Space Atlas

Space Atlas

PricingSign in

Privacy Policy

Last updated: 2 November 2026 1. Who is responsible Space Atlas is operated by [TO COMPLETE: legal name] (tax ID [TO COMPLETE: NIF/CIF]), [TO COMPLETE: postal address], Spain, the data controller for the processing described here. Privacy contact: [TO COMPLETE: contact email]. 2. Data we collect Account email, display name, account identifiers and Terms acceptance time/version; favorites; correction suggestions and supporting sources; saved country groups; submissions and feedback. Authentication also processes credentials securely. Technical requests may expose IP addresses, device/browser information and security logs to hosting and map providers. We measure page visits with Vercel Web Analytics, which uses no cookies and does not identify you (visits are counted with a daily-rotating anonymous hash). Only if you accept analytics cookies, Google Analytics 4 (Google Ireland Limited) also collects usage data such as pages viewed, approximate location, device and browser, linked to a random cookie identifier; IP addresses are not stored by Google Analytics 4. Without consent no Google Analytics cookies are set and Google receives only cookieless, aggregated signals (Consent Mode). The legal basis is your consent, which you can withdraw at any time via "Cookie settings" in the footer. Our hosting and database providers keep technical logs (request time, path, IP address, browser and error details) for security and troubleshooting. Plan/subscription details (effective plan, manually assigned status, dates and notes), monthly usage counts per research/export action, and waitlist email, desired plan, optional company/message and join date are stored. Reports are not yet stored. Waitlist details are used for the launch notification you request; monthly counts enforce plan allowances. Monthly usage counts are kept while your account exists. Waitlist entries are kept until we send the launch notification or you ask us to remove them, and at most 24 months. If you buy the full dataset we store the purchase status, amount, Stripe session identifier, access period and number of downloads. Paid subscriptions are processed by Stripe Payments Europe, Ltd. When you subscribe we store your Stripe customer and subscription identifiers, plan, status and billing-period dates. Stripe collects and holds your card or other payment details, billing name and address, email and any tax ID you provide; we never receive full card numbers. Stripe also uses payment data for fraud prevention as an independent controller under its own privacy policy. Invoices and billing records are kept for as long as tax and accounting law requires (in Spain, generally up to six years). 3. Purposes and legal bases Providing accounts, saved favorites, research tools and paid subscriptions: performance of a contract (GDPR Article 6(1)(b)). Security, abuse prevention and maintaining the directory: legitimate interests (Article 6(1)(f)), subject to your rights. Legal/accounting obligations: Article 6(1)(c) where applicable. Analytics cookies (Google Analytics 4): consent (Article 6(1)(a)). Our legitimate interests are keeping the service secure, preventing abuse and keeping the public directory accurate; they do not override your rights, and you can object at any time. We do not send marketing emails without your consent. Agreement to our Terms is not consent to optional tracking or marketing. 4. Storage and retention Account data is retained while your account is active, and removed when you delete it. Account deletion removes owned application records and the authentication account, including related suggestion history; published factual entity information may remain without a link to your account. Technical and security logs are kept by our providers for limited periods under their own schedules, normally no more than 90 days. Database backups are rotated automatically, so deleted data disappears from them within their rotation period (normally no more than 30 days). Unconfirmed sign-ups and inactive accounts are kept until deleted; we may delete accounts inactive for more than three years after notifying you. Billing and tax records are kept as long as the law requires. 5. Processors and recipients Authentication and database: Supabase, Inc., with data hosted in the European Union (Ireland). Website hosting: Vercel Inc. (United States), served through its global network. Transactional email (account confirmation and password reset): Supabase Auth and Resend (Plus Five Five, Inc., United States). Map requests: EOX, OpenFreeMap/OpenStreetMap and NASA imagery services where enabled; providers receive request/network data according to their policies. Payments: Stripe Payments Europe, Ltd. (Ireland). Analytics (with consent only): Google Ireland Limited (Google Analytics 4). External logo/image hosts may receive your IP address when images load. Processors act on our instructions under data processing agreements. We do not sell personal data and only disclose it to the providers above, to professional advisers bound by confidentiality, or where the law requires it. 6. International transfers Our database is in the EU. Some providers (Vercel, Resend, Google, Stripe and Supabase for support and operations) may process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards such as encryption in transit. You can request a copy of the relevant safeguards at [TO COMPLETE: contact email]. 7. Your rights You may request access, rectification, erasure, portability, restriction and objection where applicable, and withdraw optional consent without affecting earlier lawful processing. Change your display name, download your personal data or delete your account in My dashboard → Account. Admin accounts require an assisted deletion request. Contact [TO COMPLETE: contact email] for other requests; write from your account email so we can confirm your identity. We answer within one month (extendable by two months for complex requests) and will explain if a legal exception applies. You may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority where you live. 8. Cookies, children and changes We use essential cookies/browser storage and, only with your consent, Google Analytics cookies; see the Cookies Policy. Space Atlas is a professional research tool and is not intended for anyone under 16; we do not knowingly collect children's data and will delete it if we learn of it. Material changes will be reflected in this policy with a new date and, for signed-in users, notified in the app or by email. A new Terms version requires renewed acceptance.