1. Controller and scope
ART ATLAS PRESTACAO DE SERVICOS DE TECNOLOGIA LTDA, CNPJ 68.495.144/0001-08, is responsible for the personal-data processing described in this policy. Address: Rua Uruguai, 297, apto. 501, Tijuca, Rio de Janeiro/RJ, CEP 20510-055, Brazil. Privacy and support contact: contato@artatlas.com.br.
This policy covers visitors, account holders, people who contact us, and individuals whose personal data appears in catalog source material, such as artists and other identified people. It forms part of the same publication as the Terms & Conditions. Acknowledging the policy is not blanket consent. Where consent is legally required for a specific purpose, it must be requested separately and can be withdrawn as provided by law.
2. Data we process
Depending on how you use Art Atlas, we process:
- Account and authentication: name, email, password hash when a password is set, language, authentication and confirmation records, session tokens, and account changes. We do not store a plaintext account password.
- Personalization: selected artists and interests, preferences, favorites, and mathematical representations of preferences used for recommendations (embeddings).
- Conversations and submissions: questions, messages, images and other attachments, conversation history, generated responses, and associated technical records. Content may include personal data you choose to submit.
- Billing and legal evidence: Stripe customer, subscription and payment identifiers, subscription state, billing and usage records, and the version and time of Terms acceptance. Card entry occurs in Stripe's hosted payment flow; Art Atlas does not store full card numbers or security codes.
- Operations and support: notifications and read status, support correspondence, access and security records, and error diagnostics, which can include technical request information and an account identifier.
- Catalog: names, biographies, attribution, provenance, images, and related information obtained from public sources or supplied material. Public availability does not remove applicable personal-data rights.
Provide only data necessary for your request. Avoid sensitive personal data and confidential information in uploads or conversations, including information about other people without an appropriate legal basis.
3. Purposes and legal grounds
We process data to create and secure accounts, authenticate users, provide catalog access, personalize recommendations, deliver AI conversations, send operational notifications, administer subscriptions, answer requests, and maintain the service. The legal ground is performance of the contract or steps requested before contracting where applicable.
We also process data to comply with legal and regulatory obligations, keep necessary financial and acceptance evidence, and exercise rights in administrative, judicial, or arbitration proceedings. Security, fraud prevention, diagnostics, and the organization of relevant public catalog information may rely on legitimate interests after considering necessity, context, reasonable expectations, and the rights of affected people. Where another legal ground or specific consent is required, that requirement applies; accepting Terms does not replace it. We do not use this policy to authorize unrestricted new purposes.
4. Providers and sharing
We use infrastructure, storage, communications, payment, search, AI, and monitoring providers as needed for the relevant feature:
- Stripe processes hosted payments and subscription management.
- Resend delivers service emails; Tigris stores files and images.
- OpenRouter and its model providers, OpenAI, Modal, and Serper support AI, embeddings, image processing, and web research. Depending on the feature, messages, relevant conversation history, images, search queries, and related context are transmitted for processing. Do not assume these submissions stay only on Art Atlas servers.
- Sentry, when enabled, receives error diagnostics. We apply filtering to reduce exposure, but diagnostics may still contain an internal user identifier and technical context; this is not a promise of full anonymity.
Providers receive data according to the operation being performed and may have their own legal obligations and privacy terms. We may also disclose necessary data to comply with lawful requests, protect rights, or respond to security incidents, subject to applicable law. Contact us for information about sharing concerning your data.
Some providers and their infrastructure process or store data outside Brazil. Such processing is subject to the LGPD's international-transfer requirements. You may request information about destinations, recipients, and the applicable transfer arrangements through our contact channel. This policy does not assert that a particular contractual safeguard applies to every provider or every operation.
5. Cookies and recommendations
Art Atlas uses session and authentication cookies, an optional remember-me cookie, and a language-preference cookie to operate the service and preserve your choices. Blocking or deleting them in your browser can sign you out or impair features. This publication does not introduce advertising or marketing analytics cookies. Third-party hosted services, including payment pages, may use their own cookies under their notices.
Preferences and favorites can inform automated recommendations and search ranking. These suggestions are informational. If a decision based solely on automated processing affects your interests, you may request review and information about the criteria and procedures, subject to applicable legal protections.
6. Retention, deletion, and security
We retain data according to the purpose, the account and service relationship, applicable legal duties, limitation periods for claims, security needs, and the necessity of evidence. Different categories have different retention needs; we do not promise one universal retention period. When retention is no longer justified, data should be deleted or anonymized under applicable law.
Self-service account deletion anonymizes account fields and removes authentication tokens and personalization such as favorites and the taste profile. It does not immediately erase every linked record. Conversation history, attachments, notifications, financial and usage records, Terms acceptance evidence, and payment identifiers may remain. Contact us for requests concerning these records; we assess deletion, anonymization, restriction, and any justified retention individually. Deleting an account is not a substitute for checking subscription cancellation or requesting a legally due refund.
We use technical and organizational measures to protect data, including access controls and authentication protections. No system is immune to incidents. We handle incidents and communications to affected people and authorities as required by applicable law.
7. Your rights
Under the LGPD, as applicable, you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data, portability subject to regulation, information about sharing, and information about consent and the consequences of refusing it. Where processing relies on consent, you may withdraw it and request deletion subject to lawful retention exceptions. You may object to processing that fails to comply with the law and request review of qualifying automated decisions.
Send requests to contato@artatlas.com.br, explaining what you need and, for catalog material, the relevant page or record. We may request proportionate identity verification to protect your data and will explain any lawful limitation. These rights also apply to people without an Art Atlas account. You may contact the Brazilian National Data Protection Authority (ANPD) or competent consumer-protection bodies without first waiving any other remedy.
8. Updates
This policy and the Terms share one version and publication. Updates are published together through the same version and acceptance mechanism, preserving historical documents and previous acceptance evidence. Policy acknowledgment does not convert processing into consent or remove rights relating to earlier processing. Keep a copy of the version relevant to you and contact us with questions.