Privacy Policy

This Privacy Policy explains how Economic Atlas (“Economic Atlas,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information when you visit or use the Economic Atlas Service. It does not govern third-party websites or services, which have their own policies.

1. Information we collect

Account information. When you create an account, our authentication provider, Clerk, processes the identity and sign-in information you choose to provide, such as your email address and authentication credentials or social sign-in information. Our application stores your Clerk user identifier and email address.

Service content. We process questions and messages submitted to the chat feature, saved chat conversations if you enable account sync, watchlists, saved preferences, and support communications. Avoid submitting sensitive personal information or confidential information that you do not want processed by our service providers.

Browser storage. The Service stores watchlists, chat history, and a pseudonymous chat-session identifier in your browser's local storage. When account sync is enabled, saved watchlists and chat history are also stored with your account so they can be available on other devices. You may clear browser-local data through your browser settings, but doing so does not remove any account-synced copy.

Payment information. Payments are processed by Stripe. We do not receive or store full payment-card numbers. We store limited billing records necessary to provide your plan, such as Stripe customer and subscription identifiers, subscription status, plan, and renewal date.

Usage and technical information. We process information generated by use of the Service, including IP address for rate limiting and security, request timing, usage totals, device/browser information that our hosting or authentication providers may collect, and log information necessary to operate and protect the Service. We also record chat-turn records (including the text of the question you ask, for a limited period) and product-interaction events (such as pages visited, screens or searches run, and exports generated) in our own database to operate, diagnose, and improve the Service — see Section 6 for details and retention. On your first page view of a browsing session, we also record the hostname of the site that referred you (never the full referring URL or path) and any campaign parameters (such as utm_source or utm_campaign) present in the link you followed, so we can tell which sources bring visitors to the Service — see Section 6 for how this is stored and used. We do not currently operate an advertising network or sell personal information for cross-context behavioral advertising.

2. How we use information

We use personal information to provide and maintain the Service; authenticate users; process subscriptions; synchronize saved features; answer support requests; enforce limits and prevent fraud, abuse, and security incidents; measure and improve Service performance; comply with law; and establish, exercise, or defend legal claims. We use chat prompts and conversation context to generate requested AI-assisted responses. We do not use your content to train our own general-purpose AI model.

3. Service providers and disclosures

We disclose information to service providers that process it for us to operate the Service, including Clerk for authentication and account management, Stripe for payment processing, our cloud hosting and database providers (including Vercel and Supabase/Postgres), Vercel Web Analytics and Vercel Speed Insights for aggregated site-usage and page-performance measurement (see Section 6 for how these operate), PostHog for product analytics when configured (see Section 6 for what it receives and when it is active), and AI providers used to generate chat responses (currently Anthropic or, when configured, OpenRouter and the model provider selected through it). These providers process information under their own terms and applicable data-processing commitments.

We may also disclose information when required by law, to protect rights, safety, and security, to investigate misuse, or in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined by applicable U.S. privacy laws.

4. Retention

We retain account and product data for as long as needed to provide the Service and meet the purposes described in this Policy. We retain billing records as required for accounting, tax, dispute, and legal purposes. You may request deletion as described below; we will delete or de-identify personal information we control within a reasonable period, unless we must retain it for a legitimate legal, security, fraud-prevention, or accounting purpose. Backups may persist for a limited period before they are overwritten.

Several categories run on fixed, automated deletion schedules rather than an open-ended retention period: usage telemetry (cost, token counts, and timing for chat requests — not the content of your messages) is deleted 24 months after it is recorded; chat-turn records (including the outcome of each chat request and, where applicable, the text of your question) are deleted 24 months after they are recorded, with the question text itself permanently removed after 90 days; rate-limiting records (IP address, route, and hour bucket) are deleted after 2 days; and product-interaction events (described in Sections 1 and 6, including page views and named usage events) are deleted 395 days (about 13 months) after they are recorded. All run on a daily automated schedule. If you create an account, the first-visit campaign attribution described in Section 6 (the link or campaign that first brought you to the Service) is retained for as long as your account exists and is deleted when your account is deleted.

