Privacy policy
Last updated 25 July 2026
Who is responsible
Atlas Academy, based in the Netherlands, is the controller of your personal data under the GDPR. Contact for any privacy matter: hello@getatlasacademy.com — a human answers.
What we collect
- Your email address — so we can deliver what you bought and its future updates.
- Your first name — optional, only to address you properly.
- Payment confirmation — the fact a payment succeeded, the product, and the amount. Card details never reach us; Stripe handles them entirely.
- Anything you write to us — support emails and their replies.
No trackers, no advertising pixels, no cookies, no fingerprinting, no profiling, no automated decision-making, and nothing shared with advertisers.
One exception, stated plainly: each page view sends us the page address and, if you arrived from another site, that site’s domain — nothing else. No cookie, no IP address, no device or browser details, no identifier of any kind, so the counts can never be tied back to you or to each other. It exists only so we can tell whether anyone is reading. If your browser sends “Do Not Track”, we don’t count you at all.
Why we’re allowed to (legal basis)
- Performance of a contract (GDPR art. 6(1)(b)) — delivering your files, sending free updates for what you bought, answering support.
- Legal obligation (art. 6(1)(c)) — keeping sales records for Dutch tax law.
- Legitimate interest (art. 6(1)(f)) — keeping the site secure and preventing abuse of download links.
Who else touches your data
Only the services required to run the shop. Each is bound by a data-processing agreement and none may use your data for their own purposes:
- Stripe — payment processing (Stripe Payments Europe, Ireland).
- Netlify — website hosting and the delivery functions.
- TransIP — our email, used to send your confirmation and download links.
Some of these may process data outside the EEA. Where that happens it is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision. We never sell, rent or share your data for marketing.
How long we keep it
- Order and invoice records — 7 years, because Dutch tax law requires it.
- Your email for delivery and updates — until you ask us to remove it.
- Support correspondence — up to 2 years, then deleted.
- Download links — signed and expire after 7 days.
Storage on your device
We set no cookies at all — first-party or third-party. Nothing is stored on your device until you actively do something that needs it:
a7_theme— remembers light or dark mode, set only once you use the theme toggle.
It is strictly functional: they exist solely to provide something you explicitly asked for, which is why no consent banner is required under art. 11.7a of the Dutch Telecommunicatiewet. Clearing your browser data removes them. None of it is sent to us or to anyone else.
Your rights
Under the GDPR you can ask us, free of charge, to:
- Access a copy of everything we hold about you.
- Rectify anything wrong.
- Erase your data (except records tax law obliges us to keep).
- Restrict or object to processing.
- Port your data to another provider in a machine-readable format.
Write to hello@getatlasacademy.com and we respond within 30 days. If you are unhappy with how we handle it, you can complain to the Dutch data-protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in your own country.
Security
The site is served over HTTPS only, with a strict content-security policy. Download links are cryptographically signed and expire automatically. Payment data never passes through our systems.
Children
Our products are not directed at children under 16, and we do not knowingly collect their data.
Changes
If this policy changes we update the date at the top. Material changes affecting existing customers are emailed.