Privacy Policy

Mert Kahyaoğlu, a sole trader in the United Kingdom trading as System Design Atlas, is the controller of the data described here: the person who decides what happens to it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Write to tulparapps@gmail.com with any question about it.

You can read every free page without signing in. When you do, the site doesn’t ask who you are. Vercel, which hosts the site, receives each request your browser makes, as every web host does, and counts page views with Vercel Web Analytics. The analytics set no cookies and don’t follow you across sites; Vercel tells visits apart with a hash of the request that it discards after a day.

Accounts are run by Clerk. When you sign in, Clerk keeps your name, email address and profile picture, and if you sign in with another account, such as Google or GitHub, the basic profile that provider shares. The site reads these to show your account in the top bar and to fill in your email at checkout.

Lifetime Access is paid for through Stripe Checkout, on Stripe’s own page. Stripe collects and keeps your card details; they never reach the atlas. Stripe sends you the receipt.

The only thing the site stores about a purchase is a small record on your Clerk account: whether Lifetime Access is active or revoked, the ID of the Stripe payment it came from, and when it last changed. That record is what unlocks premium pages for you.

When a page fails in your browser, or the server fails while answering it, the site sends a report to Sentry so the fault can be found and fixed. The report describes the error, not you: what failed and where in the code, the page’s address, your browser and device, your approximate location, and what the page did just before. It carries no name, email address, account or cookies, Sentry is set never to store your IP address, and nothing records your screen.

These are the only services that receive data about you, and each gets only what its job needs.

Clerk, accounts and sign-in

Receives your name, email address and profile picture, the profile a sign-in provider such as Google or GitHub shares if you use one, your Lifetime Access record, and the IP address and browser of each sign-in, which it uses to keep accounts secure. Processor: it holds this data for us and uses it only to run sign-in.

Stripe, payments

Receives your card or other payment details, billing name and country, your email address, your account’s internal ID (so a payment can be matched to its account) and the device information it uses to prevent fraud. Controller in its own right when it sells Lifetime Access as merchant of record, under its own privacy policy; our processor for any purchase where we are the seller.

Vercel, hosting and analytics

Receives every request to the site, with its IP address, browser and the page asked for, and, through Vercel Web Analytics, the page you view, the page that sent you, and your browser, operating system, device type and country. Processor: it hosts the site and counts visits for us.

Sentry, error monitoring

Receives a report when something on the site fails: the error message and where in the code it happened (a stack trace), the page’s address without its query string, your browser, operating system, device type, language and time zone, and what the page did just before, such as the pages visited, requests made and buttons clicked. From the connection it works out an approximate location (country and town), but it is set never to store your IP address. For one page load in ten it also gets how long the page took to load. It gets no name, email address, account or cookies. Processor: it stores these reports for us so faults can be found and fixed.

The atlas sets no advertising or tracking cookies. The cookies it uses come from Clerk and are needed for sign-in: __client_uat is set on every visit and records when you last signed in or out (zero while you are signed out), and __session holds your session once you sign in. Clerk sets more on its own sign-in domain, and Stripe sets its own on the checkout page to prevent fraud.

The site doesn’t ask for cookie consent because it doesn’t need to: the Privacy and Electronic Communications Regulations exempt cookies and storage that are strictly necessary for something you ask for, like signing in, or that only remember a choice you made. Nothing here is used for analytics or advertising; Vercel Web Analytics stores nothing on your device.

Some preferences stay in your browser’s local storage. They never leave your device, and clearing the site’s data in your browser removes them.

• atlas-ui: your theme, and which sidebar sections you have collapsed
• atlas-progress: the pages you have marked as done
• atlas-read-aloud: your Listen settings: the voice, and whether to read answers and move on to the next page

Listen reads pages aloud with your browser’s built-in speech. Some browsers produce certain voices on their maker’s servers, which then receive the text being read: the page, not anything about you.

The UK GDPR only allows data to be used for a lawful reason. These are ours:

• A contract with you (Article 6(1)(b)): running your account, and selling and delivering Lifetime Access.
• Legitimate interests (Article 6(1)(f)): hosting the site, keeping it and your account secure, finding and fixing errors, preventing fraud, and counting page views to learn which pages are read. You can object to these.
• A legal obligation (Article 6(1)(c)): keeping records of sales for tax.

We don’t rely on consent for anything, and no decision about you is made by automated means.

• Your account, and the Lifetime Access record on it, until you delete it or ask us to.
• Records of sales and payouts, for at least five years after the 31 January filing deadline of the tax year they belong to, as HM Revenue and Customs requires. Stripe keeps its own payment records under its own legal obligations.
• Hosting logs, for the few days at most that Vercel keeps them. Analytics are kept only as page view counts.
• Error reports, for 90 days at most, after which Sentry deletes them.
• Local storage, until you clear it.

Clerk, Stripe and Vercel are based in the United States and may process data there and in other countries. Sentry, also a US company, stores error reports in the European Union, in Germany, though its staff in the United States may reach them. Data leaves the UK to these companies under the UK-US data bridge where the company is certified to it, and otherwise under the International Data Transfer Addendum to the standard contractual clauses in its data processing terms. For readers in the EU, the same companies rely on the EU-US Data Privacy Framework or the standard contractual clauses.

You can ask us for a copy of the data we hold about you, to correct it, to delete it, or to have it in a portable form. You can also object to how we use it, or ask us to restrict that. Write to tulparapps@gmail.com from the email address on your account and we will reply within a month (or tell you within that month if a complex request needs up to two more). You can also delete your account yourself from Manage account in the account menu.

Deleting your account deletes the Lifetime Access record with it, so premium pages lock again. Payment records we are required to keep are kept until that requirement ends.

If you are unhappy with how we handle your data, write to tulparapps@gmail.com and we will sort it out with you directly. You also have the right to complain to the Information Commissioner’s Office, or, in the EU, to the data protection authority where you live.

The atlas isn’t aimed at children, and accounts are for people aged 16 and over. If you believe a child has given us data, tell us and we will delete it.

When the site starts using a new service or collecting something new, this page changes first, along with the date at the top. The Terms of Service say how we announce changes that matter.

System Design Atlas is a trading name of Mert Kahyaoğlu, a sole trader in the United Kingdom. Write to tulparapps@gmail.com about anything on this page.

Post: 195 Ballards Lane, London N3 1LP, United Kingdom