5. Your choices and privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; and to withdraw consent where processing is based on consent. You can update sign-in details through your account controls. To request access, deletion, correction, or an export of product data, contact us at hello@economic-atlas.com. We may verify your request before acting on it and will respond within the time required by applicable law.

If you are in Canada, you may withdraw consent subject to legal or contractual restrictions and reasonable notice. If you are in the EEA, UK, or Switzerland, Economic Atlas acts as controller for the personal information described in this Policy. We process that information to perform our contract with you, comply with legal obligations, pursue our legitimate interests in operating and securing the Service, or with your consent where required. Information may be processed in Canada, the United States, and other countries where our service providers operate; where required, we use appropriate safeguards for international transfers. You may also complain to your local data-protection authority. If you are a California resident, you may have additional rights under California law; this Policy states that we do not sell or share personal information for cross-context behavioral advertising.

6. Cookies and similar technologies

We do not currently use our own advertising cookies. Essential cookies or similar technologies may be set by Clerk to provide sign-in and account security, and Stripe may use them on its hosted checkout. Our hosting providers may also process technical logs. If we add non-essential analytics, advertising, or similar tracking technologies, we will update this Policy and implement any consent mechanism required by applicable law before enabling them.

We use Vercel Web Analytics and Vercel Speed Insights to see aggregate site usage (such as which pages are visited) and page-load performance. Per Vercel's own documentation, these tools do not use cookies: visitors are instead identified by a hash generated from the incoming request that resets automatically every 24 hours and cannot be used to track a visitor across different days or different websites. The data collected is limited to aggregated, anonymized metrics — for example, page path, referrer, approximate geographic location, device/browser type, and Core Web Vitals timing — and is not tied to any individual visitor.

We use PostHog, a product-analytics service (PostHog, Inc., hosted on PostHog's US Cloud, us.i.posthog.com), when a configuration key for it is set in our production environment — no data reaches PostHog until that key is set. When active, PostHog receives page views and a small set of named product events: account created, first chat question asked, free usage limit reached, upgrade page viewed, and upgrade completed. For signed-in users only, PostHog also receives your Clerk user identifier as a stable identity key. PostHog does not receive your email address, name, or any other personal profile detail, the text of your chat questions, session recordings or replays, or automatically captured clicks or keystrokes — session recording and autocapture are disabled in our configuration of PostHog.

Separately, and as a similar technology to a cookie, the Service stores a randomly generated anonymous visitor identifier (a UUID that contains no personal information and is not derived from any personal data) in your browser's local storage on your first page view of a browsing session, along with a record of that first visit. That first-visit record captures only the hostname of the site that referred you (never the full referring URL or path) and any campaign parameters present in the link you followed — we never store the raw query string. We attach this identifier to the first-party product-interaction events described below so we can tell whether visitors from a given link went on to use the product. If you create an account, we write your first-visit campaign values once to a record associated with your account, so we can tell which link or campaign brought a customer in; that record is never overwritten after it is first written, and is deleted if you delete your account (see Section 4). This mechanism is entirely first-party — it is stored in our own database and does not involve any new third-party processor.

We also record certain information first-party, directly in our own database, without any new third-party processor. This includes chat-turn records — for each chat request, the outcome (for example, answered, declined because of a usage limit, or an error), which tools were used and with what inputs, and the text of the question you asked — and product-interaction events, such as which pages you visit, which screens (for example, company or place searches) you run, and which data or figures you export. We use this information to diagnose where the Service is falling short, understand what people are trying to do, and prioritize what to build or fix next. We do not sell this information, and we do not share it with advertisers. The text of your chat question is deleted after 90 days; see Section 4 for the full retention schedule.

7. Security and children

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No internet transmission or storage system is completely secure, and we cannot guarantee absolute security. The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided personal information in violation of this Policy, contact us so we can take appropriate action.

8. Changes to this Policy

We may update this Policy to reflect changes to our practices, the Service, or law. We will post the revised Policy with a new effective date and provide additional notice when required by law. Your continued use of the Service after the effective date is subject to the updated Policy.