Privacy Policy

Controller and scope

John Fredy Gaviria Zuluaga, an independent individual provider operating commercially through ByMyAtlas and Atlas, is the controller for the processing described in this policy for portfolio.bymyatlas.com and My Atlas. ByMyAtlas, LLC has been formed in Florida. Until a formal controller transition for this service is published, the processing responsibility described in this policy remains with the individual identified above.

Data we may process

We may process name, email, company, account and authentication data, diagnosis and onboarding context, proposals, decisions and approvals, files supplied to perform the project, deliverables, payment-obligation and event metadata, and security and audit records. We do not store full card numbers or card security codes.

Purposes

We use information to respond to requests, diagnose needs, prepare and manage proposals, create and protect accounts, execute projects, manage approvals and deliverables, verify payments, prevent fraud or abuse, provide support, meet legal obligations and preserve traceability. Marketing, where used, requires a separate lawful basis or consent when applicable.

Analytics and measurement

On public pages, Google Tag Manager may load Google Analytics 4 only after the visitor accepts analytics. Until consent is granted, analytics remains disabled. For this layer, advertising storage, advertising user data and ad personalization remain disabled. Private routes and My Atlas are excluded from this measurement. Visitors can reopen analytics preferences from the footer and change their choice.

Advertising measurement with Meta

On public pages, we may load Meta Pixel only after the visitor accepts marketing. We use it to measure visits and campaign conversion milestones, including a Lead event when the visitor starts a high-intent commercial handoff. It is not loaded on private routes or My Atlas. For consented events sent through Conversions API, the server reuses the same event identifier to prevent double counting and may transmit technical measurement identifiers such as _fbp/_fbc, IP address and user agent to Meta; these data are not stored in our funnel table.

WhatsApp Business and Meta messaging

When a person chooses to contact us through WhatsApp, Meta/WhatsApp may deliver to Atlas data necessary to provide and secure the conversation, such as the sender's phone number, profile name when available, message content and type, technical message and business-number identifiers, timestamps, and technical delivery statuses. We use these data to receive and respond to requests, preserve operational context, prevent abuse, secure the channel, maintain traceability where appropriate, and escalate to human support when needed. WhatsApp message content does not by itself grant permissions, access to private inventory, or authority over an account or project.

Automated replies or higher-impact actions are enabled only when operational authorization and applicable governance controls are in place. Meta and WhatsApp process certain data under their own policies and terms when providing the messaging service.

Payments and Stripe

When checkout is enabled, Stripe processes the payment under its own policies and terms. Atlas receives and retains only the transactional information needed to create the payment session, validate amount and currency, verify signed confirmation, reconcile project status and handle refunds, reversals or disputes where applicable.

Technology providers

The current architecture uses providers such as Supabase for authentication, database and storage, Vercel for hosting and deployment, Google Tag Manager and Google Analytics 4 for consented analytics on public pages, Meta Pixel for consented advertising measurement, Stripe for payments when enabled, and UserWay solely as an additional accessibility-personalization layer. WhatsApp, Instagram and LinkedIn apply their own policies when you choose to open them.

International processing

Some technology providers may process information outside Colombia. Before enabling contracting or processing that requires additional mechanisms, Atlas will validate and document the contractual and legal measures applicable to the provider, data type and country involved.

Security

We apply account and project access controls, RLS, private storage, authentication, MFA for sensitive actions, server-to-server payment verification, audit records and least privilege. The browser has no authority to mark a payment as verified.

Retention and rights

We retain information while needed to provide the service, preserve contractual and security evidence, meet legal obligations and resolve disputes. The applicable retention schedule will be closed before real contracting is activated. Data subjects may exercise applicable rights to access, update, correct, request proof of authorization, seek deletion or withdrawal where available, and submit complaints under applicable law.

In Colombia, you may also consult the official information and channels of the Superintendencia de Industria y Comercio (SIC).

Privacy and support contact

Email: bymyatlas@gmail.com. Customer-service phone/WhatsApp: +57 302 256 2849. Notice address: Carrera 40A # 40B Sur - 12, Envigado, Antioquia, Colombia.

Updates

This policy is reviewed when providers, purposes, payment mechanisms, data profiles, legal obligations or the service's contracting identity change.