Privacy Policy

1. Who is responsible and how to contact us

Atlas is operated by WEB7 DIGITAL TECNOLOGIA LTDA, trading as Web7 Digitall, a Brazilian company registered under CNPJ 27.423.428/0001-01, at Edificio Canaçu, Rua João Pessoa, 198, Sala 301, Cidade Alta, Natal/RN, CEP 59025-500, Brazil. WEB7 is responsible for the personal information it processes for Atlas. Send privacy and data-rights requests to support@atlasdigitalpay.com or through Help center.

Bridge and other providers can also process information under their own legal obligations and privacy notices. In particular, Bridge's identity and financial-service processing is subject to the notice for the applicable Bridge entity. This policy does not replace those provider notices.

Bridge's regional privacy notices

2. Information processed

Account and identity information: name, email, phone number, date of birth, nationality, residence, identity-document details, account identifiers, verification status and acceptance records. Clerk handles passwords, authentication factors and sessions. Atlas receives account and session information needed to identify you; it does not receive your Clerk password.

Financial and service information: deposit instructions and bank-transfer details, currencies, amounts, conversion information, balances, fees, wallet addresses, transaction history, provider references, receipts, support messages and notices. We may receive relevant verification and payment information from Bridge and other service providers.

Verification evidence: Bridge's hosted verification flow can collect identity-document images, a selfie or liveness information and proof of address. The provider explains the checks and any required consent in that flow. Atlas receives verification outcomes and associated information needed to operate the service. Do not send identity documents to an ordinary support message unless the team directs you to an appropriate secure process.

Security and technical information: IP addresses, browser/device signals, app version, device model, session/device identifiers and security-event records can be processed by Atlas and its authentication, hosting and anti-abuse providers. These support sign-in, fraud prevention, rate limiting, compatibility and incident investigation.

Optional information: a waitlist submission includes your email, residence and consent. Support messages include what you choose to tell us. Provide only what is needed and do not include passwords, transaction PINs or verification codes.

3. Purposes and legal grounds

We use information to create and secure accounts, verify eligibility, issue deposit instructions, process and reconcile transactions, maintain balances and receipts, collect disclosed fees, answer support requests and communicate about the service. Processing needed to provide a requested service is generally based on performing our agreement with you or taking steps at your request.

We also process information to satisfy applicable legal and regulatory obligations, respond to lawful requests, prevent fraud and abuse, protect accounts and systems, keep appropriate records and establish or defend legal claims. Where legitimate interests are the applicable legal ground, they are subject to your rights and the balancing required by law.

Where consent is required, such as an optional waitlist communication or certain provider verification processing, the relevant choice is presented to you. You may withdraw consent for processing that depends on it; withdrawal does not make earlier lawful processing unlawful. Withholding required information may prevent us from providing a regulated or secure service.

4. Providers and other recipients

Providers used for Atlas include Clerk for authentication; Bridge for verification, deposit accounts and conversion; Cloudflare for hosting, connection security and anti-abuse protection; Neon for database services; and Resend for transactional email. Information necessary for a stablecoin transfer is also processed by network-access and transfer providers, including GasFree and blockchain RPC services.

Authorized WEB7 personnel and service providers access information needed for their work. Financial providers may retain information independently to meet their own obligations. We may also disclose relevant records to competent authorities when legally required, to resolve a dispute or protect rights, or in a lawful business reorganization subject to applicable privacy protections.

Atlas does not sell personal information or use it for cross-app advertising tracking. The app does not include an advertising network. Required service, security and provider processing is still personal-data processing even though it is not advertising.

5. Public blockchain information

Transfers on TRON or Base publish wallet addresses, amounts and transaction details to a public network. Other parties can copy or analyze those records and may associate addresses with information from other sources. A blockchain record is generally permanent and cannot be edited or erased by Atlas when you close your account.

Consider that visibility before authorizing a transfer. Atlas's internal identity and support records are separate from the public transaction record; the app does not put your identity-document images on the blockchain.

6. Device permissions, cookies and local information

The app may request camera access to scan a wallet QR code. The scan is used to fill the destination; it does not give Atlas general access to your photo library. Your device manages Face ID, Touch ID, fingerprint or device-passcode authentication. Atlas does not receive your device's biometric template; it receives the authentication result needed to unlock the app.

The website and sign-in providers use session cookies or similar storage needed for authentication and security. The mobile app stores authentication material using the device's protected storage and holds service data in memory while in use. Provider-hosted verification pages have their own privacy notices and may request additional permissions.

Atlas does not request access to your contacts or precise device location for its current mobile features. IP and other technical signals may still be used by service providers for security. You can manage device permissions in system settings, although turning off a permission can disable the related feature.

7. International processing

WEB7 is based in Brazil, and Atlas uses providers and infrastructure in other countries, including the United States and European locations. Your information may therefore be processed outside your country of residence. The relevant location and provider depend on the service involved.

International processing is subject to the safeguards or other valid transfer grounds required by applicable law. Contact us for information about the recipients and transfer arrangements relevant to your account. A provider's separate privacy notice explains its own international processing.

8. Retention and account deletion

We retain information while needed to operate your account and for applicable legal, regulatory, accounting, security and dispute-resolution purposes. Retention depends on the record, transaction history, country requirements and any unresolved investigation, claim or legal hold. There is not one retention period for every record or every customer.

Account closure stops service access but does not immediately erase all account, identity, transaction or support records. We retain records necessary for applicable obligations and the post-closure receipt archive. Other personal information can be assessed for deletion or anonymization when it is no longer necessary. Providers such as Bridge may have their own mandatory retention periods, and public blockchain records remain public.

To close the account, open More > Delete account in the app or My account > Close my account on the website. If funds or pending activity block closure, request assistance through Help center or support@atlasdigitalpay.com. You may separately request erasure of information that does not need to be retained, and ask which records are kept, why and the applicable period.

We may verify the requester's identity and explain lawful exceptions or unresolved steps. Requests are handled within the periods required by applicable law; if an extension or restriction applies, we will explain it as the law requires. Deleting the app from your phone does not close the account or delete provider records.

9. Your rights and choices

Depending on applicable law, you may request confirmation of processing, access or a copy of your information, correction, portability, deletion, restriction or information about sharing. You may object to processing where that right applies, withdraw consent for consent-based processing, and ask for review of a decision based solely on automated processing where the law provides that right.

Send a request to support@atlasdigitalpay.com with the email associated with your account and a description of what you need. We may ask for information proportionate to verifying your identity. Do not email your password, PIN or authentication codes. We will explain if a legal obligation or another person's rights prevent fulfilling part of a request.

You can complain to the competent data-protection authority, including Brazil's ANPD or your local authority where applicable, without first contacting us. Exercising privacy rights does not remove records that must be retained under law, but we will assess the scope of each request.

10. Children and security

Atlas is for adults aged 18 or older. We do not offer accounts to children. If you believe a child has supplied information or opened an account, contact us so we can investigate and take the required steps.

We use access controls, encrypted communications and protected credential/key storage as part of the service's security. No system or transmission can be guaranteed completely secure. Protect your own devices and sign-in factors and report suspected unauthorized access promptly.

11. Updates to this policy

We may update this policy as the service, providers or applicable requirements change. The effective date identifies the current version. We will give notice of material changes and obtain any additional consent where required. Contact us using the details above if you need a previous version or an explanation of a change.