Privacy Policy

1. Data Controller

Atlas is operated by Wuttipat Klinyam, Entrepreneur Individuel registered in France under the commercial name Wynex Labs (SIREN 100 844 000, SIRET 100 844 000 00016, APE 6201Z), with registered office at 59 Rue Georges Lardennois, 75019 Paris, France. For any question about how we process your personal data, contact us at hello@wynexlabs.studio. We respond within one calendar month per GDPR Art. 12(3). No Data Protection Officer is appointed: Art. 37(1) criteria are not met. No EU representative is required: the controller is established in the EU.

2. Data We Collect

We collect only the data needed to deliver the Atlas learning experience:

• Account data: email address, name, and authentication provider information (Google OAuth, Microsoft / Azure AD, email magic link, or passkey).
• Uploaded content: PDF documents you upload for study purposes. These are processed to extract text, generate quiz questions, and build knowledge maps.
• Learning data: quiz responses, essay submissions, scores, session history, performance metrics, knowledge-map progress, and flashcard schedules used to personalise your learning experience.
• Usage data: login timestamps, feature usage, and engagement metrics for service improvement.
• Age affirmation timestamp: the moment at which you confirmed you are at least 15 years old or are using Atlas under the supervision of an institutional administrator.

3. Legal Basis for Processing (GDPR Article 6)

• Consent: we process your data based on your explicit consent, which you can withdraw at any time.
• Contract performance: processing necessary to provide the adaptive learning service you signed up for.
• Legitimate interest: service improvement, security monitoring, and fraud prevention.

4. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15): request a copy of all data we hold about you.
• Right to data portability (Art. 20): export your data in a structured, machine-readable JSON format via your Account Settings.
• Right to erasure (Art. 17): permanently delete your account and all associated data via your Account Settings.
• Right to rectification (Art. 16): update or correct your personal information.
• Right to restrict processing (Art. 18): request that we limit how we use your data.
• Right to withdraw consent: withdraw consent at any time without affecting prior processing.

5. Data Retention

We retain your data for as long as your account is active. Upon account deletion, all personal data and uploaded content are permanently removed within 30 days. Anonymised, aggregated analytics data may be retained for service improvement. Operational logs (LLM usage, audit logs) follow a 365-day retention policy; transactional notifications are purged after 90 days.

6. Data Security

We implement appropriate technical and organisational measures (GDPR Article 32) to protect your data, including encryption in transit (TLS / HTTPS), encrypted storage on Neon Postgres (EU region), access controls scoped per role (student / professor / admin), short-lived authentication sessions, error monitoring with PII masking, and audit logging of access to personal data.

7. Automated Processing & AI Grading (Art. 13(2)(f))

Atlas uses large language models (LLMs) to support several pedagogical tasks. We disclose this explicitly so you can make an informed decision:

• Essay grading: when you submit an essay or short-answer question, an LLM may produce a draft grade and feedback against the rubric set by your teacher.
• Human-in-the-loop checkpoint: AI-generated grades are not pushed to your LMS gradebook until a teacher reviews them. The grading workflow has four states (pending → ai_graded → professor_reviewed → final). Only grades in the 'final' state are passed back to the LMS.
• Opt-out: students can opt out of AI-graded assignments by contacting their teacher, who can request a manual-only grading workflow for that student. This does not affect any other Atlas features.
• Other AI uses: question generation from uploaded documents, knowledge-map construction, OCR on scanned PDFs, and embedding generation for semantic search. These do not produce grades and are not subject to the opt-out, but the AI routing and transfer safeguards in §8 apply.
• Article 22 GDPR safety shield: because every essay grade passes through professor review before passback, no decision producing legal or similarly significant effects is made solely by automated means within the meaning of Art. 22(1). The Art. 22(2)(a) (contractual necessity) and Art. 22(2)(c) (explicit consent) safeguards are satisfied: AI grading is configured by your instructor, you may opt out per the bullet above, and you may always request human-only grading.

8. International Data Transfers

Atlas's primary database is hosted in the European Union (Neon, eu-central-1). Our AI inference runs with EU-region providers; where any data transfers outside the EEA, we are transparent about the safeguards because GDPR Chapter V requires it:

• Document embeddings (OpenAI text-embedding-3-small) are routed through Azure-OpenAI-EU in Sweden Central under our Microsoft tenant; Microsoft hosts the inference inside the EU Data Boundary, with any transfer outside the EEA governed by EU Standard Contractual Clauses (Microsoft Online Services DPA).
• Essay grading, the AI tutor, study guides, question generation and other content tasks use Google Vertex AI (supported Gemini models) in the EU multi-region. Any transfer outside the EEA is governed by EU Standard Contractual Clauses (Google Cloud DPA). Anthropic Claude was decommissioned in June 2026 and is no longer used.
• OCR on scanned PDFs and knowledge-map generation use Mistral AI, EU by default (primary Sweden, backup Ireland); certain features may transfer outside the EEA under EU Standard Contractual Clauses (Module 4) per Mistral's DPA.

All transfers outside the EEA rely on the European Commission's adequacy decisions, Standard Contractual Clauses, or the EU-US Data Privacy Framework, complemented by contractual zero-retention representations where offered and EU-region pinning of our primary database (Neon) and supported AI inference. See the full subprocessor register for the per-provider region and transfer mechanism.

9. Cookies and similar technologies

Atlas uses a small, deliberately-minimised set of cookies and browser-storage items. We use no third-party advertising, marketing, or behavioural-profiling cookies — no Google Analytics, no Meta / Facebook pixel, no HubSpot, Mixpanel, or Hotjar. Because all our cookies are strictly necessary, exempt under Art. 82 LCEN, or governed by a documented legitimate interest with a right to object, we do not display a cookie consent banner. The table below replaces the information a banner would otherwise provide.

How to control these: sign out to clear the NextAuth session cookie. Clear browser storage to clear the locale cookie. Object to the legitimate-interest processing (Vercel + Sentry) by emailing hello@wynexlabs.studio with the subject 'Opt-out of analytics'.

10. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority (CNIL for France) within 72 hours per GDPR Article 33. If the breach is likely to result in a high risk to your rights, we will notify you directly per Article 34.

11. Contact & Complaints

For any privacy-related inquiry, contact our Data Protection contact at hello@wynexlabs.studio. You also have the right to lodge a complaint with your local data-protection supervisory authority — in France, that authority is the CNIL (Commission Nationale de l'Informatique et des Libertés).