Privacy policy

Overview

This policy explains what personal data Atlaned collects when you visit atlaned.com, request early access, contact us, or use the Atlaned platform, and what we do with it. We collect only what we need to run the service, we do not sell personal data, and we do not use your project data to train models or for advertising.

Who we are

Atlaned Inc., a federally incorporated Canadian company based in Ontario ("Atlaned", "we", "us"), is responsible for personal data processed through our website, early-access programme, and account administration. We handle personal data in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in the European Economic Area and the United Kingdom, the GDPR and UK GDPR.

When an organisation uses the Atlaned platform, the data its users upload into projects is processed on that organisation's behalf. For that data, the organisation is the controller and Atlaned acts as its processor. See Project data.

Data we collect

Data you give us

Early-access requests — full name, work email, company, role, country, and whether you are open to a call as a design partner.
Contact and sales enquiries — name, email, company, country, and the content of your message.
Account data — name, email, organisation, role, authentication details, and your preferences in the platform.
Feedback and support — ratings and comments you submit on our learning resources, and the content of support conversations.

Data collected automatically

Technical data — IP address, browser and device type, operating system, and request timestamps, recorded in server and security logs.
Usage data — pages visited and features used, collected through privacy-respecting analytics only if you consent to analytics cookies.
Bot protection — our forms use Cloudflare Turnstile, which evaluates browser signals to tell people from automated traffic.

How we use data

Review early-access requests, onboard invited teams, and run the design-partner programme.
Provide, maintain, and secure the platform, including authentication and access control.
Answer enquiries and provide support.
Send service messages such as invitations, account notices, and security alerts.
Understand how the site and platform are used so we can fix problems and improve them.
Detect and prevent abuse, fraud, and security incidents.
Meet legal, accounting, and regulatory obligations.

We only send product updates or marketing email where you have asked for them or where the law allows it, and every such message includes a way to unsubscribe.

Legal bases

In Canada, we collect, use, and disclose personal data with your consent, which may be express or implied depending on the sensitivity of the data and the context, or as otherwise permitted by law. If you are in the EEA or the UK, we rely on the following legal bases under the GDPR:

Contract — to provide the platform to you and your organisation and to take steps you request before entering into an agreement, such as joining early access.
Legitimate interests — to secure our services, prevent abuse, answer business enquiries, and improve our products, where those interests are not overridden by yours.
Consent — for non-essential cookies, analytics, and optional marketing email. You can withdraw consent at any time.
Legal obligation — to keep records required by tax and corporate law.

Project data

Project data means the boreholes, CPT and SPT records, laboratory results, cross-sections, slope models, reports, and other content your organisation uploads or creates in the platform. We process it only to provide the service and on your organisation's instructions, as set out in our Terms of service and, where agreed, a Data Processing Agreement.

We do not sell project data, share it with other customers, or use it to train machine learning models. Requests from individuals about personal data contained in project data should go to the organisation that controls it; we will help them respond.

We share personal data only with service providers that help us run Atlaned, under written agreements that limit their use of the data to the services they provide to us. These include providers of cloud hosting and content delivery, database services, bot protection, email delivery, error monitoring, and support tooling.

We may also disclose data where required by law, to protect the rights and safety of our users or others, or as part of a merger, acquisition, or sale of assets, in which case we will notify you before your data becomes subject to a different policy. The current list of sub-processors is available on request at privacy@atlaned.com.

International transfers

Atlaned is based in Canada, and we and our service providers may process personal data in Canada, the European Union, the United States, and other countries. Data processed outside your country may be accessible to courts and authorities there under local law.

For data from the EEA, the UK, or Switzerland, transfers to Atlaned in Canada rely on Canada's adequacy status. Onward transfers to other countries rely on an adequacy decision, such as the EU-US Data Privacy Framework, or on Standard Contractual Clauses with supplementary measures where needed.

Retention

Early-access requests — kept while the early-access programme runs and deleted within 12 months of it ending if you do not become a customer.
Enquiries — kept for up to 24 months after our last exchange.
Account and project data — kept for the duration of your organisation's subscription, then deleted within 90 days of termination unless your organisation asks us to delete it sooner or the law requires us to keep it.
Security logs — kept for up to 12 months.
Billing records — kept for 6 years, as required by Canadian tax law.

Security

We protect personal data with encryption in transit and at rest, least-privilege access, multi-factor authentication for staff, and continuous monitoring. Read more on our Security page.

Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you and receive a copy of it;
correct data that is inaccurate or incomplete;
have your data deleted;
restrict or object to our processing, including for direct marketing;
receive your data in a portable format;
withdraw consent at any time, subject to legal or contractual restrictions and without affecting earlier processing.

To exercise these rights, email privacy@atlaned.com. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada. If you are in the EEA or the UK, you can also complain to the data protection authority where you live or work.

Cookies

We use strictly necessary cookies to run the site and platform, and functional, analytics, and marketing cookies only with your consent. See our Cookie preferences page for the full list and to change your choices.

Children

Atlaned is a professional tool and is not directed at children under 16. We do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

Changes

We update this policy when our practices change. The effective date at the top of this page reflects the most recent revision. If a change materially affects how we use your personal data, we will notify account holders by email before it takes effect.

Contact

Atlaned Inc.
Attn: Privacy
Ontario, Canada
privacy@atlaned.com