Privacy Policy

Who runs ATLAS

ATLAS is a research prototype built as an individual MSc research project. It is not operated by a company, and it is not a commercial service.

Questions about this policy: [email protected]. A request about your own data is made from inside ATLAS, as “Your rights” below explains, because only that route can prove the request is yours.

What ATLAS collects

Your account. Your email address, a one-way hash of your password — never the password itself — an optional display name, and the short-lived tokens that make email verification and password resets work. If you turn on two-factor authentication, the secret behind it, encrypted.

Your organisations. Which organisations you belong to and your role in each. Everyone gets a private organisation of their own on sign-up; it has no other members.

What you upload, and what ATLAS makes of it. The file itself, and everything derived from it: the structured copy ATLAS reads it into, images pulled out of it, AI-written descriptions and table summaries, and the numeric representations that let passages be found by meaning.

Settings and activity needed to run it. Your notification preferences, your appearance preferences, the notifications addressed to you, the processing state of your uploads, and whether you have been through the welcome screen — that last one recorded against your account, so it follows you between browsers instead of being inherited by whoever signs in after you on the same one.

Your questionnaire answers, and the learner profile built from them. If you take the learning-preference questionnaire, the answers you give are stored against your account, together with which questions you were shown. Your profile is worked out from them each time it is needed. Neither is ever visible to an organisation you belong to — not to its admins, not in any report, and not in any export. Answering is optional, you can answer as much or as little as you like, and you can change or discard any part of it at any time.

Your quiz answers, and which flashcards you have reviewed. If you practise on a section, what you typed or chose is stored against your account, together with whether it was marked right and when you answered. Reviewing a flashcard stores when you next want to see it. None of it is visible to an organisation you belong to — not to its admins, not in any report, and not in any export. One thing is shared and it carries no identity: how often a generated question is answered correctly, counted across everyone who has met it, so the questions can be ordered by how hard they turn out to be. That count records no person and no organisation, and nothing can be traced back from it to you. A written answer is never part of that count, and neither is its mark.

The mark on a written answer. When ATLAS marks a written answer it stores the score, which points of the marking guide you covered, the words of your own answer it credited for each one, and the feedback it wrote for you. To do that, your answer is sent to an external AI service — the same kind of service described below, outside your country. It is sent to be marked and for nothing else: it is not used to build the marking guide, which is written from the lecture material alone and shared between everyone answering that question, and it is not added to any count. The mark is yours — not visible to your organisation, not in any report, and not in any export.

Sometimes ATLAS cannot mark an answer. When that happens you are told so plainly, no score is recorded, and you can write the answer again — nobody reviews it. There is no person waiting behind that screen and the wording never suggests otherwise.

Your conversations with the tutor. When you ask the tutor about a lecture, ATLAS stores your question, the answer, and which parts of the lecture the answer came from. Your question is sent to an external AI service — the same kind of service described below, outside your country — along with the passages of the lecture it needs to answer, and your previous two exchanges in that conversation. It also reaches the separate company that builds the search index, which is how the right passages are found. Two, and no further back: an older exchange is not sent, so something you typed early in a conversation stops travelling with it rather than following you through the whole thread. Nothing about who you are goes with it — not your name, not your email, and not your learning profile.

Your organisation can never see a tutor conversation. Not an admin, not a report, not an export, and not a support request — there is no setting that turns it on, because there is no setting at all. This is the same protection your learner profile and your private notes have.

Facilitator posts in a discussion. When a member of your organisation asks the AI facilitator to join a discussion thread about a lecture, ATLAS keeps the post it wrote, which passages of the lecture it drew on, which post in the thread it had read up to, and — for accounting only — who asked. Nobody is shown who asked: the post is the facilitator’s, not that member’s, and it counts against the asker’s own daily AI allowance. What the facilitator was shown of the thread is described under “Who else your data reaches” below.

A rough sense of how your practice is going. If you switch on the supportive-tone feature, ATLAS looks at how your recent answers went — how many were wrong in a row, and whether you are working more slowly than usual — to decide how to word things and which question to show you first. It can soften the wording when you are struggling, or offer you the harder questions first when you are not. The sense itself is never stored. It is worked out from the answers already listed above, at the moment it is needed, and then it is gone. It is never worked out at all unless you switch the feature on. What is kept is the ordinary record listed above — the feedback on an answer, or a tutor reply — which was worded while that sense applied, and which only you can see.

