Privacy Policy

This Privacy Policy describes how LogitAtlas collects, uses, discloses, and protects personal information in connection with the LogitAtlas website, API, and related services (the 'Platform').

The Platform is a business-to-business service. We process information about account holders, members of company workspaces, people who sign up for our marketing emails, and individuals who correspond with us. We also process limited information about end users of our customers' products when it is strictly necessary to operate the Platform.

This policy supplements, and does not override, any additional notices we provide at the point of collection or any data processing agreement we have signed with your organization.

For personal data that we collect about you directly, such as your account information, we act as a controller. For personal data that a seller includes in a dataset listing or that a buyer uploads to the Platform, the buyer or seller is the controller and we act as a processor, handling that data on their instructions.

Where we act as a processor, our processing is governed by the Data Processing Addendum associated with the applicable service plan, which includes the Standard Contractual Clauses issued by the European Commission for international transfers.

We collect the following categories of information:

• Account data such as your name, email address, password hash, profile photo if you add one, and language preference.
• Company data such as legal name, registered address, Stripe Connect verification details, bank account information held by Stripe, and the roles of each member in your workspace.
• Transactional data such as orders, invoices, payouts, disputes, and messages exchanged between buyers and sellers.
• Usage data such as device type, browser, operating system, IP address, pages viewed, referring URLs, session identifiers, and feature interactions.
• Communications data such as support tickets, email correspondence, and any feedback you share with us.
• Marketing data such as your opt-in status, email engagement metrics, and traffic source for your account creation.

We use personal information to:

• Create and maintain your account and company workspace.
• Facilitate dataset listings, orders, escrow, delivery, and payouts.
• Resolve disputes and respond to support requests.
• Comply with laws, including anti-money laundering, know-your-customer, tax, and sanctions obligations enforced through our payment partner Stripe.
• Prevent fraud, abuse, and security incidents, including by analyzing login patterns and transaction behavior.
• Improve the Platform by analyzing aggregated usage and feature adoption.
• Send operational emails about your account, orders, and important updates, and marketing emails to users who have opted in.

We rely on the following legal bases to process personal data under the GDPR and UK GDPR: performance of a contract with you, compliance with a legal obligation, our legitimate interests in operating a secure and reliable marketplace, and your consent where required for marketing or non-essential cookies.

We do not sell personal information. We share information only with:

• Service providers who process information on our behalf, including Stripe for payments and payouts, our cloud infrastructure provider, email delivery services, analytics tools, and customer support software. Each provider is bound by contractual terms that limit how they can use the information.
• Other users on the Platform where sharing is necessary to complete a transaction, such as showing a seller the buyer's company name when an order is placed.
• Regulators, law enforcement, and other authorities when we are required to do so by law or where disclosure is necessary to protect our rights or the rights of others.
• An acquirer or successor in the event of a merger, acquisition, financing, reorganization, or sale of assets, in which case personal data will be transferred subject to the terms of this policy.

The Platform is operated from the United States and uses cloud infrastructure in multiple regions. Personal data about users located in the European Economic Area, the United Kingdom, or Switzerland may be transferred to and processed in countries that have not been determined to provide an adequate level of data protection.

Where this happens, we rely on the Standard Contractual Clauses issued by the European Commission (and the UK International Data Transfer Addendum where applicable) as the lawful basis for the transfer. We also perform transfer impact assessments and implement supplementary technical and organizational measures where required.

We keep personal information only for as long as is necessary for the purposes described in this policy. We retain account and transaction information while your account is active and for a period afterwards to comply with tax, audit, and legal obligations.

Order and payout records are retained for at least seven years to meet financial record-keeping requirements. Support tickets are retained for up to three years. Marketing data is retained until you unsubscribe or ask us to delete it.

After the retention period ends, we delete or anonymize the information. Backups that contain personal data are purged or rotated out on a defined schedule.

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit using TLS and of sensitive data at rest, including dataset credentials.
• Role-based access controls and the principle of least privilege for our team.
• Logging and alerting on administrative actions.
• Regular backups, patching, and vulnerability scanning.
• Multi-factor authentication for account holders where supported.

No security program is perfect. You are responsible for keeping your credentials safe and reporting suspected unauthorized access promptly.

Depending on where you live, you may have the following rights with respect to personal information we hold about you:

• Access the information we hold and request a portable copy.
• Correct inaccurate information or complete incomplete records.
• Request deletion of information that we are not legally required to retain.
• Restrict or object to our processing in defined circumstances.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your supervisory authority, such as a European data protection authority or your state attorney general.

You can exercise most of these rights by using the controls in your account or by emailing privacy@logitatlas.com. We will respond within the timeframe required by applicable law and may need to verify your identity before acting on a request.

If you are a California resident, you have additional rights under the CCPA and CPRA, including the right to know, delete, correct, and opt out of 'sharing' as that term is defined by California law. We do not sell personal information.

The Platform is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Platform is used. Essential cookies are required for the Platform to function. Analytics and marketing cookies are only set with your consent where required by law.

You can manage cookie preferences in your browser or through the consent interface we display on first visit. Blocking essential cookies may prevent the Platform from working properly.

We may update this policy from time to time. Material changes will be posted on this page with a new effective date, and where appropriate we will notify account holders by email. Continued use of the Platform after a change takes effect means you accept the updated policy.

If you have questions or concerns about this policy or how we handle personal information, you can reach us at privacy@logitatlas.com. You can also write to LogitAtlas, Attention: Privacy, 1209 Orange Street, Wilmington, Delaware 19801, United States.

If you are located in the European Economic Area or the United Kingdom and wish to contact a representative under Article 27 of the GDPR, email privacy@logitatlas.com and we will route your request accordingly.