Privacy Notice — Derelict Atlas

1. Who we are

Derelict ("we", "us", "our") operates the Derelict Atlas service. We are the data controller for personal data processed through the service. Contact us at hello@derelict.online.

2. Data we collect

Account data: email address, hashed password, display name.
Usage data: saved locations, search history, submissions, reports.
Technical data: IP address, device/browser identifiers, log data.
Support data: messages you send us.

Payment card data is collected and processed by Stripe, not by us.

3. Purposes and legal bases

Providing the service and your account — performance of contract.
Securing the service and preventing fraud or abuse — legitimate interests.
Improving the product and fixing bugs — legitimate interests.
Responding to support requests — legitimate interests / contract.
Complying with legal obligations — legal obligation.

4. Sharing your data

We share personal data only with:

Hosting, database, and analytics providers acting as our processors.
Stripe, our payment processor, for payments, subscription management, tax compliance, and invoicing.
Professional advisers (legal, accounting) when reasonably necessary.
Authorities where required by law.

5. International transfers

Some of our processors are located outside your country. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We retain account data while your account is active and for a reasonable period afterwards to meet legal, accounting, or reporting requirements. You can request deletion at any time.

7. Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent or lodge a complaint with your local supervisory authority. Contact us to exercise these rights.

8. Security

We apply appropriate technical and organisational measures including encryption in transit, access controls, and audit logging. No system is perfectly secure.

9. Cookies

We use strictly necessary cookies for authentication and session management. We do not use advertising cookies. Stripe may set its own cookies during checkout.

10. Changes

We may update this notice. Material changes will be communicated through the service or by email.