Privacy Policy

This policy explains how Sahil Singh, trading as Atlas Prism ("we") handles personal information when you use Atlas Prism. We comply with South Africa's Protection of Personal Information Act (POPIA) and, where it applies, the UK/EU GDPR.

Our Information Officer is Sahil Singh, contactable at privacy@atlasprism.app.

1. What we collect

If you are a customer of ours (a brand)

• Account details — name, email address, business name, password (stored hashed).
• Configuration — your logo, colours, brand voice and product catalogue.
• Billing details — handled by Paddle. We receive confirmation of your subscription status, not your card number.
• Usage data — consultations run, features used, error logs.

If you are a consumer using a consultation

• What you type during the consultation, including skin concerns you describe.
• An optional photo, only if you choose to share one.
• Basic technical data such as language and device type.

2. Why we process it, and on what basis

• To provide the service — performance of our contract with you.
• To take payment — performance of contract, and legal obligation for records.
• To keep the service secure and improve it — our legitimate interests.
• To send service emails (verification, billing, outages) — performance of contract. Marketing emails only with your consent, and you can withdraw at any time.

3. Information about your customers

Where a consumer uses a consultation on your website, you are the responsible party (or controller) and we act as your operator (or processor). We process that information only to deliver the consultation on your behalf and in line with your instructions.

Information a consumer shares about their skin may be sensitive. It is used to generate their routine, and is not used to build profiles, target advertising, or identify individuals across websites.

Photos are processed for that consultation only and are not retained afterwards.

A Data Processing Addendum is available on request from privacy@atlasprism.app.

4. Who we share information with

We use a small number of service providers, each bound by contract:

• Anthropic — generates the consultation. Content sent through their API is not used to train their models.
• Supabase — database and authentication.
• Vercel — hosting.
• Paddle — merchant of record; they process your payment details directly.
• Resend — sending service emails.

We do not sell personal information, and we do not share it for advertising.

5. How long we keep it

• Account and configuration — while your account is active, then 60 days after cancellation, then deleted.
• Consultation records — retained for your dashboard while your account is active.
• Photos — not retained after the consultation.
• Invoices and tax records — as long as the law requires.
• Backups — deleted data is removed from backups within 30 days.

6. Your rights

You may ask us to access, correct, delete, or restrict use of your personal information, to object to processing, or to receive a copy in a portable form. Contact privacy@atlasprism.app and we will respond within 30 days.

If you are unhappy with our response you may complain to the Information Regulator (South Africa), or to your local supervisory authority if you are in the UK or EU.

7. International transfers

We are based in South Africa and our providers operate internationally, so your information may be processed outside your country. Where that happens we rely on appropriate safeguards, including standard contractual clauses, and the providers' own compliance frameworks.

8. Security

Data is encrypted in transit and at rest. Access is limited to what is needed to operate the service. Passwords are hashed and never visible to us. We keep the consultation engine server-side so it is never exposed to browsers.

9. Cookies

We use only what is necessary: a session cookie to keep you logged in, and basic security cookies. We do not use advertising or cross-site tracking cookies. The embedded consultation sets no marketing cookies on your customers' devices.

10. Changes

We will post any changes here and, for material changes, notify account holders by email.