⚠️ DRAFT — pending review by the owner’s legal counsel. Not yet in effect; do not publish or rely on it until counsel approves and all [OWNER: …] items are resolved.

This page is a working draft prepared for the Atlastic team and is pending review by qualified legal counsel before publication. It must not be published as-is. All items marked [OWNER: …] must be completed or confirmed by the owner/counsel. Nothing on this page should be treated as legal advice.

Effective date: 28 June 2026

Overview

Atlastic is a consumer travel app (iOS and Android) and the website atlastic.com, operated by MajeStay Technologies Limited, a company established in the Dubai International Financial Centre (DIFC), Dubai, UAE [exact DIFC office/unit to be confirmed] (“Atlastic”, “we”, “us”). Atlastic lets you discover curated daily trips and book flights, hotels and stays, activities, airport transfers, and curated multi-component packages, with honest all-in pricing. Atlas is our in-app AI travel concierge — it advises and helps you plan, but never books on your behalf; you always make the final booking decision.

This page explains how to delete your Atlastic account and personal data, what we delete, anonymize, and retain (and why), how long it takes, and how to request a copy of your data. You can request deletion inside the app or from the website without installing the app.

How to delete your account — in the app

Open the Atlastic app and sign in.
Go to Settings → Delete Account.
Confirm the request when prompted.

We may ask you to re-authenticate (sign in again) to confirm it is really you before we proceed. Once confirmed, your deletion request enters processing as described in Processing timeline below.

How to delete your account — on the web (no app needed)

You do not need the app installed to request deletion. Choose either method:

Web form: https://atlastic.com/data-deletion, or
Email: send a request from the email address on your account to privacy@atlastic.com with the subject line “Delete my account”.

Please include the email address associated with your Atlastic account so we can locate and verify it. To protect your account, we will verify your identity before acting on a request received this way (for example, by confirming control of the account email). We will not delete an account based on an unverified request.

What we delete, anonymize, and retain

When your deletion request is verified, we handle your data in three ways.

Deleted or anonymized — your personal profile and activity:

Account email, name, phone number (if provided), and date of birth
Traveler details you saved for bookings (where not embedded in a retained booking record — see below)
Search queries, including those you sent to the Atlas AI concierge
Social sign-in identifiers and profile data received from Google / Apple sign-in (name, email, avatar)
Approximate location data collected (with your permission) for search
Diagnostic identifiers from crash/usage diagnostics on our systems (note: our diagnostics provider, Firebase Crashlytics, retains some diagnostic data independently under its own retention window)
App preferences and saved/favorited content

We either delete these or irreversibly anonymize them so they can no longer be linked to you.

Retained for a limited period — records we are legally or contractually required to keep:

Completed booking and transaction records (flights, hotels/stays, activities, transfers, packages) needed for tax, accounting, consumer-protection, and audit obligations, and to honor travel suppliers’ records. Traveler details (such as name and date of birth) that are embedded within these completed booking records are kept — minimized where feasible — for the retention period, because they form part of the legally required record.
Payment records associated with your bookings. We never store full card numbers — card payments are captured directly by Stripe, our PCI-compliant payment processor — but we retain transaction references and receipts as required.
Freeze-your-deal fee and related transaction records where you used that feature.
Records needed for fraud prevention, dispute/chargeback handling, and to establish, exercise, or defend legal claims.

These retained records are kept only for the period required by applicable law and supplier obligations: for the minimum period required by applicable UAE/DIFC law (at least 5 years for financial and tax records), and for the duration of any supplier or payment-processor record-keeping obligation. When the retention period ends, the records are deleted or further anonymized.

Why we retain these: we are required to keep certain financial, tax, and transaction records by law, and travel suppliers and payment processors impose their own record-keeping requirements for bookings made through them. Deleting these immediately would prevent us from meeting those obligations and from resolving any later disputes or refunds tied to your past bookings.

Why we are allowed to process your data (legal bases)

For users in the EU and UK, the GDPR requires us to tell you the lawful basis for each use of your data:

Performance of a contract — creating and running your account and processing your bookings.
Legal obligation — keeping the booking, payment, tax, and anti-fraud records described above.
Legitimate interests — preventing fraud, defending legal claims, and keeping the App stable through diagnostics.
Consent — using your approximate location for search, social sign-in, and any optional marketing; you can withdraw consent at any time.

Fuller detail is in our Privacy Policy (atlastic.com/privacy).

Where your data is processed (international transfers)

Atlastic uses cloud providers and partners that may process your personal data outside the country where you live — including Stripe, AWS, Google/Apple, Firebase, our travel distribution partner, and the Atlas LLM provider. Where data is transferred across borders, we rely on appropriate safeguards (such as transfers to countries with an adequate level of protection, or contractual safeguards like Standard Contractual Clauses for EU/UK-origin data). As a DIFC-established controller, our transfers are governed by the DIFC Data Protection Law (DIFC Law No. 5 of 2020), Articles 26–28: we transfer personal data only to jurisdictions the DIFC Commissioner of Data Protection recognizes as providing an adequate level of protection, or otherwise under appropriate safeguards such as the DIFC Standard Contractual Clauses or another mechanism approved by the Commissioner. For any EU/UK-origin personal data, the EU/UK Standard Contractual Clauses apply (interim default; counsel to confirm).

