Privacy Policy

1. Who is responsible

The controller of your personal data is Tarisar L.L.C-FZ, a free-zone company registered in Dubai, United Arab Emirates, at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. Contact: [email protected].

2. What we collect

• Your email, when you sign in or subscribe to the newsletter.
• Your creations: the hinge and change you submit, and the prose and images the atlas generates from them.
• Payment information, when you buy something. Payments are handled by a PCI-compliant third-party payment processor; we receive confirmation of payment but never see or store your card number.
• Privacy-friendly analytics: the pages viewed and the referring site. We do not use tracking cookies. Unique visits are counted with a salted daily hash that cannot be traced back to you and rotates every day; aggregate page analytics are also gathered through cookieless, privacy-friendly analytics services.
• Technical data: standard server logs and, for the analytics hash only, a transient reading of your IP address, which is not stored in raw form.

3. How and why we use it

To provide the Service (sign you in, generate and store your creations, take payment); to keep it safe (moderation, rate limiting, security); to send you service email and, if you asked, the newsletter; to understand and improve the Service; and to meet legal obligations.

4. Legal bases (GDPR)

We rely on: performance of a contract (providing the Service you asked for); our legitimate interests (security, improvement, aggregate analytics); your consent (the newsletter, which you can withdraw at any time); and legal obligation where it applies.

5. Automated processing and AI transparency

Your Submission is screened by an automated moderation model and then processed by generative-AI models to write and illustrate your creation. This is automated processing, but it does not produce legal or similarly significant decisions about you. All output is AI-generated content, presented as fiction and labelled as such, consistent with applicable AI-transparency rules.

6. Who processes data for us (sub-processors)

We share data only with vetted providers that process it on our behalf to run the Service, under contract and appropriate data-protection terms. They fall into these categories:

• cloud hosting and content delivery;
• database and authentication;
• object storage and image delivery;
• bot and abuse protection;
• generative-AI models that write and illustrate creations;
• email delivery (transactional and newsletter);
• payment processing;
• privacy-friendly, cookieless analytics.

We keep an up-to-date list of the specific providers in each category and will share it on request at [email protected]. We do not sell your personal data. We may disclose data if required by law or to protect the Service and its users.

7. International transfers

Some providers are located outside the EU/EEA (for example in the United States). Where data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision where one applies.

8. How long we keep it

We keep your account until you close it. The works generated on the Service are owned by the Operator and may be retained after your account is closed, in a form no longer linked to you. Newsletter subscriptions are kept until you unsubscribe. Aggregate analytics are retained in non-identifying form. Some records may be kept longer where the law requires.

9. Your rights

Subject to applicable law, you can ask to access, correct, delete, export or restrict your data, and object to certain processing. You can withdraw consent to the newsletter at any time. You can also complain to your local data-protection authority. To exercise any right, contact [email protected].

10. Deleting your data

Closing your account deletes or de-identifies your personal data (your email and account). The works generated on the Service are owned by the Operator (see the Terms) and may be retained after closure, unlinked from you. You can delete individual creations from your shelf at any time.

11. Cookies and bot protection

We use a small number of strictly necessary cookies to keep you signed in. We do not use advertising or cross-site tracking cookies, and our analytics work without cookies.

To protect sign-in from automated abuse we use Cloudflare Turnstile. It runs when you request a sign-in link and processes limited technical data (such as your IP address and browser characteristics, and it may set a strictly necessary cookie) solely to tell humans from bots. It is not used for advertising or cross-site tracking. See Cloudflare’s Turnstile Privacy Policy.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

13. Changes

We may update this Policy and will post the new version with a new effective date.

14. Contact

Privacy questions: [email protected]. Or send word to the cartographers.