Privacy
1. Who is responsible
The controller for your data in Atlas is Promi New Face UG (haftungsbeschränkt), Kolkmannskamp 9, 44879 Bochum, Germany, Germany. Register: Amtsgericht Bochum, HRB 21427, VAT ID DE450235975. Managing director: Attila Lőrincz. Email: prominewface@gmail.com. See the imprint.
Atlas is the content dashboard at app.brandzey.io. If you use Atlas through an agency that manages your brand, the agency decides what goes into your workspace. For that data the agency is the controller and we act as its processor (see the data processing terms).
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: email, name, password (stored as a hash by Supabase Auth), plan and workspace role | Create and run your account, sign you in, send service emails | Art. 6(1)(b), contract |
| Brand brief, content cards, scripts, research, library and settings you enter | Provide the app and write drafts in your voice | Art. 6(1)(b), contract |
| Analytics pulled from your connected social accounts through Zernio (followers, views, posts) | Show your real numbers and rank your posts | Art. 6(1)(b), contract |
| Competitor and watchlist data from public profiles, collected through Apify and Sandcastles | Research features you ask for | Art. 6(1)(b), contract; Art. 6(1)(f), legitimate interest in running the feature you requested |
| Leads: personal data of your own audience that you or your connected tools add (names, handles, messages) | Show them to you in the Leads view | You are the controller for this data. We process it for you (Art. 28). |
| Footage and renders you upload | Store, transcribe and edit your videos | Art. 6(1)(b), contract |
| Your own API keys (Anthropic, OpenAI, Apify, Zernio, Notion, others you add) | Run the features with your own provider accounts. Keys are encrypted with AES-256-GCM and the app shows only the last 4 characters. | Art. 6(1)(b), contract |
| Billing data: plan, payment status, Mollie customer and subscription IDs. Card or bank details go to Mollie and we do not see them. | Charge, renew and cancel your subscription; tax and accounting records | Art. 6(1)(b), contract; Art. 6(1)(c), legal obligation |
| Technical data: IP address and request logs at our hosting providers, error and usage events | Security, fixing errors, measuring how the product is used | Art. 6(1)(f), legitimate interest in a secure and working service |
| Usage records: for each paid call Atlas makes for your account (writing, the agent, transcription, research, video renders) the time, the feature, the AI model, token or audio minute counts, the cost, whether your key or ours paid, and a short error message if the call failed. Not the content of your prompts or results. | Bill usage above what your plan includes, keep to the daily spending limit that protects you from runaway costs, and let the operator of Atlas see what each account costs to run | Art. 6(1)(b), contract, for billing and the daily limit; Art. 6(1)(f), legitimate interest in running and pricing the service, for the operator's overview. You can object to the overview. |
| Support messages and feedback you send | Answer you and improve Atlas | Art. 6(1)(b) and (f) |
| Consent record when you sign up (version and time) | Prove which terms you accepted | Art. 6(1)(c) and (f) |
We do not sell your data. We do not use your content to train AI models of our own. The AI providers below process your content only to answer your requests, under their own terms.
3. Who receives data (sub-processors)
We use these providers. Where a provider is in the US or can access data from the US, the transfer rests on the EU-US Data Privacy Framework or on Standard Contractual Clauses. Entries marked must be checked before this page is final.
| Provider | What for | Where | Transfer basis |
|---|---|---|---|
| Supabase (database and sign-in) | Stores your account and workspace data | EU, Ireland (eu-west-1) | Data stays in the EU. Supabase Inc. is a US company, so SCCs apply |
| Vercel Inc. (hosting and functions) | Runs the app and its API | Dublin, Ireland | US company. DPF or SCCs |
| Amazon Web Services (video storage and rendering) | Stores footage, renders edits | Frankfurt, Germany (eu-central-1) | Data stays in the EU. AWS DPA with SCCs as backstop |
| Resend | Service emails such as invites and sign-in mail | US | DPF or SCCs |
| Mollie B.V. | Payments and subscriptions | Netherlands | EU, no transfer |
| Anthropic (Claude) | Writing, agent and edit planning, with your key or ours | US | SCCs |
| OpenAI (Whisper) | Transcribes your footage, with your key or ours | US | DPF or SCCs |
| Apify | Collects public post data for research, with your key or ours | Czech Republic, with US sub-processors | EU, then SCCs where needed |
| Zernio | Publishes posts and reads analytics for the accounts you connect | ||
| Sandcastles | Social video research data | ||
| Notion (optional) | Only if you connect it | US, with EU option | DPF or SCCs |
When you connect a provider with your own key, you also have your own agreement with that provider. Their handling of your data is then covered by their terms with you.
Social platforms (Instagram, TikTok, YouTube and others) are not our sub-processors. Zernio connects to them on your instruction.
4. How long we keep data
- Account and workspace data: while your account exists. When you delete it or ask us to, we delete it within 30 days, except what we must keep by law. Backups roll off within 7 days.
- Billing and invoice records: 10 years, as German tax law requires.
- Request logs and error logs: up to 30 days.
- Usage records: 24 months, then deleted automatically. Amounts that went into an invoice stay with the invoice.
- After a subscription ends, your workspace stays readable until the end of the paid period. We then keep it for 30 days so you can come back, and delete it after that.
5. Cookies and local storage
Atlas uses only what it needs to work: your sign-in session and a few settings stored in your browser. We do not use advertising cookies. The marketing site at brandzey.io has its own notice.
6. Your rights
You can ask us for access to your data, correction, deletion, restriction, a copy you can move to another service, and you can object to processing based on legitimate interest. If you gave consent, you can withdraw it at any time. Write to prominewface@gmail.com. We answer within one month.
If your data sits in a workspace run by an agency, ask the agency first. We help the agency answer you.
7. Complaints
You can complain to a data protection authority. The authority responsible for us is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf. You can also contact the authority in your own country.
8. Security
Data is encrypted in transit. Your saved API keys are encrypted with AES-256-GCM. Each workspace is separated at the database level, and clients of an agency see only their own brand. No system is perfectly secure, and we cannot promise it. If a breach affects you, we tell you and the authorities as the law requires.
9. Changes
We will update this page when something changes and tell you about material changes by email or in the app.