Atlas Collector Privacy Notice

This Privacy Policy explains how Atlas Collector, Inc. ("Atlas", "we", "us", or "our"), a Delaware corporation, collects, uses, stores, and shares your personal data when you use the Atlas Collector Platform (the "Platform").

We know privacy policies can feel like fine print. We've tried to write this one clearly. If you have any questions, please reach out through the support channel in the Atlas app.

By creating an account or using the Platform, you agree to the practices described in this policy.

1. Who We Are

Atlas Collector, Inc. is the data controller for personal data collected through the Platform. We are incorporated in Delaware, United States, and operate our physical card vault facility in the United Arab Emirates.

For any privacy-related queries, please contact us through the support channel available in the Atlas app.

2. What Data We Collect

2.1 Data You Provide Directly

When you create an account or use the Platform, we collect: • Name and email address — collected at account creation and used to identify your account and communicate with you; • Phone number — collected for account verification purposes. We may use SMS to verify your identity at sign-up or when you make changes to your account;

• Profile information — including any display name, profile photo, or avatar you choose to add; • Collector preferences — including your card game interests and collector profile information you provide; • Payment information — we collect limited payment details (such as the last four digits of your card and billing country) for transaction records. Full payment card data is processed directly by Stripe and is never stored by Atlas; • Communications with us — including support requests and any other messages you send to Atlas.

2.2 Data We Collect Automatically

When you use the Platform, we automatically collect: • Device information — including device type, operating system, and unique device identifiers; • IP address — collected when you access the Platform and used for security, fraud prevention, and to infer your approximate location; • Usage data — including which features you use, packs you open, and how you interact with the Platform; • Push notification tokens — if you grant permission for push notifications, we collect the token required to send them to your device.

2.3 Data from Sign-In Methods

Atlas currently supports email and password sign-in. We plan to add additional sign-in methods in future, including Google Sign-In and Apple Sign-In. Where you use a third-party sign-in method, that provider will share certain profile information with us (typically your name and email address) in accordance with their own privacy policy and your account settings with them. We will update this policy when additional sign-in methods become available.

3. How We Use Your Data

We use the data we collect for the following purposes: • Account creation and management — to create and maintain your Atlas account and verify your identity; • Phone verification — to send SMS verification codes to confirm your phone number at sign-up or account changes; • Pack opening and vault management — to process pack purchases, allocate cards to your account, and manage your Vault; • Payment processing — to facilitate purchases through Stripe and maintain transaction records; • Platform communications — to send you transactional messages including pack opening confirmations, purchase receipts, and important account notifications; • Push notifications — to send you in-app alerts and updates if you have granted permission; • Security and fraud prevention — to detect and prevent abuse, Promotional Abuse, multiple account creation, and other fraudulent activity; • Platform improvement — to understand how users interact with Atlas and to improve our features and services; • Legal compliance — to comply with applicable laws and respond to lawful requests from authorities.

We do not use your data to serve third-party advertising, and we do not sell your personal data to third parties.

4. Legal Basis for Processing (EU and UK Users)

If you are located in the European Union or the United Kingdom, we process your personal data under the following legal bases: • Contract performance — processing your account data, payment information, and vault management data is necessary to provide the Atlas service to you; • Legitimate interests — we process device identifiers, IP addresses, and usage data on the basis of our legitimate interest in securing the Platform, preventing fraud, and improving our services; • Legal obligation — we may process and retain certain data to comply with applicable law, including financial record-keeping requirements; • Consent — where we send push notifications, we rely on your consent, which you can withdraw at any time through your device settings.

5. Third-Party Services and Data Sharing

5.1 Our Approach to Third Parties

Atlas uses a limited set of trusted third-party services to operate the Platform. We share your data with these services only to the extent necessary for them to perform their function. We do not sell your data to third parties or share it for third-party advertising purposes.

