Privacy Policy

Data controller: SOFT ATLAS, a simplified joint-stock company (SAS) with a share capital of €1,000, registered office at 60 avenue de Saint-Ouen, 75018 Paris, France, registered with the Paris Trade and Companies Register under number 131 898 603, represented by its President, Thibault Renouf. SOFT ATLAS took over the operation of Soft Atlas, and the data of the accounts created during the private beta, from Alexandre Deschamps, who ran the platform as an individual until the company was registered.

Soft Atlas is a B2B SaaS review platform where verified professionals rate the tools they use at work. We operate under French law and comply with the EU General Data Protection Regulation (GDPR) and the Digital Services Act (DSA).

If you have any questions about how we handle your personal data, contact us at hello@softatlas.io.

We collect the following categories of personal data:

• Account data: your professional email address (used to verify your employer), your first and last name, and optionally your LinkedIn profile URL.
• Reviews and tool stack: the software ratings and written reviews you submit, and the tools you declare in your professional stack. The tools you declare also contribute, in aggregated and anonymized form, to the technology stack shown publicly on the relevant company's profile page. Reviews are published on Soft Atlas and may be indexed by search engines, with the reviewer shown by first name and last initial, or as an employee of their company when the review is anonymous.
• Employment information: your current employer (matched via your email domain or your LinkedIn profile) and your job title or function, where provided.
• Usage and technical data: standard server logs (IP address, browser type, pages visited, timestamps) and error reports generated when something goes wrong in the application. We also record certain in-product usage events linked to your account (for example, actions taken on the platform and the pages you visit while signed in) to improve the product and support content moderation. You can stop the measurement of your visits from our Cookies Policy.

We do not collect payment card data, government ID numbers, or any sensitive categories of personal data under GDPR Article 9.

To help you find colleagues and peers who are already on Soft Atlas, and to invite the ones who are not, you can choose to import your contacts, from your Google account or from a LinkedIn connections export. This is optional and only happens when you start it.

• What we read: from Google, only the email addresses, names, profile photos and last update dates of your contacts and of the people you have exchanged emails with (read-only access, scopes contacts.readonly and contacts.other.readonly); the dates only put your most recent contacts first and are never kept. From a LinkedIn export, the names and email addresses in the file.
• What we keep: each address or name is turned into a one-way key (a keyed hash) that can only be compared with the keys of Soft Atlas members. So that you can choose whom to invite, the addresses, names and photo links of your Google contacts who are not Soft Atlas members are also kept, encrypted, for 24 hours after the import, then deleted. Photos are shown directly from Google and never copied. Google access tokens are used once during the import and never stored.
• How we use it: only to show you which of your contacts are Soft Atlas members, so you can connect with them, and to let you invite the others. A contact receives an email only when you select them and send the invitation yourself, one contact at a time, within a daily limit; we keep the address of each person you invite, as for any invitation. We never email your contacts on our own, never share or sell this data, and never use it for advertising or to train AI models.
• How long: the keys, until you import again (the new import replaces the previous one), delete your imported contacts from the network page, or delete your account; the list of contacts to invite, 24 hours at most. You can also revoke Soft Atlas's access at any time from your Google account settings.

Soft Atlas's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Providing the service (contract, Art. 6(1)(b)): we process your account data and reviews to create and maintain your Soft Atlas account, authenticate you, and display your contributions on the platform.
• Review authenticity and platform integrity (legitimate interest, Art. 6(1)(f)): we verify that reviewers are genuine professionals and apply a category-based matching system, on a best-effort basis, to avoid displaying reviews of a reviewer's employer's direct competitors. This matching relies on product category information and may not be exhaustive or fully accurate; you can contact us at hello@softatlas.io if you believe a competitor's reviews are incorrectly displayed, or that a competitor has not been properly excluded. Our legitimate interest outweighs the limited privacy impact because the verification relies only on your professional email domain.
• Security and error monitoring (legitimate interest, Art. 6(1)(f)): we use logs and error data to detect abuse, fix bugs, and keep the platform stable.
• Product improvement and content moderation (legitimate interest, Art. 6(1)(f)): we record certain account-linked usage events to understand how the platform is used, prioritize product improvements, and support moderation of content (for example, the multi-user confirmation mechanism described in our Terms of Service). This data is not used for advertising and is not shared with third parties for marketing purposes.
• Legal obligations (Art. 6(1)(c)): we may retain certain data to comply with applicable French and EU law (accounting records, legal requests).

