Privacy Policy

1. Information We Collect

1.1 Personal Information You Provide

When you sign up for our waitlist, we collect:

• Email address: Required to notify you about platform launch and early access
• User type: Optional information about your role (developer, business, researcher, etc.)
• Source information: How you found us (optional)
• Consent records: Your agreement to receive communications

1.1.2 Google Sign In Data

When you sign in with Google, we collect and store your complete OAuth response including access tokens. This data is stored unencrypted in our database (Google Sheets) and is accessible by authorized personnel only:

• Email address: From your Google profile
• Google user ID: Unique identifier for your Google account
• Full name: From your Google profile
• Profile picture URL: Link to your Google profile picture
• OAuth access token: For API access and authentication
• OAuth refresh token: For token renewal and maintaining your session
• ID token (JWT): Contains your user claims and authentication details
• Authentication timestamp: When you signed in with Google

Important: We store OAuth tokens to enable future authentication features. You can request deletion at any time via privacy@x402atlas.com.

1.2 Automatically Collected Information

When you visit our website, we automatically collect:

• Technical data: IP address, browser type, device information
• Usage data: Pages viewed, time spent on pages, navigation paths
• Analytics data: Via Google Analytics to understand how visitors use our site

2. How We Use Your Information

We use your personal data for the following purposes:

• Authentication: To enable sign in with Google and maintain your authenticated session
• Waitlist management: To notify you when x402 Atlas launches or when early access becomes available
• Communications: To send you updates about product development and features (for waitlist users) or account-related notifications (for signed-in users). You can opt out anytime.
• Analytics: To understand user behavior and improve our website and service
• Security: To protect against fraudulent or malicious activity
• Legal compliance: To comply with applicable laws and regulations

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), our legal basis for collecting and using your personal data depends on the data and context:

• Consent: You have given explicit consent for waitlist communications
• Legitimate interests: Website analytics to improve our service
• Legal obligations: Compliance with applicable laws

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service providers: Google Identity Platform (authentication), Google Sheets (data storage), Resend (email delivery), Cloudflare Turnstile (bot protection)
• Google OAuth Services: Google Identity Platform (for authentication), subject to Google's Privacy Policy
• Analytics providers: Google Analytics (website usage analysis)
• Legal authorities: When required by law or to protect our rights

All third-party providers are contractually obligated to protect your data and use it only for specified purposes.

5. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Waitlist data: Until platform launch + 12 months, or until you request deletion
• Analytics data: Anonymized after 26 months (Google Analytics default)
• Legal requirements: Longer retention if required by law

6. Your Rights (GDPR & CCPA)

You have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure ("Right to be Forgotten"): Request deletion of your data
• Portability: Request transfer of your data to another service
• Objection: Object to processing of your data
• Withdraw consent: Unsubscribe from communications at any time
• Lodge a complaint: Contact your local data protection authority

To exercise any of these rights, contact us at privacy@x402atlas.com. We will respond within 30 days.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• HTTPS encryption for all data transmission
• Bot protection via Cloudflare Turnstile
• Secure storage with access controls
• Regular security assessments
• OAuth tokens stored unencrypted in Google Sheets (acknowledged security limitation)

Please note: OAuth tokens are currently stored unencrypted. While we restrict access to authorized personnel only, this represents a security tradeoff for development speed. We plan to implement token encryption in future updates.

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including the United States. We ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for data transfers
• Your explicit consent for data transfers

9. Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

• Essential cookies: Required for website functionality
• Analytics cookies: Google Analytics to understand usage (can be opted out)

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality.

10. Children's Privacy

Our service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last Updated" date
• Sending an email notification to waitlist members
• Posting a notice on our website

Your continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data: