Last updated: 7 October 2026
This policy explains what data ATLAS keeps, why, who it is shared with, and what you can do about it. It describes the system as it actually works.
FANTØM is the controller of the data processed in ATLAS. For anything related to privacy, write to eduardo@ifantom.com.
From your account: first and last name, email, a password protected by irreversible cryptography, language, organisation type and name, role, and the date you accepted these documents.
From sign-up: the country you are in, which you tell us when creating the account; the country you connected from at that moment (we keep only the country code, never the network address); and, if you arrived through an ad or campaign link, the campaign it came from. We use this in aggregate form, to understand where people come from and which campaigns bring the people who actually use and subscribe to ATLAS.
From your usage: the conversations you have with ATLAS, what it stored in automatic memory, your favourites, how much capacity you used, and technical access logs. From each question we also keep, in aggregable form, which public players, teams, competitions and matches it looked up — never the question text for that purpose.
From payment: we keep your subscription identifier and its state. **Card details never pass through ATLAS** — payment happens entirely within Stripe.
We do not ask for or keep any national ID, passport or identity document.
To perform the contract: maintain your account, answer your questions, charge the subscription and provide support.
For legal obligation: tax and accounting records of the charges.
For legitimate interest: security, fraud prevention and an aggregate understanding of how the product is used — always to the smallest extent necessary.
Automatic memory works on consent, and you can turn it off at any time.
Only those necessary for the service to work, and only what is necessary:
OpenAI (United States) — the text of your questions and conversation context, to generate answers. SportMonks (Netherlands) — queries about matches and players, with no data of yours. Stripe (Ireland and United States) — your email and the payment details you provide to them directly. Railway (United States) — hosting of the application and database. Resend (United States) — delivery of verification and password recovery emails.
We do not sell your data. We do not share it with advertisers. We do not use your conversations to train models.
Some of these providers are outside Brazil and the European Union. Transfers rely on standard contractual clauses and the protection commitments each of them has made.
Conversations and memory: while the account exists, or until you delete them.
Account data: while the account exists. When you delete it, we erase within 30 days.
Billing records: for the period tax law requires, even after the account is closed.
You can: know what data we hold, correct it, obtain a copy, delete conversations and memories, turn off automatic memory, and delete the entire account.
Much of this is in your account area and does not depend on asking anyone. For the rest, write to eduardo@ifantom.com — we reply within 30 days.
You may also complain to the data protection authority in your country: the ANPD in Brazil, or the corresponding national authority in the European Union.
ATLAS uses two: one that keeps you signed in, and one that remembers your chosen language. Both are necessary for the service to work.
We use no advertising, tracking or behavioural analytics cookies. That is why you do not see a cookie banner asking for permission — there is nothing optional to permit.
Without any cookie, we measure which ATLAS pages are viewed, which site or ad the person came from, how long the page stayed open, and the country (and, when provided, the city) of the connection. The visitor is a code that changes every day and cannot recognise you from one day to the next; the network address and the full device details are never stored. If your browser sends “Do Not Track” or “Global Privacy Control”, we measure nothing.
All traffic is encrypted. Passwords are stored with Argon2id and cannot be reversed — not even by us. Sessions live on the server and can be ended immediately.
No system is immune. If an incident occurs that poses a risk to you, we will notify you and the competent authorities within the deadlines the law requires.
If we change this policy materially, we will tell you by email before the change takes effect.