Privacy notice

1. Controller

No data protection officer has been appointed.

2. Visiting the website

Cloudflare, Inc. provides DNS, TLS, content delivery, static hosting, and security for this site. When your browser requests a page, Cloudflare processes technical data needed to answer and protect that request. This can include your IP address, date and time, requested path, request headers, browser and device information, referrer where supplied, response status, and security or routing identifiers.

The purpose is to deliver the site reliably, prevent abuse, and keep the service secure. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is operating a secure, available website. B1 Atlas does not enable Cloudflare Workers Logs, Workers Traces, or Cloudflare Web Analytics for this site and does not keep its own copy of visitor logs. Cloudflare retains operational and security data under the periods or necessity criteria in its service documentation and agreements.

Cloudflare may process data in the United States and other countries. It relies on the EU–US Data Privacy Framework for covered transfers and on the European Commission's Standard Contractual Clauses where required. Details and copies of the safeguards are available in the Cloudflare Data Processing Addendum.

3. Waitlist and launch emails

When you join the waitlist, your email address is sent directly to Kit (Kit, Inc.). Kit records the signup, sends a confirmation email, and adds you to the list only after you click the confirmation link. We then use the address to send the B1 Atlas launch date, launch offer, the free B1 letter-writing cheat sheet (PDF), and a few closely related launch updates.

Kit may process the email address, signup and confirmation status, timestamps, form attribution, IP address, browser and device data, delivery history, email opens, link clicks, and location inferred from those interactions. B1 Atlas does not use this information for advertising profiles or share it for third-party advertising.

The legal basis for the signup, messages, and the associated Kit telemetry is your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time by using the unsubscribe link in an email or by writing to hello@b1atlas.com. Withdrawal does not affect processing carried out before withdrawal.

Providing an email address is voluntary, but it is required to join the waitlist. Without it, we cannot send the confirmation, launch information, offer, or PDF. There is no legally significant automated decision-making or profiling.

Retention

• Unconfirmed signups are deleted within 7 days.
• Confirmed subscriber profiles are kept until you unsubscribe or until 30 days after the final promised launch-related email, whichever happens first.
• After withdrawal or the end of the waitlist, the active Kit profile is deleted within 30 days.
• Minimal consent evidence and a suppression record are kept until the end of the third calendar year after consent ends, solely to demonstrate consent and prevent another marketing message. They are then deleted unless a claim requires longer retention.

Kit processes subscriber data for B1 Atlas as a processor and uses subprocessors for hosting, delivery, security, support, and related service functions. Processing can take place in the United States. Kit states that it uses the EU–US Data Privacy Framework for covered transfers and Standard Contractual Clauses where required. The current recipients and safeguards are listed in the Kit Data Processing Addendum.

4. Contact by email

Messages sent to hello@b1atlas.com are routed by Cloudflare Email Routing to a Gmail inbox operated by Google. We process your address, message, attachments, and technical delivery data to answer you. The legal basis is Article 6(1)(b) GDPR when the message concerns a contract or steps before a contract, and Article 6(1)(f) GDPR for other enquiries. The legitimate interest is answering genuine enquiries and keeping a record long enough to follow them through.

Ordinary enquiries are deleted within 6 months after the final reply. Records may be retained longer where a legal retention duty applies or they are needed to establish, exercise, or defend legal claims. Cloudflare and Google may process data in the United States using the EU–US Data Privacy Framework and, where required, Standard Contractual Clauses. See Cloudflare's DPA above and Google's data-transfer information.

5. Your analytics choice

You can use every guide and tool without accepting analytics. If you accept, we use PostHog and Umami to understand which tasks help visitors and where they get stuck. Analytics starts only after you choose Accept. Before that, we create no analytics identifier, make no analytics country lookup, send no analytics request to PostHog or Umami, and record no session.

Open analytics settings to accept or reject. The same settings link is available in every page's footer. Closing the settings without choosing does not grant consent. Your choice is separate from signing up for Kit emails.

What this browser stores

If you accept, we save your acceptance and its version in your browser's local storage, under b1atlas.analytics-consent. This consent record contains no visitor identifier and is not sent to PostHog. It has no automatic expiry. It remains until you reject analytics, clear site data, or a new version replaces it. This notice accompanies consent version 4. An older acceptance does not enable the expanded collection; you must choose again. An invalid or unreadable entry keeps analytics off. If saving or removing acceptance fails, analytics stays off on the current page and the settings show the problem.

Rejecting removes any saved acceptance. We do not store a rejection or a banner dismissal in browser storage or send it to a server. The banner stays dismissed while you move between pages in this tab. Without a saved acceptance, it appears again on a fresh visit or full page reload. Older saved rejection entries are removed when read.

After consent, we also store a random browser identifier and session information under b1atlas.analytics-audience.v1. The identifier links consented visits across reloads and tabs in the same browser. It is valid for 90 days from creation, without extending that period on each visit. It is replaced at the next consented use after expiry. A session ends after 30 minutes without measured activity or after 24 hours, whichever comes first. Session information includes the first page and reviewed acquisition categories observed after consent.

