Privacy Policy

1Overview

This policy explains what personal data Atlas Security (“Atlas”) collects, why, who receives it, how long we keep it and how you use your rights. It is written to align with the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree No. M/19 of 1443H) and its Implementing Regulations (the “PDPL”) and, for visitors and customers in the European Economic Area and the United Kingdom, the GDPR.

2Who we are and in what role

Atlas is established in Jeddah, Kingdom of Saudi Arabia. Contact: [email protected]. We act in two roles, and the difference matters for who you ask:

• Controller for the personal data of people who visit our website, hold an Atlas account (customers, resellers and staff), buy from us, or contact us.
• Processor for the personal data of End Users: the people who run software that a seller protects with Atlas Authenticator. The seller decides what is collected and why, and is the controller. If you are an End User, ask the seller first; we help them answer you under the Data Processing Agreement. The one exception is the optional network flag list in section 3.

3What we collect

Account holders and customers

• Account

  Why

  Create and run your account

  Notes

  Username, email address, profile picture, plan, organization name and ID. Signing in with Google, or linking Discord, adds the identifier and the email or username those providers return.

• Password

  Why

  Sign you in

  Notes

  Stored only as a bcrypt hash (cost factor 10). We cannot read it.

• Passkeys

  Why

  Passwordless sign-in

  Notes

  The credential ID, public key, name you gave it, transport hints, whether it is backed up and when it was last used. The private key and your fingerprint or face never leave your device.

• Sign-in and activity history

  Why

  Security, fraud prevention, your own history

  Notes

  Time, IP address, approximate location, user agent and the action, for sign-ins and for changes made on your account.

• Sessions

  Why

  Keep you signed in, let you sign devices out

  Notes

  IP address, user agent, creation and last-use time, and a link to the device record.

• Device records

  Why

  Recognise your devices, warn you about new ones, protect accounts

  Notes

  See section 4 for the full list.

• Purchases

  Why

  Deliver what you bought, accounting

  Notes

  Product, amount, payment method (PayPal or cryptocurrency), the name you give at checkout and the payment’s transaction identifier. A PayPal payment is made on PayPal’s own pages; PayPal tells us the transaction identifier, the amount, your PayPal email address, payer identifier and country, and any refund or reversal, and we keep them with the order. A crypto payment goes from your wallet to ours and is recorded on a public blockchain, which we cannot erase.

• Obfuscator uploads

  Why

  Protect your binary

  Notes

  The compiled files you upload and the protected builds. They are processed on our own servers, shared with no third party, and deleted 24 hours after the job is created.

• Applications and licences you manage

  Why

  Run the Services for you

  Notes

  Your application settings, license keys, API keys, resellers, bans and logs. This is also where End User data sits (below).

• Support and community

  Why

  Answer you, run the forum and chat

  Notes

  Tickets, messages to our team, forum posts and public chat messages (visible to others), and Discord details if you link Discord.

• Notifications and emails

  Why

  Tell you what happened on your account

  Notes

  What we sent, your delivery preferences, and the content of transactional email.

• Product email

  Why

  Send the news and offers you chose to receive

  Notes

  Your email address, the wording you agreed to and when, which of these emails we sent you, and which links in them you clicked, so that we stop sending what you ignore and can count what works. There is no tracking pixel and no third party in the click count. We choose the time of day from the hour you last used Atlas, test two subject lines against each other, and keep the personal discount code made for you. These emails come from [email protected] and are relayed through Google (see Subprocessors). Every email has an unsubscribe link, and you can also turn it off in Account, Notifications or by writing to [email protected]. Account, security and billing emails are separate and keep arriving.

• Referrals and attribution

  Why

  Credit a referral or the landing page that brought you

  Notes

  A referral code or landing-page tag, only if you allowed Attribution in the cookie settings.

• Consent and data requests

  Why

  Prove what you agreed to and how we handled a request

  Notes

  Your cookie choice under a random browser ID with no IP address. At signup, your confirmation that you are 18 or older, the version of the Terms you accepted, the time and IP address, and whether you opted in to product email. Each data request, with its reference, type, status and the staff member who handled it.

People who visit the website

• Our network provider and web server log the IP address, time, page and browser of each request, to deliver the site and to detect attacks.
• On the sign-in, registration and password-reset pages, Cloudflare Turnstile checks that the visitor is not a bot. Cloudflare receives your IP address and browser signals for that check and handles them under its own privacy policy; we receive only whether the check passed.
• With your permission (Analytics in the cookie settings) we count visits to the public pages with our own self-hosted tool: the page, the referrer, browser, system, device type, screen size and country. It sets no cookie and stores no IP address, and it never runs on account, dashboard, sign-in or checkout pages.

