Privacy Policy

1. Who we are

This policy covers the Atlas Studios website (atlasstudiosuk.com) and Atlas Tools (atlasstudiosuk.com/tools). Both are run by Atlas Studios Group Ltd, registered in England and Wales, company number 17292301, registered office 38 Buckingham Way, Flackwell Heath, High Wycombe, England, HP10 9EE (“Atlas”, “we”, “us”), a UK web design and software studio.

Questions about this policy or your data: general@atlasstudiosuk.com.

2. Two roles: controller and processor

When we decide why and how your data is used, we are the data controller. That covers people who contact us, visit our website, or have an Atlas Tools account (sections 3 and 4).

When you visit a business's website that uses Atlas Tools, that business is the controller and we are its data processor. We handle your data only on the business's instructions, to run the tool you used (section 5). If you want to see, correct or delete that data, ask the business whose website you used. We'll help them respond.

3. Our own website and enquiries

• Enquiries. If you use a quote form or email us, we collect the details you give us — typically your name or business name, email address and your answers about what you need. We use them to reply and to prepare a quote. Legal basis: taking steps at your request before a contract, and our legitimate interest in running our business. We keep enquiries that don't become a contract for up to 12 months after we last spoke.
• Website analytics. Our website uses Vercel Analytics, which counts visits in aggregate without cookies or personal profiles. If you choose “Accept” on our cookie banner, we also use Google Analytics, which sets cookies to show us how the site is used (pages visited, rough location, device). Legal basis: your consent, which you can withdraw at any time using “Cookie settings” in the footer. If you decline, Google Analytics does not load.
• Advertising. We advertise on Google and Meta (Facebook and Instagram). If you accept advertising cookies on our banner, their tags tell us which of our adverts led to a sign-up or a first payment (see section 4), and Google and Meta use that to measure and improve our adverts. We don't use them to show you other companies' adverts. Legal basis: your consent, which you can withdraw at any time using “Cookie settings”. If you decline, nothing from Google or Meta loads.
• Arcade games. If you submit a score to the weekly leaderboard, we store the nickname you type (up to 10 letters or numbers) and your score, and they are shown publicly on the leaderboard. Please use a nickname, not your real name. We don't ask for your email address. Your high scores, and the nickname you used, are also saved in your own browser so the game can remember them. Legal basis: your request to take part.
• Atlas Intelligence. The questions you type to our on-site advisor are used to work out an answer. We don't keep them or link them to you.
• Atlas Tools on our own site. Our website uses Atlas Tools like any other customer, so what is in section 5 applies to our own visitors too.

4. Atlas Tools customers

If you have an Atlas Tools account, we collect and use:

• Account details — your email address and sign-in sessions (we use passwordless magic links, or a password if you set one). Legal basis: contract.
• Business details — site name, domain, industry, location, services, opening hours and the settings for each tool. Legal basis: contract.
• Team members — email addresses of people you invite to your account.
• Billing — which tools you have, invoices and payment status. Cards are handled by Stripe; we never see full card numbers. Legal basis: contract and legal obligation. Billing records are kept for six years for tax law.
• Weekly reports — every Friday we email the site's owner a PDF report made from that site's own Atlas Tools data, unless there's nothing to report. Every report email has a one-click link to stop it, and it can be switched off on the Weekly report page; we keep that choice and when each report was sent. If you customise your report (or use the CSV report), we also store the logo you upload (a small image) and your report colours, fonts and sections. For the CSV report we also store the CSV link you give us, or the CSV file you upload, and which columns to use; a link is read again each week when the report is made. Please only use a CSV you have the right to share with us, and avoid personal details in it. Reports are made fresh each week and emailed to you; we don't keep copies. Legal basis: contract.
• Backlinks Manager — the websites you're considering for links, your status and notes on each, the outreach emails and press releases our AI drafts for you, and the addresses of pages that link to you. We visit those pages each night to check your link is still there. Please keep notes to business contact details. Legal basis: contract.
• Connected accounts — if you connect Google (section 6), a review listing or a WordPress/Shopify store, we store the access needed to run that tool, encrypted.
• Support — messages you send to our help assistant, problem reports and any screenshots you attach, so we can fix things. Legal basis: contract and legitimate interest.
• Usage — which tools you use and how much AI you use, to keep the service running and fairly priced. Legal basis: legitimate interest.
• How you found us — only if you accepted cookies on our banner: the campaign that brought you to us (for example “google / cpc / spring-offer”) is saved with your account when you sign up, so we know which of our marketing works. If you accepted advertising cookies, we also keep the advert's click reference and tell the advertising platform when you start paying: Google receives the click reference and the date and amount; Meta receives a scrambled (hashed) copy of your email address, its own cookie reference, the date and the amount. Neither receives your name or card details. Legal basis: your consent.

We do not sell personal data, and we do not use your or your visitors' data to train AI models.

5. Visitors to our customers' websites

Which of these applies depends on the tools the business has switched on. In each case the business is the controller (section 2).

