Privacy Policy
MiniAtlas ("we", "us") is operated by ATTO SPACE INC, 8080 N Central Expy Ste 1700, Dallas, TX 75206, USA. This policy explains what personal data we process when you use miniatlas.app, why, and the choices you have.
Who this applies to
MiniAtlas accounts are for adults (18+) — parents, guardians, educators and sellers. MiniAtlas is not directed to children, and we do not knowingly collect personal data from children under 13 (or under 16 in the EEA/UK). If you believe a child has given us personal data, contact us and we will delete it.
Information we collect
- Account data: email address, name (optional), a salted and hashed password (PBKDF2; we never store your password itself), your plan, marketing preference and account timestamps.
- Session and security data: a random session identifier stored in an essential, HttpOnly cookie, a hashed copy on our server, your browser's user-agent string, and short-lived records of failed sign-in attempts used to block password guessing. We do not store your IP address in our database.
- Purchases and memberships: what you bought, the amount, currency, date and status, and Stripe identifiers. Card and bank details are entered on Stripe's pages and processed by Stripe; we never see or store full card numbers.
- Saved resources: the links and titles you save to your account.
- Seller data: store name, country, seller type, bio, website, product listings and files, sales and payout status. Identity verification, tax and bank information for payouts are collected by Stripe during onboarding.
- Messages: what you send us through the contact form (name, email, topic, message) and the country derived by our hosting provider from your connection.
- Waitlist: email, sign-up time, interface language, where you signed up and country derived from your connection.
- Browser storage: your language and location preferences (
ma_lang,ma_home,ma_lang_hint), cookie-notice acknowledgement (ma_consent) and a waitlist retry copy (ma_waitlist) in localStorage on your device. - Visit statistics: we use Cloudflare Web Analytics to count page views and measure page speed. It does not set cookies, does not use local storage and does not build a profile of you across sites; Cloudflare processes the page address, referrer, browser type and approximate country of each visit.
How we use it and our legal bases
- To provide your account, memberships, downloads and seller tools (performance of a contract).
- To take payments, prevent fraud and keep records required for tax and accounting (contract; legal obligation; legitimate interests in security).
- To answer your messages and provide support (contract; legitimate interests).
- To send launch news and, if you opt in, occasional product updates (consent — you can withdraw at any time).
We do not sell or rent personal data, we do not use advertising cookies or cross-site tracking (our only statistics tool is the cookieless Cloudflare Web Analytics described above), and we do not use your data for automated decisions with legal effects.
Service providers
- Cloudflare, Inc. — hosting, database (D1), file and key-value storage, security (USA/global).
- Stripe, Inc. and affiliates — payments, subscriptions, tax calculation, seller onboarding and payouts. Stripe acts as an independent controller for some data; see stripe.com/privacy.
- An email delivery provider, once transactional email is switched on (for password resets and receipts).
International transfers
We are a US company and our providers may process data in the United States and other countries. Where GDPR or UK GDPR applies, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK Addendum and, where available, the EU–US Data Privacy Framework.
How long we keep data
- Account data: while your account is open. When you delete your account we erase it immediately, except order records, which we keep without your account link for as long as tax and accounting law requires (typically up to 7 years).
- Sessions: up to 30 days. Failed sign-in records: up to 24 hours. Password-reset links: 1 hour.
- Messages: up to 24 months. Waitlist: until launch communications end or you ask to be removed.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR or US state laws such as the CCPA/CPRA), you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent. Signed-in users can download their data and delete their account at any time from My account. For anything else, contact us — we answer within 30 days. EEA/UK residents may also complain to their local data-protection authority.
Security
We use HTTPS everywhere, hashed passwords, HttpOnly/Secure/SameSite cookies, CSRF protection, rate limiting, signed and expiring download links and least-privilege access. No system is perfectly secure; tell us at once if you suspect a problem.
Changes
We will post updates here and, for material changes, notify account holders by email or on the site.
Controller and contact
ATTO SPACE INC
8080 N Central Expy Ste 1700
Dallas, TX 75206
USA
Email: atlas@miniatlas.app · Phone: +1 945 365 0365 · or use our contact form.
See also our Terms of Use, Cookie Notice and Refund Policy.
Weekly newsletter and printables
If you subscribe to the weekly email (on the home page, the newsletter page, the quiz or when you request printables), we store your email address, language, the page you signed up on, your approximate country (from your connection) and the time and wording of your consent. We use this only to send the newsletter; we do not sell or share it. Every email contains an unsubscribe link, and you can also write to atlas@miniatlas.app to have your address deleted. Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.