End Users of software protected with Atlas Authenticator

When an End User runs a protected application, the Atlas library sends the following to our authentication servers over an encrypted connection. The seller chooses the sign-in mode, so which of these exist for a given End User depends on the seller’s application:

• License key, or username, email address and password for account-mode applications. The seller can manage these in their dashboard. Account-mode passwords are stored only as bcrypt hashes, so neither the seller nor we can read them.
• The hardware identifiers and combined fingerprint described in section 4, the computer name and Windows user name, and a hash of the application executable.
• The IP address, the country and city derived from it, whether the address looks like a VPN, proxy or hosting network, and the outcome and time of each sign-in attempt.
• Network flags, only for applications whose seller turned them on (they are off by default). When a machine signs in with an executable that is not on the seller’s list, Atlas records its hardware identifier against that application. A machine reported by at least three such applications from at least two different organisations within 90 days is flagged to every application that turned the feature on, and the seller’s own rule decides whether anything is blocked. Atlas decides the purpose and means of this shared list, so for it Atlas is a controller, not only a processor. Reports are deleted after 120 days. A seller can allow a machine that was flagged wrongly, and you can ask us to review a flag at [email protected].
• The program’s trace log and its start-up checks (Windows version, hardware summary, time zone, the hosts-file entry for our server name, and the firewall rules that could block the connection) stay on the End User’s computer. They are not sent to us. The checks only read these settings and change nothing.

4Devices and hardware

Your devices, when you sign in to your Atlas account

After you sign in, your browser reports details about itself and we record them as a device record: the browser and system, device type and model, screen size and pixel density, graphics card, processor cores and memory, time zone, languages, installed fonts, display and accessibility preferences, the number of audio and video devices (never their contents), connection type, whether the browser is automated, and a fingerprint value derived from stable details. We add the parsed user agent, the IP address, the approximate location, the network provider and whether the address is a VPN, proxy or hosting network, and a random device ID that we also keep in a cookie (atlas_did).

We use it to tell you when a sign-in comes from a device we have not seen, to catch account sharing and ban evasion, and to investigate fraud. A match between two accounts is a signal for a person to review, not a verdict. You can see every field in Account, Privacy and data, remove a record, or turn the Security category off in the cookie settings, which stops new records from that browser. We never ask for camera, microphone, location or other permissions, and we do not read your browsing history, other tabs or files. We use device records only for account security and fraud prevention, never to profile you for advertising or to pass to advertisers. We treat the device record as necessary to keep the account you asked us to open secure; it is made only after you sign in, and you can switch it off in the cookie settings.

Hardware identifiers of End Users

The identifiers are: the Windows machine GUID, the boot disk GUID, the C: volume serial, the Windows product ID, the GUIDs of all physical disks, the MAC addresses of physical network adapters, the USB controller IDs, the SMBIOS UUID, the motherboard serial, the BIOS or chassis serial, a fingerprint of the TPM, the graphics adapter ID, the monitor serial from its EDID, the audio device IDs, the machine SID and the storage controller ID. They identify a machine, and so, indirectly, a person. What End Users are told, and the legal basis for collecting it, are the seller’s responsibility; see the DPA.

5Why we use it

• Create and run accounts, deliver the Services, take payment, give support

  Basis (PDPL and GDPR)

  Performance of a contract

• Account and platform security, fraud and abuse prevention, license enforcement, device records, hardware bans, network flags

  Basis (PDPL and GDPR)

  Legitimate interests (securing the Services and our customers’ software). You can object; see section 12

• Financial and tax records, responding to lawful requests

  Basis (PDPL and GDPR)

  Legal obligation

• Analytics on public pages, attribution, product email

  Basis (PDPL and GDPR)

  Consent. Product email is sent only if you tick the box at signup (it starts ticked only where the law allows that) or turn it on in Account, Notifications, and you can withdraw any consent in the cookie settings or in Notifications

For End Users we act on the seller’s instructions; the seller’s basis (usually its legitimate interest in enforcing its licences) is the basis for that processing.

6Automated decisions

Some protective actions run without a person: sellers can set alert rules that ban a license, hardware identifier or IP address automatically (for example on an unauthorised executable hash, repeated failed sign-ins or a geofence violation), sessions can be refused for VPN, proxy or blocked-country addresses, and sessions that look tampered with can be ended. A ban can stop an End User from using a seller’s software. A person can review any of them: ask the seller or contact us.

7Cookies and similar technologies

Essential storage keeps you signed in and remembers your choices. Two optional cookies exist: atlas_did(Security: recognises your device) and atlas_seo (Attribution: which landing page brought you). Analytics sets no cookie. You choose in the banner, and you can change it at any time with Cookie settings in the footer. Each change is recorded with a random ID and the version of this policy, so we can show what you agreed to. The full list, with durations, is in the Cookie Policy.

8Who receives it

We do not sell personal data. We share it only with:

• Subprocessors that help us run the Services: Cloudflare, PayPal, Google, Discord and IP intelligence providers. What each receives and why is on the Subprocessors page.
• PayPal, the payment service for PayPal payments. It receives what you enter on its own pages and handles it under its own privacy statement as an independent controller. We receive the transaction identifier, the amount, your PayPal email address, payer identifier and country.
• The seller, for End Users: the seller sees the sign-in, hardware and network data of the people who use their software.
• Our staff, as their position allows. Staff access is limited by role and every staff action on an account is logged.
• Authorities and advisers where a valid legal order or the protection of our rights requires it, limited to what is needed.

