Forum Atlas
Start free

Privacy Policy

Version 1.1 · Last updated: October 15, 2026

Forum Atlas, Inc., a Delaware corporation (“Forum Atlas,” “we,” “us”). This Privacy Policy explains what information we collect when you use the Forum Atlas platform, website, and APIs (the “Platform”), how we use it, and your choices. It is incorporated into our Terms & Conditions.

1. Scope

This policy covers personal information about users of the Platform (account holders, invitees, and visitors). It does not govern the public-source information the Platform ingests and analyzes, which is drawn from publicly available records and is addressed in Section 8.

2. Information we collect

Account information (email, name, organization), usage analytics (page views, and the questions you ask, stored as you typed them), workspace data (saved searches, watchlists, brief preferences), billing information (managed by Stripe; we never store card details). Ingesting a customer's own private documents is planned for Enterprise and is not built yet; we will describe how that data is isolated here before we accept any.

You provide:

  • Account & identity — name, work email, organization, and authentication identifiers, handled through our auth provider (WorkOS).
  • User inputs — queries, watchlists, saved configurations, feedback.
  • Billing — if you purchase a paid plan, payment is processed by our payment processor (Stripe); we receive limited billing metadata, not full card numbers.
  • Communications — messages you send us (e.g., support).

Collected automatically:

  • Usage data — features used, briefs/queries run, timestamps, approximate volume.
  • Device/log data — IP address, browser/user-agent, and similar log information.
  • Cookies / similar technologies — for authentication, preferences, and (if enabled) product analytics.

3. How we use information

To provide and improve the Forum Atlas service, deliver briefs, generate forecasts, surface entity-graph updates, send transactional emails (account verification, brief delivery), authenticate and secure accounts, process payments, provide support, monitor performance/errors/abuse, comply with law, and meet our security + compliance commitments (a formal third-party security audit is planned after launch; we hold no security certification today). We do not sell your personal information.

4. Legal bases (where applicable)

Where required (e.g., EU/UK), we process personal data on the bases of contract performance, our legitimate interests in operating and securing the Platform, your consent (optional analytics), and legal compliance.

Analytics and session replay. Optional product analytics (PostHog) run only after you choose Accept in the consent banner. Until then, and if you choose Reject, no analytics request is sent to PostHog from your browser. The choice is stored in your browser, applies to every visitor wherever they are, and can be changed at any time with the control below. A Global Privacy Control signal from your browser is treated as a refusal. Session replay is not used: it stays disabled even if you accept analytics, and we would ask separately before ever enabling it. Separately, our web host (Vercel) provides aggregate, cookie-less page-view and performance measurement that does not identify you.

Analytics are off in this browser (no choice recorded yet).

5. Sharing

We do not sell personal data. We share personal information only with service providers / subprocessors that operate the Platform on our behalf, under contract. This is the complete list; the same list, with its change history, is published at Subprocessors.

Subprocessor list version 1.1, effective October 15, 2026

  • Vercel, Inc. — Web application hosting and content delivery (United States)
  • Supabase, Inc. — Managed PostgreSQL database and storage (United States)
  • Modal Labs, Inc. — Compute for the intelligence and ingestion services (United States)
  • WorkOS, Inc. — Authentication and session management (United States)
  • Stripe, Inc. — Payment processing and billing (United States)
  • Anthropic, PBC — AI model inference (query and content processing) (United States)
  • Voyage AI, Inc. — Text embedding generation (United States)
  • Cohere, Inc. — Search re-ranking (United States)
  • Cloudflare, Inc. — DNS, CDN, and network security (United States (global edge))
  • Resend, Inc. — Transactional email delivery (United States)
  • Google LLC (Google Workspace) — Business email (United States)
  • Functional Software, Inc. (Sentry) — Error and performance monitoring (United States)
  • PostHog, Inc. — Product analytics, only for visitors who accept analytics in the consent banner (United States)

We may also share information where required by law, to enforce our Terms, to protect rights and safety, or in connection with a merger, acquisition, or asset sale, subject to this policy.

6. AI processing of your inputs

Your queries and inputs may be processed by our AI providers to generate responses. We use AI providers under API terms intended to prevent customer inputs from being used to train their models, and we do not use a customer's private inputs to train models for other customers.

7. Data retention

We retain personal information for as long as your account is active and as needed to provide the Platform, then for a reasonable period to meet legal, accounting, security, and dispute-resolution needs, after which it is deleted or anonymized.

8. Public-source content

The Platform synthesizes publicly available information (e.g., government filings, regulatory records, public disclosures). Where that public information references individuals (such as named executives or officials), it is processed as part of providing industry intelligence and is sourced from public records. Requests concerning such content follow the process in Section 10.

9. Security

We use administrative, technical, and organizational safeguards — including access controls, tenant isolation, and least-privilege practices — to protect personal information. Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest by our managed infrastructure providers. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, export, or restrict processing of your personal information, and to object or withdraw consent. You can also manage analytics preferences with the control in Section 4.

How to make a request. Email privacy@forumatlas.com from the address the request concerns, or tell us how we can confirm it is yours. Say which right you are exercising (access, correction, deletion, export, restriction, or objection) and, if the request is about information in the Platform’s public-source content rather than an account, the name and a link to the page it appears on. You do not need an account, and making a request costs nothing. An authorized agent may make a request on your behalf with proof of authority.

What happens next. We confirm receipt within 5 business days and may ask for information to verify your identity; we use it only for that. We answer within 30 days of receiving the request. If a request is complex and we need longer, we tell you within those 30 days why and by when, as the law allows. If we decline a request we say why, and you may complain to your data-protection authority.

Deleting an account or workspace. When a workspace owner asks us to delete a workspace, we delete the workspace’s data on request, as the Data Processing Addendum describes; we confirm when it is done. Copies in backups age out on the backup rotation. We keep the records the law requires us to keep, such as the record that the Terms were accepted and billing and usage records.

11. International data transfers

The Platform is operated and hosted in the United States (our infrastructure providers are listed in Section 5). If you access the Platform from outside the U.S. — including the EEA, UK, or Switzerland — your information is transferred to and processed in the U.S. and other countries where our providers operate. Where required, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable) and equivalent safeguards for those transfers, and we make our Data Processing Addendum available to business customers on request.

12. Children

The Platform is not directed to individuals under 18, and we do not knowingly collect their personal information.

13. Changes to this policy

We may update this policy; the “Version” and “Effective” date will change, and material changes will be notified. Continued use after changes take effect constitutes acceptance.

14. Contact

Forum Atlas, Inc. — Email privacy@forumatlas.com.