Your organisation can never see it. Not an admin, not a report, not an export — there is no setting that turns it on, because there is no setting at all, and no part of ATLAS can be asked about another person’s. This is the same protection your learner profile, your tutor conversations and your private notes have.

People you invite. If you invite someone to an organisation, their email address is stored so the invitation can be sent and accepted — before they have an account, and before they have seen this page.

Reports you file. If you report material, what you wrote and any contact detail you chose to add is stored with the report, and is readable by the platform operator reviewing it.

Which apps you have connected. The app, what you allowed it to do, when you allowed it, and which version of these documents you accepted at the time. Visible only to you — not to any organisation you belong to, and not in any report or export. Settings → Privacy & data is where you see and end them.

A developer account’s applications and keys. If your organisation is a developer account, ATLAS keeps what it needs to run the applications you build: each application’s name, its permissions and which member created it; for each API key, its name, its permissions, when it was created and last used, when it expires or was revoked, and which member created it — never the key itself, only a one-way fingerprint of it, with its first characters and last four so you can tell your keys apart; each webhook address, the events it asks for, which member added it and its signing secret, encrypted; and a log of each message ATLAS tried to deliver there, holding a copy of the message itself, how many attempts it took and how the last one ended. Members of that organisation see these in the developer portal, as far as their role allows.

The learners a developer links. A developer’s application can link one of its own learners to ATLAS; the API calls them end users. ATLAS keeps which of the developer’s applications linked the learner, when they were linked and unlinked, and a SHA-256 digest of the reference the developer chose for them, never the reference itself. A digest does not hide a value that can be guessed: whoever holds it can find an email address or a student number by trying candidates, which is why developers are asked to send an identifier that means nothing outside their own system. When a developer sends an Idempotency-Key with the link, the same digest is also kept with the record that makes a retry act once, and that record stays after the learner is unlinked, until the application or the developer account is deleted. A learning profile the developer sends to get recommendations for that learner is used to answer that one request and is not kept. For the learners a developer links, the developer decides what happens to their data and is responsible for their consent (in legal terms, the data controller). ATLAS processes that data only on the developer’s behalf.

Which version of these documents you agreed to. Recorded against your account when you sign up, with the date.

Technical data. The cookies listed in the next section, and — for a short window, to stop password-guessing — counters keyed to the IP address sign-in attempts came from. While you are signed in, a counter keyed to your account counts your requests for a short window, so that no one person can use more than a fair share of ATLAS; each API key and each app you connect has a counter of its own. Each counter disappears when its window ends. Server logs record requests and errors.

How ATLAS itself is used, counted without naming anyone. ATLAS counts, day by day, how often its features are used, how often a feature it switched on for someone is switched off, how many questionnaire areas are started and finished, how many searches found nothing (never what was searched for), how many minutes are spent reading, how quizzes go on a first attempt, and how often its AI checks pass. These counts record no person, no organisation and no content.

Which months you used ATLAS, in each organisation. One record per month that you were signed in and used an organisation — the month and the organisation, nothing about what you did. It is kept for 25 months, deleted with your account, and included in your own download. No organisation can see it; ATLAS staff see it only as counts that cover at least five people.

Your organisation’s payment relationship, if it pays. The payment company’s own reference numbers for your organisation and its subscription, and a record of each charge: what was charged, in Sri Lankan rupees, and on which day. The payment company is PayHere. About the card itself, ATLAS keeps only its brand.

No card number, no expiry date, no security code and no billing address is ever kept by ATLAS. Your card is entered on PayHere’s own pages and stays there; there is no field anywhere in ATLAS that could hold one. PayHere’s message back to us carries a partly-hidden card number and can carry other card details; ATLAS reads none of them and keeps only a fingerprint of the message, from which they cannot be recovered — which is why you see your card’s brand and no digits at all. The billing contact you type at checkout is passed straight to PayHere and is not kept either.

What you write to the support address, if you do: your message, the address it came from, and our reply.