Effect on active and past bookings

Deleting your account does not automatically cancel any active or upcoming booking. Bookings are subject to the relevant travel supplier’s terms, fare rules, and cancellation policies (shown to you at the time of booking), and Atlastic facilitates the booking. Please resolve or cancel any active bookings before requesting deletion, and keep your own copies of confirmations and vouchers. Even after your account is deleted, you can contact privacy@atlastic.com about a past booking or refund; because we retain the limited booking and payment records described above for the legally required period, our support team can still help resolve disputes, cancellations, or refunds tied to those past bookings (interim default; counsel to confirm).

Processing timeline

We aim to complete verified deletion requests within 30 days of receiving and verifying the request. For California residents, we respond to deletion requests within 45 days (extendable by a further 45 days where permitted, with notice). Complex requests, or those requiring identity verification, may take the full period.

During processing we deactivate your account and stop using your personal data for ongoing app functionality, except as needed to complete the deletion and to maintain the retained records described above. When deletion is complete, we will send a confirmation to your account email. Deletion completes within a maximum of 30 days of a verified request. There is a short grace window of up to 7 days after you confirm, during which you may contact privacy@atlastic.com to cancel the request; after that the deletion is irreversible. We send a confirmation email to your account email when deletion is complete (interim default; counsel to confirm).

Request a copy or export of your data

You can ask for a copy of the personal data associated with your account before or instead of deleting it.

Email: send a request from your account email to privacy@atlastic.com with the subject “Export my data”, or use the web form above.
We will verify your identity, then provide your data in a portable, machine-readable format within 30 days.

There is currently no self-serve in-app data export, so the email or web-form method above is the way to request a copy of your data (interim default; counsel to confirm).

Depending on where you live, you may have rights to access, correct, delete, port, and restrict or object to the processing of your personal data.

EU / UK (GDPR): rights of access, rectification, erasure, restriction, objection, and data portability, plus the right to withdraw consent and to lodge a complaint with your local data protection authority.
California (CCPA/CPRA): rights to know, access, delete, correct, and to limit the use of sensitive personal information. Atlastic does not sell or share your personal data for cross-context behavioral advertising, so the do-not-sell/share right does not apply — there is nothing to opt out of — but you may still contact us to confirm this. The categories of personal information we collect, and the categories disclosed to our service providers, are set out in our Privacy Policy.

No solely-automated decisions. Because you always make the final booking decision and Atlas only suggests, we do not make decisions about you that produce legal or similarly significant effects by automated means alone (GDPR Article 22).

To exercise any of these rights, contact privacy@atlastic.com. We will not discriminate against you for exercising your rights. A California consumer may use an authorized agent to submit a request on their behalf, provided we can verify the agent’s authority and the consumer’s identity. If you are in the DIFC and are not satisfied with our response, you may lodge a complaint with the DIFC Commissioner of Data Protection, the supervisory authority for the DIFC Data Protection Law (DIFC Law No. 5 of 2020) (interim default; counsel to confirm).

Sensitive information

Date of birth and traveler details are needed to complete bookings and may be treated as sensitive personal information under the CPRA and special-category-adjacent under the GDPR. We use them only to fulfill the booking you request. Where a travel supplier requires it to issue a particular booking (for example, passport or government-ID details for international flights), we collect that information solely to complete that booking, treat it as sensitive personal data, and do not use it for any other purpose (interim default; counsel to confirm).

To operate Atlastic and fulfill your bookings, we share limited personal data with service providers and partners, strictly to provide the service — we do not sell your personal data:

Stripe — to process card payments
Travel suppliers / aggregators (via a B2B distribution partner) — to fulfill flight, hotel/stay, activity, transfer, and package bookings
Google / Apple — for social sign-in
Firebase / Google — for crash/usage diagnostics only (not account sign-in)
AWS — for hosting and for transactional email (Amazon SES)
A third-party large-language-model provider — the Atlas concierge sends your travel queries to a cloud LLM to generate suggestions. The LLM provider is configured so that your queries are NOT used to train its models; queries are retained only briefly for abuse-monitoring and operational purposes and are then deleted (no-training, short-retention configuration). [LLM provider name to be confirmed] (interim default; counsel to confirm).

Deletion of your Atlastic account does not by itself delete records held independently by these third parties under their own terms (for example, a supplier’s record of a completed booking, or Stripe’s transaction records). The current list of processors and links to each processor’s privacy notice is maintained in, and kept consistent with, our Privacy Policy at atlastic.com/privacy (interim default; counsel to confirm).

A note about the Atlastic website

The marketing website atlastic.com uses essential/functional storage only and runs no third-party analytics or tracking. The only personal data the website itself collects is the email address you submit to the waitlist form. To delete a waitlist email, contact privacy@atlastic.com. The Site uses only essential/functional storage and sets no advertising or tracking cookies.

About Atlas (AI concierge)

Atlas provides AI-generated suggestions and itineraries that may contain errors and are not professional travel, financial, legal, medical, or visa advice. Please verify important details independently. Atlas never finalizes a booking on your behalf — you always confirm. Your queries to Atlas are treated as search data and are deleted or anonymized on account deletion as described above.

Children

Atlastic is not directed to children under 16, and because using Atlastic involves entering into a payment contract you must also be at least 18 (or the age of legal majority where you live) to book, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact privacy@atlastic.com and we will delete it.

Contact

Privacy / data requests: privacy@atlastic.com
Legal: legal@atlastic.com monitored
General: hello@atlastic.com
Operating entity & registered address: MajeStay Technologies Limited, DIFC, Dubai, UAE [exact DIFC office/unit to be confirmed]
Governing law / jurisdiction: the laws of the Dubai International Financial Centre (DIFC), Dubai, UAE, with the DIFC Courts having jurisdiction

This page works alongside our Privacy Policy and Terms of Service.

Data & Account Deletion