We store a feedback invitation time and session reference underb1atlas.analytics-feedback.v1 to limit automatic invitations to one per session and pause them for 30 days after an invitation. Voluntary feedback remains available. Expired audience and feedback records may remain in local storage until they are replaced, you withdraw consent, or you clear site data. We do not use analytics cookies, fingerprinting or cross-device matching. These identifiers describe measured browsers, not identified people.

Optional analytics and provider

After you accept, PostHog, Inc. records page visits, page language and topic, broad device and browser categories, approximate country, and reviewed referral and campaign categories. It records the first page observed in a session, whether this browser has been observed before, and when guides or tools are shown, started and used. Defined steps, results, public resource actions and links, accepted waitlist requests, and sanitized error context help us understand use and failures. Error context contains fixed codes and public page, feature, step and release references. A waitlist event contains no email address and does not establish that you confirmed your subscription.

Optional feedback asks whether you completed your task and offers fixed reasons when something did not help. A separate sample may be asked which broad task brought them here. We record prompt eligibility, visible invitations, selected responses and dismissals so we can distinguish responses from unanswered invitations. Feedback is voluntary; we do not collect an open-text comment through these prompts. Manual feedback and automatic invitations are kept separate in reports.

We do not send tool answers, typed letters, calculator scores, email addresses, free text, arbitrary URLs, URL queries or fragments, or referrer paths. We do not link analytics to email subscribers or create named person profiles. Blanket interaction capture, PostHog's separate survey service, console and network recording, performance capture, PostHog AI, Replay Vision, and autonomous fixes are off.

We record a masked random sample of 25% of eligible consented sessions. Form controls, analytics settings, hidden content, tool choices and results, and other private areas are blocked or masked. The recording excludes network headers and bodies, console messages, canvases, and cross-origin frames. On reviewed public page areas, heatmap data contains click coordinates, viewport size, the page path without query details, and maximum scroll depth. It does not contain the clicked text or form value. PostHog retains new session recordings for 30 days.

Our project uses PostHog Cloud EU, which PostHog describes as hosted in Frankfurt. IP-address discard is enabled and PostHog's GeoIP enrichment remains disabled. After consent, the browser requests a country code from an endpoint on b1atlas.com. Cloudflare supplies that approximate country from its handling of the network connection. The endpoint returns only the country code, without an IP address, city, postcode or coordinates. The site sends that code and its country name to PostHog. We do not request your browser's precise location. An unavailable country remains unknown; VPNs and proxies can make the country differ from your location.

After you accept, requests pass through e.b1atlas.com to PostHog EU. PostHog uses Cloudflare to forward these requests. Cloudflare processes the data in transit and may use servers outside the EU. PostHog states that this service does not cache requests or keep request logs. This routing does not change your analytics choice: rejecting analytics prevents these requests.

Cloudflare processes connection data as described in section 2. PostHog also receives an IP address when handling a network request, but our settings prevent it from being stored with analytics events. B1 Atlas does not send city, postcode, coordinates or other precise location fields to PostHog. Approximate country does not tell us your nationality, language ability or reason for visiting.

The project's free plan specifies a 12-month event-retention window. PostHog currently reports that enforcement is not active for this project, so we cannot promise automatic deletion after 12 months. Analytics events may remain longer. We will review this after launch and update this notice if the retention arrangement changes.

PostHog processes analytics data for B1 Atlas. Its Data Processing Agreement and subprocessor list describe processing and international-transfer safeguards, including the EU–US Data Privacy Framework and Standard Contractual Clauses. EU hosting does not mean that all processing stays in the EU. The legal basis is your consent under Article 6(1)(a) GDPR. Consent also covers optional storage or access on your device under section 25(1) TDDDG. No analytics cookies or cookieless tracking is used when you reject analytics.

Our own Umami analytics

After you accept analytics, we also count page visits with our own Umami installation at stats.shopwiselane.com, hosted in the USA. We send the public page path and, when recognised, only the referring website's domain. Query strings, URL fragments, form entries and custom visitor identifiers are excluded. Umami sets no cookies. Its server receives the IP address and browser information needed to handle the request and derive anonymous visit statistics and approximate location. We do not enable Umami session replay or automatic click tracking. Rejecting analytics stops new Umami requests too.

Self-hosted Umami retains statistics until they are deleted. We have not verified an automatic deletion schedule for this installation, so we cannot promise a fixed deletion date. Contact us using the address in this notice with questions about earlier data.

Changing or withdrawing your choice

Choose "Reject" in the settings at any time. Withdrawal stops new analytics requests and recording, cancels the country lookup, discards unsent events, and removes the saved acceptance, audience identifier, session information and feedback cooldown record where browser storage allows removal. Already sent data is not recalled. Requests about earlier data can be sent to hello@b1atlas.com. If you accept again, observation starts with the current page and state. Earlier interactions are not reconstructed or sent afterward.

6. Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction, and data portability. You may object to processing based on Article 6(1)(f) GDPR. An objection to direct marketing is always effective for future marketing. You may also withdraw consent at any time.

Send a request to hello@b1atlas.com. You also have the right to complain to a data protection authority. The authority responsible for the controller's establishment is:

You may also complain to an authority in the EU Member State where you live or work, or where you believe an infringement occurred.