Privacy Policy
Last updated: 19 October 2026
1. Who is responsible
Space Atlas is operated by [TO COMPLETE: legal name, address and country of the data controller]. Privacy contact: [TO COMPLETE: contact email]. This draft must be completed and reviewed before being relied upon as a final legal notice.
2. Data we collect
Account email, display name, account identifiers and Terms acceptance time/version; favorites; saved trips and their ordered stops; correction suggestions and supporting sources; saved country groups; submissions and feedback. Authentication also processes credentials securely. Technical requests may expose IP addresses, device/browser information and security logs to hosting and map providers. [TO COMPLETE: exact logging and analytics inventory].
Plan/subscription details (effective plan, manually assigned status, dates and notes), monthly usage counts per research/export action, and waitlist email, desired plan, optional company/message and join date are stored. Reports are not yet stored. Waitlist details are used for the launch notification you request; monthly counts enforce plan allowances. No payment provider is connected and no payment-card details are collected. [TO COMPLETE: final retention for monthly usage and launch waitlist].
3. Purposes and legal bases
Providing accounts, saved favorites, trips and research tools: performance of a contract (GDPR Article 6(1)(b)). Security, abuse prevention and maintaining the directory: legitimate interests (Article 6(1)(f)), subject to your rights. Legal/accounting obligations: Article 6(1)(c) where applicable. Optional marketing or non-essential tracking, if introduced: consent (Article 6(1)(a)) where required. [TO COMPLETE: confirm each purpose, legitimate-interest assessment and any additional processing]. Agreement to our Terms is not consent to optional tracking or marketing.
4. Storage and retention
Account data is retained while your account is active, and removed when you delete it. Account deletion removes owned application records and the authentication account, including related suggestion history; published factual entity information may remain without a link to your account. [TO COMPLETE: periods for security logs, backups, unverified accounts, inactive accounts and legally required records]. Backups and third-party logs may expire on separate schedules; [TO COMPLETE: schedules and deletion procedures].
5. Processors and recipients
Authentication/database: Supabase. Hosting: [TO COMPLETE: legal provider name and location]. Email delivery: Resend [TO COMPLETE: confirm use and contractual entity]. Map requests: EOX, OpenFreeMap/OpenStreetMap and NASA imagery services where enabled; providers receive request/network data according to their policies. Future payment provider: [TO COMPLETE]. External logo/image hosts may receive your IP address when images load. [TO COMPLETE: full processor list, processing agreements, hosting regions and links to policies]. We do not sell personal data. [TO COMPLETE: confirm all disclosure practices].
6. International transfers
Providers may process data outside the EEA. [TO COMPLETE: actual countries, adequacy decisions, Standard Contractual Clauses, supplementary safeguards and how to obtain a copy].
7. Your rights
You may request access, rectification, erasure, portability, restriction and objection where applicable, and withdraw optional consent without affecting earlier lawful processing. Change your display name, download your personal data or delete your account in My dashboard → Account. Admin accounts require an assisted deletion request. Contact [TO COMPLETE: privacy email] for other requests. You may complain to [TO COMPLETE: competent supervisory authority]. [TO COMPLETE: identity checks, response procedure and applicable exceptions].
8. Cookies, children and changes
We currently use essential cookies/browser storage only; see the Cookies Policy. [TO COMPLETE: minimum age and handling of children's data]. Material changes will be reflected in this policy and, where appropriate, notified. A new Terms version requires renewed acceptance. [TO COMPLETE: notification method].