Cookies

ATLAS sets cookies for three things, and nothing else:

• Keeping you signed in — your session; the short-lived one that carries you through a two-factor challenge; a short-lived one that makes sure a Google sign-in finishes in the browser that started it; if an app sent you here to ask permission, a short-lived note of which screen to bring you back to afterwards; and, in an ATLAS staff member’s own browser only, which account a support view is showing while it lasts.
• Remembering how you like to read — the light, dark or high-contrast theme, the reader’s font, text size and spacing, and how wide you keep its side panels, so the first page you see is already right rather than changing under you.
• Remembering something you have already seen — a prompt you dismissed, or the welcome screen you have been through. The dismissal is kept on this device so it does not come back. The welcome is now kept on your account instead, and the cookie for it is on its way out.

There is no advertising and no third-party tracking of any kind, and ATLAS’s own counting of how it is used names nobody. No cookie here follows you anywhere else.

Who else your data reaches

Two external AI services, both outside your country. One writes the image descriptions and table summaries; a different company builds the index that lets passages be found by meaning, and every passage of every document you upload goes to it. Their published terms say they do not train on what is sent through their APIs. ATLAS holds no contract guaranteeing that, and does not set a provider option enforcing it — the protection is their policy, not our configuration.

What you write in an answer box goes to the first of those services, when you answer a written question and ATLAS marks it — and so does what you ask the tutor, together with your previous two exchanges — and so does a discussion thread’s title and its most recent posts — yours, if you wrote any of them — when any member of your organisation asks the facilitator to join that thread. Those are the only things you write that leave ATLAS: your notes and highlights, your questionnaire answers and everything in your profile stay here. A marked answer is sent to be marked and is not kept by us beyond your own attempt record; a tutor question is sent to be answered, and your question also reaches the company that builds the index, so the right passages of the lecture can be found for it. A thread goes without anyone’s name — the posts are numbered, and that is all the model is told about who wrote them — only a fixed number of its most recent posts, only when a member asks and never on a schedule, and only in a thread that is about one of your organisation’s lectures. Its title and its most recent member post reach the index company too, as the search for the passages the facilitator may use.

Google, only if you choose “Continue with Google” — in which case Google tells ATLAS your email address and name.

An email service, to deliver verification, password-reset and notification mail.

The platform operator. Reported material, and whatever you wrote in the report, is readable by whoever reviews it — across every organisation.

PayHere, the payment company, if your organisation buys a plan. ATLAS tells it the amount, the currency, the plan’s name and a reference number for the organisation, and passes on the billing contact you type at checkout — your name, email address, phone number, address, city and country — which PayHere requires for its receipt. ATLAS keeps none of that contact: it goes from the checkout screen through ATLAS straight to PayHere. Your card you give to PayHere yourself, on its own page, which is also where its receipt comes from.

Cloudflare and an email provider, if you write to the support address. Cloudflare receives mail for that address and forwards it to the inbox of the person who runs ATLAS, which an email provider holds; it is read and answered there.

An app you connect yourself, if you ever allow one. ATLAS shows you exactly what it is asking for before anything is shared, and it can only do what you agreed to on that screen. You can disconnect it at any time in Settings, and it stops having access straight away. Signing out of ATLAS everywhere does not disconnect it — that is a separate decision, and only you can make it.

No app can reach your questionnaire answers, your learner profile, your private notes or your conversations with the tutor. Those are covered below, and nothing you can grant an app unlocks them.

A developer’s own servers, if a developer account registers a webhook address. ATLAS tells that address when a lecture in that organisation finishes processing, changes or fails: which lecture and version, which event and when it happened, identifiers for the message itself, and, when a lecture failed, the stage that refused it. Each message carries no title, no content and nothing about any person. The address is the organisation’s own choice, and its administrators and moderators can remove it at any time.

Nothing is sold, and nothing is shared for advertising. Apart from an app you connect yourself and the webhook messages above, your data is not passed to anyone else except where the law requires it.

What other members of your organisation can see

Members of an organisation you belong to can see the material uploaded into it, who its members are, anything you post in a discussion there — your posts, your name beside them, and which posts you have marked as helpful — and any work you offer for peer review, with your name beside it. They cannot see anything from your other organisations, and your private organisation is visible to nobody but you.

A review of that work is narrower still: it is visible to the person who wrote it and to the person whose work it is about, and to nobody else — not another member, and not an administrator. A review is not anonymous: the person whose work you review sees that you wrote it, with your name beside it, and you see who reviewed yours.