As Atlas grows, we may add new third-party services — for example, analytics tools, customer messaging platforms, or support software. We will update this policy when we do, and where required by law, we will seek your consent before sharing your data with new categories of third party.

5.2 Current Third-Party Services

Atlas currently uses the following third-party services: • Stripe — payment processing. When you make a purchase, your payment details are processed directly by Stripe. Atlas does not store your full card details. Stripe's privacy policy is available at stripe.com/privacy. • Supabase — our backend infrastructure provider, including database, authentication, and file storage. Your account data and vault records are stored on Supabase's infrastructure. Supabase processes data in accordance with its data processing agreement. • OneSignal — push notification delivery. If you have enabled push notifications, your device push token is shared with OneSignal to deliver notifications to your device. OneSignal's privacy policy is available at onesignal.com/privacy.

5.3 Future Third-Party Services

We may in future add services in categories including analytics and product insight tools, customer communications platforms, in-app support software, mobile attribution and marketing tools, and error monitoring services. We will update this Privacy Policy and notify you of any material changes before these services are introduced.

6. Data Retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter, to allow for account recovery and to comply with our legal obligations.

Specifically: • Account and profile data — retained for the duration of your account and for up to 12 months following account deletion, after which it is permanently deleted or anonymised; • Transaction and vault records — retained for a minimum of 5 years to comply with financial record-keeping requirements; • Usage and analytics data — retained for up to 24 months in identifiable form, after which it may be retained in anonymised or aggregated form indefinitely; • Push notification tokens — deleted promptly when you disable notifications or delete your account.

7. Data Security

Atlas takes reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These measures include encrypted data transmission, access controls on our backend systems, and use of established cloud infrastructure providers.

No system is completely secure. If you have reason to believe your account has been compromised, please contact Atlas support immediately.

In the event of a personal data breach that is likely to affect your rights and freedoms, Atlas will notify you and the relevant supervisory authorities as required by applicable law.

8. International Data Transfers

Atlas is a global platform. Your data may be transferred to and processed in countries outside your own, including the United States and the United Arab Emirates, where data protection laws may differ from those in your country.

Where we transfer personal data of EU or UK users to countries that are not subject to an adequacy decision, we take steps to ensure appropriate safeguards are in place, including the use of standard contractual clauses approved by the relevant authorities.

9. Your Rights

Depending on where you are located, you may have the following rights in respect of your personal data:

• Access — the right to request a copy of the personal data we hold about you; • Correction — the right to ask us to correct inaccurate or incomplete data; • Deletion — the right to ask us to delete your personal data, subject to our legal retention obligations; • Restriction — the right to ask us to restrict processing of your data in certain circumstances; • Portability — the right to receive your data in a structured, machine-readable format; • Objection — the right to object to processing based on our legitimate interests; • Withdrawal of consent — where we rely on your consent (for example, for push notifications), you can withdraw it at any time through your device settings or by contacting us.

To exercise any of these rights, please contact Atlas through the support channel in the app. We will respond to all legitimate requests within 30 days. We may need to verify your identity before fulfilling a request.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the data protection authority in your country.

10. Children's Privacy

The Atlas Platform is open to users of all ages, consistent with our Terms & Conditions. We do not knowingly collect personal data from children in a manner inconsistent with applicable law. If you are a parent or guardian and believe your child has provided us with personal data without appropriate consent, please contact us and we will take steps to delete that data.

11. Cookies and Tracking Technologies

The Atlas mobile app does not use browser cookies. We may use equivalent technologies on mobile devices, including device identifiers and local storage, for the purposes described in Section 3 of this policy.

If Atlas launches a web-based interface in future, a separate cookie policy and consent mechanism will be implemented at that time.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or through an in-app notification at least 14 days before the changes take effect. The date at the top of this policy always reflects the most recent update.

We encourage you to review this policy periodically. Continued use of the Platform after a change takes effect constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or how Atlas handles your personal data, please contact us through the support channel available in the Atlas app.