listing), the rights above may apply. California's treatment of business-to-business and publicly available information continues to evolve; publicly available information is generally outside the CCPA's definition of personal information, and we handle business-contact data consistent with applicable law. A business or individual who wants their information reviewed or removed from the Service may contact us at admin@the-atlas-project.net, and we will respond consistent with applicable law and our sources' terms.

10.4 How to exercise rights. Email admin@the-atlas-project.net from your Account address, describing your request. We will verify your identity and respond within the time required by law.

11. International Data Transfers

We are based in the United States, and our subprocessors may process data in the US and elsewhere. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK Addendum, or another lawful mechanism. By using the Service, you understand your information may be processed in the US.

12. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their personal information (see Terms §16).

13. Changes and Contact

Changes. We may update this Policy. We will post the new version with a revised "Last updated" date and, for material changes, provide additional notice (email or in-product). Continued use after the effective date constitutes acceptance where permitted by law.

Contact. Questions or requests: admin@the-atlas-project.net. Postal address: The Atlas Project, [MAILING_ADDRESS — to be added once the entity is formed].

Last updated: July 18, 2026 · The Atlas Project · admin@the-atlas-project.net

This document was prepared with automated assistance and has not been reviewed by an attorney. It is not legal advice.