Privacy policy

Who we are

PullAtlas Ltd, a company registered in England and Wales (company number 17349728), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. For the personal data described here, we are the data controller. You can contact us about privacy or exercise your rights at privacy@pullatlas.com. We are registered with the UK Information Commissioner’s Office (ICO), registration number ZC203359.

What we store

Your account details (name, email, preferences) and your workspace data: projects, chapters, Atlas entries, Plan beats, Progress stats, Review tasks, release plans, and feedback you send. If you connect your own AI provider key, we store it encrypted so features can use it on your behalf. If you subscribe to a paid plan, we store your plan status and a customer reference from our payment provider (never your card details). All of this exists to run the workspace for you; none of it is sold, shared for advertising, or used to train AI models.

Lawful bases

We process your data to perform our contract with you (running the workspace, syncing, and the features you invoke); on the basis of our legitimate interests (keeping the service secure, preventing abuse, and fixing errors) balanced against your rights; and to comply with our legal obligations (such as tax and accounting for paid plans). Where a feature depends on your consent, we ask for it and you can withdraw it.

No public publishing

PullAtlas does not create reader-facing pages, public story profiles, or any public surface for your work. Your manuscripts are visible only to your account and to collaborators you explicitly invite.

AI features and your key

AI features run only when you invoke them. PullAtlas is bring-your-own-key: when you use a feature, the relevant story context is sent to the AI provider whose key you connected (such as Anthropic, OpenAI, Google, or OpenRouter) to produce the result, and for semantic search a passage may be sent to our embeddings provider to create embeddings; that provider has no right to use what we send for training, and deletes it immediately after processing. Your key is stored encrypted and is used only to make requests you trigger. PullAtlas itself never uses your work to train or improve AI models. However, the AI provider you choose processes your content under its own privacy terms and may retain or use what you send for its own purposes, such as model improvement, depending on that provider’s policy and the plan you hold with them, so please review the policy of whichever provider you connect and, if it matters to you, choose one that offers a no-training commitment. Nothing is sent to any AI provider unless you trigger a feature.

Cookies and local storage

PullAtlas uses cookies only to keep you signed in, and your browser’s local storage for interface preferences such as theme. There are no advertising or cross-site tracking cookies.

Services we rely on (sub-processors)

Running PullAtlas takes a small set of established third-party providers, each contracted to act only on our instructions, chosen for their security and privacy standards, and given no more of your data than their single job requires. By category, they provide: secure cloud hosting, our database, and sign-in; domain and email routing; the real-time collaboration service behind shared projects only; payment processing and tax through a merchant of record for paid plans, where your card details go to the provider directly and never touch PullAtlas servers; embeddings for semantic search; and error monitoring, which never captures manuscript text and masks any session recorded around an error. Separately, when you invoke an AI feature, the relevant story context is sent to the AI provider whose key you connect (such as Anthropic, OpenAI, Google, or OpenRouter) to produce the result. We keep the specific list of these providers current and will share it with you on request at privacy@pullatlas.com.

International transfers

Some of these providers are based outside the UK and EEA, including in the United States. Where your data is transferred internationally, it is protected by appropriate safeguards such as the providers’ standard contractual clauses or an adequacy decision.

How long we keep data

We keep your workspace data for as long as your account is open. When you delete your account, your account and every project you own are removed. Limited records we are legally required to keep, such as billing and tax records for paid plans, are retained for the period the law requires and then deleted.

Feedback context

In-app feedback can include the current route, owned project id when available, browser, viewport, language, timezone, theme, and the last visible app error. It never includes manuscript text automatically.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to correct it, to have it erased, to receive a portable copy, and to restrict or object to certain processing. You can export your complete workspace at any time and delete your account yourself from Settings. To exercise any other right, contact us at privacy@pullatlas.com. If you believe we have handled your data wrongly, you can complain to the UK Information Commissioner’s Office at ico.org.uk, though we hope you will contact us first so we can help.

Backups and export

Export tools create PullAtlas JSON backups and manuscript files whenever you want them. Manuscript exports exclude archived chapters by design; PullAtlas backups include archived project data for recovery.

Changes to this policy

This policy may be updated as the service evolves. Material changes will be announced in the app, and the date above always reflects the current version.