Privacy Policy

If you opt in, we use your verified account email to send marketing emails, including a short monthly newsletter, new maps, map-quality improvements, product updates, free-credit offers, and other promotions. We record your account identifier, email, consent source, opt-in and withdrawal timestamps. We also keep campaign content, recipient addresses, sending attempts, provider acceptance references, and suppression records for delivery failures or complaints. Resend processes recipient addresses and email content to deliver messages and handle delivery failures and complaints. We use consent for optional marketing emails; essential account, purchase, security, and service-disruption notices are handled separately as needed to provide and protect the service. You can unsubscribe from optional emails without signing in by using the link in an email, or in account settings. We retain consent and suppression records as needed to honor your choices and prevent unwanted mail; Resolved delivery records are scheduled for deletion after one year; active deliveries remain until resolved.

The exact list depends on whether you are just browsing or using account features.

Basic product analytics: page path, locale, a random view ID, customization actions, language suggestion views and responses, and coarse country/region codes from trusted hosting-edge headers.

Export and reliability details: map/style identifier, output format, dimensions, PNG DPI, SVG precision when relevant, selected layers and settings, status, processing time, file size, user agent, and a one-way client-IP hash.

Accountless purchase details: the exact map configuration, Stripe checkout and payment references, product and amount, payment status, download count and timestamps, and a one-way hash of the random browser access token. Stripe processes checkout email, billing address, and card details; CustomAtlas does not store full card numbers.

Account details when you sign in: a Clerk account identifier and primary email address, plus onboarding and optional marketing-email consent status.

Saved-map details when you use account features: map name, map configuration (which may include quiz or worksheet text you enter), timestamps, recovery versions, export history, share settings, and invited collaborator email addresses.

Feedback details when you send a report or request: the text you submit, relevant page and map context, your account identifier when signed in, and coarse country/region codes. Feedback does not collect an email address.

We use this information to provide requested features and to operate, secure, and improve the service.

Generate requested SVG, PNG, and PDF exports.

Save, autosave, restore, share, and export account-saved maps.

Authenticate accounts, manage sharing permissions, and record and honor optional marketing email consent.

Monitor reliability, troubleshoot failures, improve performance, prevent abuse, enforce rate limits, and maintain platform security.

We do not sell personal data or hand it to advertisers. Data is shared with service providers only as needed to deliver the product, protect it, or comply with the law.

Clerk provides account authentication, Stripe processes payments and receipts, and Supabase hosts account data, accountless purchase records, map assets, export history, and analytics storage.

Our hosting or edge provider may provide coarse country/region headers and process requests as part of delivery and security.

Shared maps are visible to people you invite or anyone with a link, depending on the setting. Edit access is limited to invited editors.

Professional advisors or authorities when legally required.

Resend delivers our marketing emails and essential account or service emails and processes recipient addresses, message content, and delivery or suppression information.

Where data-protection law requires a legal basis, we process data to perform our contract with you (accounts, saved maps, sharing, and exports), for legitimate interests in operating, securing, and improving a limited-data service, to comply with applicable legal obligations, and with consent for optional marketing emails. You may withdraw marketing email consent at any time.

CustomAtlas and its providers may process information in the United States and other countries. Where required, providers use recognized transfer mechanisms and contractual safeguards. Their own privacy notices describe their locations and safeguards in more detail.

Saved maps remain until you delete an unpaid map or request erasure of a protected paid map. Deleting your account removes its saved maps, recovery versions, sharing settings, export history, and account profile. Product analytics and operational events are scheduled for deletion after 90 days; export history, feedback, and completed email delivery records after one year. Active email deliveries remain until resolved. We retain limited marketing consent and suppression records to honor your choices. Payment and credit records are retained separately for tax, accounting, refund, dispute, and legal-claim obligations; their retention depends on the applicable obligation and whether a dispute remains open. Provider logs and backups follow each provider’s retention practices.

Depending on your jurisdiction and the processing involved, you may request access, correction, deletion, restriction, objection, or a portable copy of personal data. Some controls are already available in the product.

Delete unpaid saved maps and their recovery versions from My Maps. Paid maps are protected for repeat downloads; email us to request their erasure. Deleting a map removes access to its saved content and shared links.

Withdraw optional marketing email consent from account settings or the unsubscribe link in an email.

Request access, correction, or deletion of personal data by email. We may need to verify the request.

Ask questions about how your data is processed.

Complain to your local privacy or data-protection authority where that right applies.

CustomAtlas is not directed to children under 13, and we do not knowingly collect personal data from children.

We use same-origin checks, input validation, rate limits, account authorization, provider access controls, and server-side export processing to help protect the service and the information it handles. We review and improve these controls as the service develops.

We may update this policy as our practices or legal requirements change. Updates are effective when posted here.