We share data only with the vendors necessary to operate Soft Atlas. Each is bound by a data processing agreement. Some of these providers are based outside the EU; see the International Transfers section below.

• Supabase (PostgreSQL database and file storage, hosted in the European Union - West EU, Ireland) - processes account data, reviews, and stack data.
• Vercel (application hosting and edge network, USA) - processes request logs and serves the application.
• OpenAI (AI-assisted features, via our automation infrastructure, USA) - may receive limited text content for AI-assisted features (e.g. content enrichment). No review text is sent without your awareness. This list may be updated as we evaluate additional AI providers.
• Resend (transactional email, USA) - processes your email address to send verification and notification emails.
• Sentry (error monitoring, USA) - receives error reports and stack traces that may include session context.

We do not sell your data to third parties or share it for advertising purposes.

• Active account: your personal data is retained for as long as your account is active.
• After account closure: your personal data is deleted immediately upon account deletion. Your reviews are retained in anonymized form (your name and employer are replaced with generic identifiers) to preserve the integrity of the platform's historical data.
• Legal retention: certain data (invoicing records, legal correspondence) may be kept for up to 10 years, in accordance with French legal requirements for accounting and commercial records.
• Error logs: retained for 90 days for security and debugging purposes.

Under the GDPR and the French Data Protection Act, you have the following rights with respect to your personal data:

• Right of access (Art. 15): obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data directly in your profile settings.
• Right to erasure (Art. 17): request deletion of your account and personal data. You can initiate this process by contacting us at hello@softatlas.io. Once account deletion is complete, your personal data is deleted, and your reviews are retained only in de-identified form.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format. Contact us to request an export.
• Right to object (Art. 21): object to processing carried out under legitimate interest (for example, error monitoring). We will stop unless we have compelling legitimate grounds that override your interests.
• Right to lodge a complaint: if you believe we have not handled your data lawfully, you may lodge a complaint with the CNIL (the French data protection authority) at www.cnil.fr.

To exercise any of your rights, contact us at hello@softatlas.io. We will respond within 30 days.

Several of our subprocessors (Vercel, OpenAI, Resend and Sentry) are based in the United States, which is outside the European Economic Area. We ensure appropriate safeguards are in place for these transfers:

• Standard Contractual Clauses (SCCs) or equivalent safeguards: we rely on the European Commission's standard contractual clauses, or an equivalent recognized transfer mechanism (such as the EU-US Data Privacy Framework, where applicable), with each subprocessor located outside the EEA.
• Data Processing Agreements: each subprocessor operates under a data processing agreement that binds them to GDPR-equivalent protections.

You can request a copy of the relevant safeguards by contacting us at hello@softatlas.io.

We use a limited set of cookies and local storage: what is strictly necessary for authentication and platform stability, what carries an invitation, partner or claim link through sign-up, and our own anonymous audience measurement, which you can switch off. One more cookie records which channel brought you to Soft Atlas on your first visit, and it is saved on your account if you sign up, so that we know how members found us. You can refuse it from our Cookies Policy. We do not use advertising or cross-site tracking cookies.

For the full details of what cookies we use and why, see our Cookies Policy.

We have not appointed a formal Data Protection Officer (DPO) at this stage, as GDPR does not currently require one for our activity. For any privacy-related request, please contact us instead at the email below.

For any privacy-related request, write to us at: hello@softatlas.io.

We aim to respond to all requests within 30 days. For complex requests, we may extend this period by a further two months and will notify you accordingly.