9Transfers

Our servers are operated by Atlas in the Kingdom of Saudi Arabia. Web traffic passes through Cloudflare’s global network, and the subprocessors above process data in other countries. Where a transfer needs a legal mechanism under the PDPL or the GDPR we rely on one the law allows, such as an adequacy decision, the recipient’s standard contractual clauses or your consent, and you can ask us which.

10How long we keep it

• Account, profile, notifications

  Kept

  While the account exists. See section 12 for what deletion removes and what stays

• Sign-in and activity history

  Kept

  365 days in the live database, then in compressed archive files until the month they cover is two years old, then deleted

• Staff action logs

  Kept

  730 days in the live database, then archived for up to five years in total, then deleted

• End User sign-in logs (auth servers)

  Kept

  180 days in the live database, then in archive files until the month they cover is two years old, then deleted

• End User alert-rule history, client-submitted logs and ended sessions (auth servers)

  Kept

  90 days, then deleted

• End User sign-in codes, password-reset codes and the emails that carried them

  Kept

  The code record 30 days after it is used or expires, the queued email 14 days after it is sent

• Bans that expired

  Kept

  Deleted a year after they expire

• End User license and account records

  Kept

  Until the seller deletes them or resets or deletes the application

• End User hardware identifiers

  Kept

  Deleted with the license when the seller deletes it, and with the application when it is reset or deleted

• Network flag reports (applications that turned them on)

  Kept

  Deleted after 120 days. Only the last 90 days count toward a flag

• Device records

  Kept

  Until you forget them or the account is deleted. Each keeps its ten most recent IP addresses

• Sessions

  Kept

  While the account exists. Revoked sessions stop working immediately

• Obfuscator uploads and protected builds

  Kept

  Deleted 24 hours after the job is created, on every plan

• Purchases and invoices

  Kept

  Six years from the purchase, or as financial and tax law requires

• Consent records and data requests

  Kept

  As long as needed to show what you agreed to and how we answered

• Nightly database backups

  Kept

  14 days, so data you delete from the live database can remain in a backup for up to 14 days

11Security

• The website and API use HTTPS. The connection between a protected application and our authentication servers uses its own encrypted channel: an X25519 key exchange, a pinned Ed25519 server key and HMAC-authenticated messages.
• Account passwords are hashed with bcrypt. Sessions can be revoked, and a password sign-in needs an approval from a link we email you, unless the device is one you marked as trusted. Passkeys are supported.
• Requests to the API are signed and rate limited. Staff access is role based, destructive staff actions need a PIN, and staff actions are logged.
• End User account passwords are stored as bcrypt hashes, and End User hardware identifiers as keyed HMAC-SHA-256 hashes.
• Data on our servers is not separately encrypted at rest. The database is backed up every night; each backup is encrypted (AES-256) and the last 14 are kept.

The platform’s measures are described, checked against the code, at atlas.se.net/security. No system is perfectly secure. If a breach affects your data we assess it as soon as we learn of it, and tell you and the authority within the deadlines the law sets, including 72 hours to the authority under the GDPR where it applies.

12Your rights

You may ask for a copy of your data, correction, deletion, to object to processing based on our legitimate interests, and to restrict processing while a request is decided. You may withdraw consent at any time. The data copy is a machine-readable JSON file and covers the account, sessions, devices, passkeys, notifications, purchases, linked Discord account, activity history and your data requests.

• How: sign in and open Account, Privacy and data. Each request gets a reference and a due date. Filing needs a recent sign-in or your password, so nobody else can ask for your data. The page shows the status of every request, and a copy of your data is released there for seven days once approved.
• Deletion: scheduling account deletion in Security also creates a deletion request, which you can cancel for seven days. When that window ends we delete the account automatically, and a deletion request filed here is carried out within 30 days. Deletion removes your applications and their licenses and End User records, sessions, passkeys, devices, notifications, support tickets, chat messages, Discord link, obfuscator jobs and activity history, and strips your name, email, password, picture and IP address from the account record. What stays: the order records the law requires us to keep (buyer details, amounts and payment identifiers, six years), a record that the deletion happened, and your forum posts as “[deleted]”. If a payment, a staff role or an unpaid referral balance blocks deletion we tell you what to resolve.
• Without an account, or as an End User: email [email protected]. For End User data we pass the request to the seller.
• Time: we answer within 30 days. If we decline, we tell you why.
• Complaints: you may complain to the competent authority: in Saudi Arabia the Saudi Data and AI Authority (SDAIA); in the EEA or UK, the authority where you live or work.

13Children

Atlas is for adults. You must be 18 or older to create an account, and we ask you to confirm it at signup and keep the confirmation. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we close it and delete its data. If you believe a child has given us data, contact [email protected]. What a seller collects from its own customers, including any who are children, is the seller’s responsibility; see the Data Processing Agreement.

14Changes to this policy

When this policy changes, we post the new version here with its effective date. When a change materially affects you, we tell you by email or in the dashboard before it takes effect, and when the cookie policy version changes we ask for your choice again.

15Contact