When a member asks the AI facilitator to join a discussion, its post is visible to every member of that organisation like any other post, and it does not say who asked for it.

Nothing you have not published is visible to them. Your notes, highlights and tags, your quiz answers and marks, your conversations with the tutor, and how a lecture is being presented to you all stay private to you — no other member and no administrator can read them. Whether you have read a discussion is private to you as well.

Because ATLAS stores one shared copy of any file uploaded more than once, an organisation may be holding the same processed copy as yours. Nothing identifies you to them, and nothing identifies them to you — see the Terms of Service for how that works.

What ATLAS does not collect

Nothing reads what you write to work out how you feel. The supportive-tone feature described above looks only at whether your recent answers were right or wrong and how long you took. It does not read your answers, your notes, your questions to the tutor, or anything else you type, and none of that is ever sent anywhere to be judged for mood.

This matters for reading the rest of this page: where a feature is absent, the data is absent because the FEATURE is, not because of a promise about it. When those features arrive, this policy is updated before they do, and it will say who can see what.

How your data is protected

Every read of organisation data is checked three times over — your role, your ownership of the specific item, and a database-level rule that refuses anything outside your organisation even if the first two were wrong. Uploads are virus-scanned before they are processed, and files are served in a way that stops them running as code.

When ATLAS staff look at your account to help you. To sort out a problem, a small number of ATLAS staff can open your screens as you see them — read-only, for thirty minutes at most, after confirming with their own second factor and writing down why. Your learner profile, questionnaire answers, tutor conversations and private notes stay closed unless the reason they wrote down is about exactly that, and every one of those screens they open is recorded in the security log with who, when and why. They cannot change anything on your account while they look, cannot download your files or your data, and cannot look at another member of staff this way.

What is not yet protected, stated plainly. Traffic between your browser and ATLAS is encrypted. Storage is not: ATLAS runs on research infrastructure, and uploaded files and the database are not separately encrypted at rest. Your password is never stored in a form anyone can read, and a two-factor secret is encrypted — but the documents you upload are not. Upload accordingly.

How long it is kept

Account data is kept while the account exists, and erased when it is deleted, as described under your rights below. The monthly record of when you used ATLAS is kept for 25 months, then removed; the counts that name no one are kept as statistics. A deleted upload is recoverable for a grace period and then removed for good, along with everything derived from it — unless another organisation still holds the same shared copy, in which case that copy survives for them.

A message to the support address is kept for as long as it takes to answer it, and longer only where it records something agreed — a refund, for example — for as long as the payment record it belongs to.

Your rights, and how to use them

Depending on where you live, you have rights over your personal data — to see it, to get a copy of it, to correct it, and to have it deleted. Those rights exist whether or not this software has a button for them, and these are the buttons it has.

A copy of your data. Signed in, go to Settings, then Privacy & data, and choose Download my data. You get one file with everything ATLAS holds about you, including your questionnaire answers, learner profile, notes and tutor conversations — the things no organisation can ever see. Nobody else sees the file, ATLAS keeps no copy of it, and we email you whenever one is downloaded. It never contains passwords or other sign-in secrets.

Deleting your account. On the same page, choose Ask to delete my account. ATLAS staff carry the request out; until then you can withdraw it there. Deleting your account erases your personal data, and your private workspace goes with it. What you uploaded to a shared organisation stays with that organisation, because it is theirs, and so does what you wrote in its discussions, shown as by a former member. Records the law requires us to keep — invoices, and security logs of who did what — are kept, with nothing that names you: they hold only an identifier that no longer leads to anyone.

Correcting your data. Your learning preferences and your questionnaire answers can be changed from Settings, under Learning preferences. There is no self-service way yet to correct other details, such as your name.

These routes need you to be signed in. The support address answers questions but cannot carry out a request, because an email cannot prove whose account it is about; so if you cannot sign in, reset your password first. If your account has been suspended you cannot sign in at all, so you can still ask for its deletion without signing in: on the sign-in page, or at ask to delete your account, enter its email address and confirm from the link we send there. That makes the same request as the button above, and ATLAS staff carry it out the same way. A copy of your data cannot be sent by email link, because it contains what only you should see.

Changes to this policy

This policy carries a version number and an effective date, shown at the top of this page. Any change that affects what is collected, who sees it, or what you can do about it raises the version.