Privacy

    Privacy policy

    Last updated 27 August 2026.

    This is an honest draft of how Parallel Labs Ltd ("we") handles personal data when you use Atlasly at atlasly.app. It is not legal advice. Where a fact is missing, it says UNKNOWN rather than guessing.

    Who is the controller

    Parallel Labs Ltd, company number 17193393, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

    Email: parallellabs@atlasly.app.

    We have not named a Data Protection Officer. Whether one will be appointed: UNKNOWN.

    ICO registration number: UNKNOWN.

    What we collect

    Depends on how you use Atlasly.

    If you browse without an account. Pages you visit, approximate location from IP, device and browser data, and analytics events. The live site loads Google Analytics with measurement ID G-9J0XHLSZGR (see index.html and the page HTML).

    If you create an account. Name, email, and authentication data through Clerk. We use Clerk to sign you in. We do not store your password.

    If you run a site or upload files. Addresses, boundaries, and other site inputs you type or draw; project records; and files you upload. Photographs for Image to CAD may be processed on our servers after a local preview. Scans, drawings, and sketches on that tool are converted in the browser on your device. Treat any other upload path as UNKNOWN until listed here.

    If you pay. Billing name, email, and payment status through Stripe. We do not see full card numbers.

    If you email us. The contents of the message, your address, and any files you attach.

    We do not buy marketing lists. We do not claim a customer count or a star rating as personal data.

    Why we use it

    Purpose / Legal basis (UK GDPR):

    • Run the site, keep you signed in, remember projects: Contract, or legitimate interests in operating the service
    • First-pass site screens you request: Contract
    • Paid plans, invoices, fraud checks: Contract; legal obligation for tax records
    • Understand which pages are used (GA4 G-9J0XHLSZGR): Legitimate interests. It runs on every visit and is not behind the cookie banner.
    • Understand how the product is used (PostHog): Consent. It is off until you accept it in the cookie banner, and you can withdraw that below at any time.
    • Reply to email: Legitimate interests, or contract if you are a customer
    • Security and abuse prevention: Legitimate interests

    Processors we actually use

    Verified in the product or live site, not guessed:

    • Clerk for authentication
    • Supabase for application data
    • Stripe for paid plans
    • Google Analytics / gtag measurement ID G-9J0XHLSZGR
    • PostHog for product analytics, EU region
    • Cloudflare Pages hosts the public website

    Of these, only PostHog waits for your consent. Google Analytics runs on every visit. See Cookies below.

    Map tiles, geocoding, and elevation providers may run when you use the map. Exact processor list for those calls: UNKNOWN in this draft. We will name them when confirmed.

    Where data is stored

    Clerk and Stripe are US companies. Google Analytics is a Google service. Supabase project region: UNKNOWN. Whether we use a UK or EU-only region, SCCs, or the UK International Data Transfer Agreement: UNKNOWN. If you need a DPA or a region constraint, email us. Enterprise pricing copy mentions DPA and EU-region discussion; that is a sales conversation, not a claim that EU hosting is already live.

    How long we keep it

    Retention schedule: UNKNOWN. We will add periods for accounts, site files, analytics, and email once they are decided.

    You can ask us to delete an account by emailing parallellabs@atlasly.app. Backup and log copies may remain for a short period. How long: UNKNOWN.

    Cookies

    Atlasly sets cookies or similar storage in two groups. Being exact about which is which matters more than making the list look tidy.

    Always on, no choice offered:

    • Sign-in (Clerk), to keep you logged in.
    • Hosting and security (Cloudflare).
    • Your cookie choice itself, so we do not ask on every page.
    • Google Analytics (G-9J0XHLSZGR). This is analytics rather than strictly necessary, and we run it on every visit under legitimate interests. It is not behind the cookie banner. You can block it in your browser or with an extension. Whether we will move it behind consent: UNKNOWN.

    Off until you accept:

    • PostHog (EU region), including a visitor id that links your events across sessions. Typing in the product is masked in session replay.

    Before you accept, PostHog is not loaded at all — no script, no cookie, no request — and product events carry no identifier that links your visits. Refusing does not reduce what the product does.

    A full cookie table (name, duration, type): UNKNOWN. We will add it rather than guess at it.

    Withdrawing reloads the page, so anything already loaded is gone rather than merely switched off.

    Your rights

    Under UK GDPR you can ask to access, correct, delete, or restrict your personal data, to object to some processing, and to receive a copy (data portability) where that right applies. You can complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint).

    We will need enough information to find your account. Do not send extra identity documents unless we ask.

    Children

    Atlasly is aimed at practising architects and related professionals, not at children. We do not knowingly collect data from children.

    Changes

    We will update this page when the facts change. The date at the top is the draft date. Email us if something here is wrong.