Atlas Privacy Policy
Last updated: 11 October 2026 · Effective date: 11 October 2026
This Privacy Policy describes how Petrus Horn trading as Horn Software Architects ("we", "us", "our") collects, uses, stores, and protects personal information in connection with Atlas. It applies to all users of Atlas and visitors to this site.
This policy complies with the Protection of Personal Information Act, 4 of 2013 (POPIA) of the Republic of South Africa and, where applicable, the General Data Protection Regulation (GDPR) of the European Union.
1. Who We Are
Responsible Party (POPIA) / Data Controller (GDPR):
Petrus Horn trading as Horn Software Architects
South Africa
Email: hello@hornsoftwarearchitects.co.za
Information Officer (POPIA):
Petrus Horn
Email: hello@hornsoftwarearchitects.co.za
2. What Data We Collect
2.1 Data you give us directly
- — Email address — when you sign up for an account or purchase a subscription
- — Payment information — collected by Lemon Squeezy (our payment processor). We never receive or store your card number
2.2 Data Atlas collects automatically during use
- — Licence key — transmitted to our licence server once per day for session token refresh and tier verification
- — Project ID — a short string you choose transmitted at ingest time to enforce the free-tier project limit. We do not receive your project file paths or source code
- — Tool call counts — anonymous counts of which Atlas tools were used for usage analytics. No code content is included
2.3 Data we do NOT collect
- — Your source code — Atlas indexes your codebase locally. No source code, file contents, function bodies, or variable names are ever transmitted to our servers
- — Browsing data — we do not use tracking pixels or cross-site tracking
3. How We Use Your Data
| Data | Purpose | POPIA basis | GDPR basis |
|---|---|---|---|
| Email address | Account creation, licence key delivery, transactional emails | Processing necessity | Contract performance |
| Email address | Product announcements (with consent) | Consent | Consent |
| Licence key | Verify subscription status, issue daily session tokens | Processing necessity | Legitimate interest |
| Project ID | Enforce free-tier project limits | Processing necessity | Legitimate interest |
| Tool call counts | Product analytics, abuse detection | Legitimate interest | Legitimate interest |
| Payment data | Processed by Lemon Squeezy; we receive order confirmation only | Processing necessity | Contract performance |
4. Data Sharing and Third Parties
We share your data only with:
| Recipient | Purpose | Location |
|---|---|---|
| Lemon Squeezy | Payment processing, subscription management | United States |
| Railway | Hosting our licence server | United States |
| Resend | Transactional email delivery | United States |
We do not sell your personal information. We do not share it with advertising networks.
Cross-border transfers (POPIA Section 72): Where personal information is transferred outside South Africa, we ensure adequate protection through contractual safeguards consistent with POPIA requirements.
Cross-border transfers (GDPR): Transfers to the United States are made under Standard Contractual Clauses or equivalent safeguards.
5. Data Retention
| Data | Retention period |
|---|---|
| Account and email | For the duration of your account, plus 1 year after deletion |
| Licence key records | For the duration of the subscription, plus 3 years for legal/tax compliance |
| Tool call counts | 24 months rolling |
| Payment records | 5 years (tax compliance) |
6. Your Rights
Under POPIA (South African users):
- — Access — request a copy of the personal information we hold about you
- — Correction — request correction of inaccurate information
- — Deletion — request deletion of your personal information (subject to legal retention requirements)
- — Objection — object to processing based on legitimate interest
- — Complaints — lodge a complaint with the Information Regulator of South Africa at www.justice.gov.za/inforeg/
Under GDPR (EEA/UK users):
- — All rights above, plus:
- — Portability — receive your data in a machine-readable format
- — Restriction — request we restrict processing in certain circumstances
- — Complaints — lodge a complaint with your local supervisory authority
To exercise any of these rights, email hello@hornsoftwarearchitects.co.za. We will respond within 30 days.
7. Security
We protect personal information using:
- — TLS encryption for all data in transit
- — Ed25519 cryptographic signing for licence keys
- — Licence server access restricted by API key
- — No plaintext passwords stored (authentication via Lemon Squeezy)
In the event of a data breach affecting your personal information, we will notify you and the relevant regulator within the timeframe required by applicable law.
8. Cookies
This site uses only technically necessary cookies for session management. We do not use advertising or analytics cookies.
9. Children
Atlas is not directed at children under 18. We do not knowingly collect personal information from anyone under 18.
10. Changes to This Policy
We may update this policy. We will notify you by email and by posting the updated policy at this page. The "last updated" date at the top will change. Continued use after the effective date constitutes acceptance.
11. Contact
For privacy questions, data subject requests, or to reach our Information Officer:
Petrus Horn
Email: hello@hornsoftwarearchitects.co.za