Privacy Policy

Buranku Atlas is operated by João Robalo, based in Portugal, who is responsible for the personal information described in this policy as the data controller.

Privacy contact: [email protected]
Website: https://burankuatlas.com

This policy explains how we handle personal information when you visit our website, request access, purchase access, or use the Buranku Atlas platform.

Account information. When you sign in with Google, we receive your email address, name, profile picture, and Google account ID to identify and authenticate your account. We also maintain your account’s approval status and access permissions, when you first signed in, when you were last seen, when you were approved, and an internal status and note. Google handles authentication; we do not receive your Google password.

Workspace information. We collect information you choose to enter or save, including watchlists, portfolio holdings, positions and cost basis, dashboards and dashboard settings, alerts, client books, analysis notes, and reports. Financial information associated with your account is treated as personal information. If you are on the Desk plan, our analysts can view the holdings you have entered on your portfolio page, and any review request you send, in order to provide portfolio management; the review they write is stored with your account.

Payment information. We receive transaction and billing information needed to manage paid access, identify payments, handle refunds or disputes, and maintain required records. Complete payment card details do not reach our systems.

Communications. If you contact us, we collect your email address, message, and any other information you provide.

Technical records. We process operational, diagnostic, and security logs generated in connection with the operation and protection of the Service. From every visitor, we automatically collect server logs containing the IP address; browser, operating system, and device type (user agent); date and time of each request; page or file requested and response status; the page the visitor came from (referrer); and error and security diagnostic logs. These logs are kept for 14 days.

We obtain this information directly from you, from Google and Stripe in connection with their services, and through operation of the platform.

Account information is necessary to access the private platform. Payment information is necessary for paid services. Workspace information is optional, although particular features require the corresponding information to function.

We use personal information for the following purposes and legal bases under the General Data Protection Regulation (“GDPR”):

Where applicable law requires consent for a particular activity, we obtain it before carrying out that activity. You may withdraw consent at any time without affecting processing lawfully carried out before withdrawal.

We use Stripe to process payments.

Depending on your payment method, Stripe processes information such as your name, email address, billing details, payment credentials, transaction amount, and payment status. Stripe also processes information for payment security and fraud prevention.

Complete payment card details do not reach or get stored in Buranku Atlas’s systems. We receive the payment-related information needed to administer your purchase and maintain required records.

Stripe acts as a processor for certain activities performed on our behalf and as an independent controller for certain activities of its own. Further information is available in the Stripe Privacy Policy.

We occasionally use ChatGPT to summarize notes or make their wording more concise.

Only material containing no personal information is submitted for this purpose. We do not send user names, account information, portfolio information, or other personal information to ChatGPT.

Reports submitted through the platform for publication or sharing are available for review only by authorized administrators of Buranku Atlas. They are not made available to other users or the public.

We do not sell personal information or disclose it for advertising or unrelated commercial purposes. Personal information is made available only as necessary to operate the Service or meet legal requirements, including to:

• Google, for account identification and authentication.
• Stripe, for payment, billing, and related transaction activities.
• Hosting, data storage, and security providers, for the account, workspace, and technical information necessary to operate and protect the platform.
• Authorities or professional advisers, where required by law or necessary and legally permitted to establish, exercise, or defend legal claims.

Access within Buranku Atlas is restricted according to operational need and access permissions.

Your browser also connects to the following providers, which receive your IP address and user agent:

• Google Fonts, on every page, including for signed-out visitors.
• Google, when loading profile pictures.
• CoinGecko, when loading coin images on the Crypto page.
• Cloudflare and AWS, as the hosting and network layer.
• Google, when you sign in.

Cookies are stored in your browser. Cookies and similar browser storage can support functions such as sign-in, session management, and preferences.

We use:

• A signed session cookie, which holds your account ID, email address, name, profile picture, and expiry.
• A short-lived sign-in security cookie.
• An admin “view as customer” cookie.

Browser storage does not necessarily mean information stays entirely on your device: when a cookie supports a website function, your browser may send its information to the relevant service.

You can delete or block cookies and other browser storage through your browser settings. Doing so may affect sign-in or other functionality.

The 14-day retention period for our logs and the one-month retention period for backups below do not determine how long cookies remain in your browser; browser storage follows its own expiry settings or can be cleared by you.

We retain personal information only for as long as necessary for the purposes described in this policy.

When information is no longer required, we delete or anonymize it. Deleted information may remain in existing backups until those backups expire within their one-month retention period.

Where specific information must be preserved to comply with a legal obligation or address an existing legal claim, we retain only the necessary information and limit its use to that purpose.

We protect personal information through encrypted connections, restricted administrative access, and access controls.

These measures help protect information against unauthorized access, alteration, disclosure, or loss. No method of transmission or storage can guarantee complete security.

Where a security incident triggers a legal notification obligation, we provide the notifications required by applicable law.

Buranku Atlas operates from Portugal. Our authentication and payment providers operate internationally, and their processing may take place outside the European Economic Area, including in the United States and, in Stripe’s case, India.

Google and Stripe publish the safeguards they use for international transfers. These include European Commission adequacy decisions, the EU-U.S. Data Privacy Framework for covered transfers to certified recipients, and European Commission-approved standard contractual clauses where applicable.

Further information and access to the relevant safeguards are available through Google’s data transfer information, the Stripe Privacy Policy, and Stripe’s Data Transfers Addendum.

You can also contact [email protected] to request information about transfers relating to your use of Buranku Atlas and the applicable safeguards.

Subject to the conditions and exceptions in the GDPR, you may request:

• Access to your personal information and a copy of it.
• Correction of inaccurate or incomplete information.
• Deletion of information.
• Restriction of certain processing.
• Portability of information where applicable.
• Withdrawal of consent where processing relies on consent.

Right to object: You may object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to processing for direct marketing at any time.

To exercise your rights, email [email protected]. We may request proportionate information to verify your identity.

We respond without undue delay and normally within one month. Where permitted because of the complexity or number of requests, we may extend this by up to two further months, informing you within the first month and explaining why.

You also have the right to lodge a complaint with Portugal’s Comissão Nacional de Proteção de Dados (CNPD) or another competent supervisory authority.

You can manage the Service’s connection through your Google Account settings. Removing that connection does not itself delete information already held by Buranku Atlas; contact us to request account deletion.

Access requests are reviewed by an administrator.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on users.

The Service is intended for people aged 18 or older.

If we learn that an account belongs to someone under 18, we will take appropriate steps to close the account and delete associated personal information, subject to applicable legal requirements.

If you believe someone under 18 has provided personal information, contact [email protected].

We may update this policy when the Service or our information practices change. We will publish the updated policy and revise the “Last updated” date.

Where required, we will provide additional notice and obtain consent before introducing a new use of personal information.

For questions about this policy, contact João Robalo at [email protected].