[business name — not yet registered] is the controller of the personal data described here. For anything about your data, including the requests in section 7, write to support@cotatlas.com. We have not appointed a data protection officer, because the scale of the processing does not require one.
The account itself: your email address and a hashed password — the password is stored in a form we cannot reverse and we never see the original — together with the dates your account was created and last signed in.
The subscription: your tier (free or pro), the Stripe customer and subscription identifiers, the subscription status, the date the current period ends, and whether it is set to cancel. That is the entire row.
We do not receive your card details. Card numbers go from your browser to Stripe and never reach our servers. Stripe holds your payment method and billing details under its own privacy policy.
Technical records: our hosting and database providers keep short-lived server logs — IP address, time, page requested, browser identification — as every web server does, to keep the service running and to spot abuse.
What we do not do: no advertising, no advertising or analytics cookies, no tracking across other sites, no profiling, no selling or renting your data to anyone. The only cookies the site sets are the ones that keep you signed in. They are strictly necessary for a service you asked for, which is why you are not asked to consent to them.
To run your account and your subscription — performance of our contract with you (Article 6(1)(b) GDPR). Without an email address there is no account, and without the subscription fields there is no way to know what you have paid for.
To send messages about the service — confirming your email, resetting your password, telling you about a price change or an interruption. Also contract performance. These are not marketing and you cannot unsubscribe from them while you hold an account.
To keep accounting and tax records — a legal obligation (Article 6(1)(c) GDPR) under Slovenian tax law.
To keep the service secure — our legitimate interest in preventing abuse, fraud and unauthorised access (Article 6(1)(f) GDPR), balanced against the fact that the data involved is minimal and short-lived.
We use three providers. Each is bound by a data processing agreement, each processes only what it needs, and none of them is permitted to use your data for its own purposes — with the exception noted below.
Stripe is also an independent controller for payment data: it must keep records of transactions and check for fraud under rules that apply to it directly, not because we asked.
Beyond these, we disclose personal data only where the law requires it — for example to a court or a tax authority acting within its powers.
Accounts and the database sit in the European Union (Ireland). Hosting and payments involve companies in the United States, so some data is transferred there. Those transfers rely on the European Commission’s standard contractual clauses and, where the provider participates, the EU–US Data Privacy Framework.
Account data for as long as you have an account, and for 30 days after you close it, so an accidental closure can be undone.
Invoices and the accounting records behind them for as long as tax law requires — generally ten years — because that obligation outlives the account and we cannot delete them on request.
Server logs for a short period set by each provider, normally days to a few weeks.
You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on legitimate interest you may object, and we will stop unless we have grounds that override yours.
Write to support@cotatlas.com. We answer within one month. There is no charge, and we do not ask for more identification than we need to be sure it is you.
Deleting your account. The service has no self-service delete button yet. Ask us and we will delete the account and its profile row; what has to remain is the invoice record described in section 6.
If you think we have handled your data badly, please tell us first. You also have the right to complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, ip-rs.si) or to the supervisory authority where you live.
The service is not intended for anyone under 18 and we do not knowingly hold data about children. If you believe a child has created an account, tell us and we will remove it.
If this policy changes in a way that affects you, we will email account holders before the change takes effect. The date at the top of this page always shows the version in force.