• Chatbot — the messages you type and anything you choose to share (such as a name or phone number). In the AI versions, messages are sent to our AI provider so it can write a reply.
• Contact form, “Get a quote” tab and lead quiz — the details and answers you submit, and the page you were on. They are emailed to the business and stored in its Leads inbox, and you may get an automatic reply.
• Online booking — your name, email address, phone number, any notes, your time zone and the time you book. You receive confirmation and reminder emails. If the business has connected Google Calendar, the booking is added to its calendar.
• Reviews — if a business asks you for a review, we email the request to the address it gave us, and keep your rating and any private feedback you send.
• Play to win (prize wheel or slot machine) — your email address and the result. Each email can play once.
• Heatmaps — anonymous information about a visit: the page, whether it was a phone or a computer, how far down the page the screen reached, where clicks landed, how long you stayed, and which form fields were touched or left unfinished. We never record what you type, and there are no cookies and no personal profile. We skip visitors whose browser sends Do Not Track or Global Privacy Control. Visits are deleted after 90 days.
• Live activity — counts each visit once, as a plain number per day for the business's “visits today” figure; nothing about who you are is kept. Its notifications are built from activity the business already holds and never show a visitor's name, email or phone number — only the name a reviewer published with their review, shortened (for example “Sarah T.”).
• Top bar, Schema Generator, Site Intelligence — no personal data from visitors.

Information stored in your browser. The Atlas script sets no cookies on a customer's website. It does keep a few small notes in your browser's session or local storage — for example that you closed a top bar, started a quiz, or have already played a prize game — so a pop-up doesn't keep appearing. They contain no personal details and aren't used to track you across websites. Details are on our Cookie Policy.

IP addresses. We use IP addresses briefly to stop abuse (for example, limiting how fast something can be submitted). They are held only for the length of the limit — about a minute — and are not stored with your submission.

6. Google user data

If a customer connects a Google account, we ask for the minimum access each feature needs:

• Search Console (read-only) — to show the customer its own search queries, clicks and rankings in Site Intelligence.
• Google Calendar — to see whether times are busy (so they aren't offered for booking), and to add, change or remove the booking events we create, including Google Meet links. We do not read the details of other events or share them.
• The Google account's email address, only to show which account is connected.

We use this information only to provide those features to that customer. We don't sell it, use it for advertising, or let people read it except where the customer asks, where needed for security or support, or where the law requires. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Access tokens are stored encrypted. You can disconnect at any time from the tool's page in your dashboard, or remove access at myaccount.google.com/permissions.

7. Cookies and similar technology

Our own sites and dashboard use a small number of cookies, most of them strictly necessary (keeping you signed in; remembering a plan you were looking at). Analytics (Google Analytics) and advertising (Google Ads, Meta) cookies are used only if you accept them. The full list, with what each does and how long it lasts, is on our Cookie Policy.

8. Who processes data for us

We use a small number of service providers (“subprocessors”), each only for the job described:

• Vercel — hosting and website analytics
• Supabase — database hosting
• Stripe — payments
• Resend — sending emails (confirmations, reminders, reports, replies)
• Anthropic — AI text for the AI chatbot, content tools, suggestions and the help assistant
• Google — Search Console, Calendar, Places, PageSpeed and Business Profile where those tools are used; Google Analytics and Google Ads measurement on our own sites if you accept those cookies; and Gemini where a customer has chosen to use it
• Meta Platforms — measuring our Facebook and Instagram adverts, only if you accept advertising cookies
• Upstash — short-lived counters that limit abuse
• Our email provider — for messages sent to general@atlasstudiosuk.com

Some of these are based outside the UK, mainly in the United States. Where personal data leaves the UK, we rely on UK adequacy arrangements or the UK International Data Transfer Agreement or Addendum, together with the provider's own safeguards.

9. How long we keep data

• Account and settings: while your account is active, then deleted on request after closure.
• Visitor data a customer collects (chats, leads, bookings, game entries, review requests): while the tool is active so the customer can use it, and deleted when they delete it or close their account.
• Heatmap visits: 90 days.
• Enquiries to us that don't become a contract: up to 12 months after we last spoke.
• Billing and tax records: six years.

10. If you use Heatmaps (customers)

As the controller of your visitors' data, your own privacy policy should mention it. Suggested wording: “We record anonymous clicks and scrolling on this website to improve it. We don't record what you type, and we don't use cookies for this.” The same goes for any other tool that collects visitor details, such as forms, chat, bookings and prize games. This isn't legal advice for your business.

11. Your rights

Under UK data protection law you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict how it is used, ask for it in a portable format, and withdraw consent where we rely on it. Email general@atlasstudiosuk.com and we'll reply within one month. If you aren't happy, you can complain to the Information Commissioner's Office at ico.org.uk.

12. Security

Data is encrypted in transit (HTTPS) and at rest. Third-party access tokens are encrypted again within our application. Access to production data is limited to people who need it to run the service. If a breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.

13. Children

Our services are for businesses and aren't aimed at children. We don't knowingly collect children's personal data.

14. Changes

We'll post any changes here and update the date above. We'll email account holders about material changes before they take effect.