Legal and transparency
Privacy notice
Last updated 14 October 20261. Who we are
Atlas Palter Pte Ltd, registered in Singapore under number 202646696H, with its registered office at 68 Circular Road, Singapore 049422 ("Atlas", "we"). Data protection officer: Elle Torres, dpo@atlaspalter.com.
2. Scope
This notice covers three groups: visitors to this website; contacts at airlines, authorities and partners; and pilots and crew members whose public information we process on behalf of an airline or regulator. Crew members should also read the crew transparency notice.
3. Our role
For crew monitoring, the airline or regulator is the controller and Atlas acts as processor under a data processing agreement. For website visitors and business contacts, Atlas is the controller. [ Counsel to confirm the controller/processor split per customer type, including regulators. ]
4. What we process and why
5. Special categories and criminal-offence data
We do not assess religion, nationality, ethnicity or political opinion. Where content relating to suspected terrorist activity is processed, it is processed only under the controller's legal authority and with the safeguards required by law (GDPR Article 10 and equivalent national provisions). [ Counsel to confirm conditions per jurisdiction. ]
6. Automated processing
Software collects and matches content. No decision about a crew member is made by automated means: every flag is reviewed by trained analysts, and every employment or operational decision is made by the airline or authority.
7. Sharing
We share personal data only with the controlling airline or authority, with sub-processors listed in our DPA, and where required by law. We do not sell personal data.
8. International transfers
Data is hosted in [ region ]. Transfers outside the EEA or Israel rely on adequacy decisions or standard contractual clauses. [ Counsel to list transfer mechanisms. ]
9. Retention
Website and contact data: [ period ]. Crew data: for the duration of employment or authorisation, deleted within [ period ] of the airline notifying a leaver, except verified case files retained for [ period ] where required by law or the controller.
10. Your rights
Subject to applicable law, you may request access, correction, erasure, restriction, or object to processing, and lodge a complaint with a supervisory authority, including the Israeli Privacy Protection Authority or your local EU authority. Requests: hello@atlaspalter.com. Where we act as processor, we forward requests to the controller without delay.
11. Security
Encryption in transit and at rest, role-based access, audit logging, hash-sealed evidence storage and staff vetting. ISO 27001 and SOC 2: certification in progress.
Data processing terms (DPA)
Summary of key terms ยท full agreement provided with the customer contract1. Roles and instructions
The customer is the controller. Atlas processes crew data only on the customer's documented instructions, which are the screening and monitoring scope set out in the order form.
2. Scope of processing
Subjects: pilots and crew enrolled by the customer. Data: identity and enrolment data, linked account identifiers, publicly available content and activity, analyst assessments and case files. Purpose: identifying indicators of radicalisation, hostile recruitment and terror affiliation. Collection is limited to public sources; no covert accounts, no access to private or encrypted content.
3. Confidentiality and personnel
Personnel with access are bound by confidentiality, security-vetted and trained. Access to case files is role-based and logged.
4. Security measures
Technical and organisational measures are set out in Annex [ X ], including encryption, access control, audit logging, WORM evidence storage and hash-sealing, backup and incident response.
5. Sub-processors
Current list: [ hosting provider, region ]; [ translation provider ]; [ others ]. Customers receive [ 30 ] days' notice of new sub-processors and may object.
6. Breach notification
Atlas notifies the customer without undue delay and within [ 24 ] hours of becoming aware of a personal data breach, with the information needed for the customer's own notifications.
7. Data subject requests and assistance
Atlas forwards requests to the customer and assists with responses, DPIAs and prior consultations with supervisory authorities.
8. Audit
Customers and competent regulators may audit compliance on [ 30 ] days' notice, or rely on third-party certifications once issued.
9. Deletion and return
On a leaver notification, monitoring of that crew member stops and data is deleted within [ period ]. At contract end, data is returned or deleted within [ period ], unless retention is required by law.
For pilots and crew members
Plain-language summary of what happens to your information. It does not replace the notice your employer gives you.Linking your accounts
At enrolment you link your accounts through each platform's own sign-in (OAuth). This confirms which accounts are yours. We receive account identifiers only, never your password, and we do not access private content. [ Counsel to confirm OAuth scopes per platform. ]
What happens if something is flagged
Software only proposes. Trained analysts check the content in its original language and context and confirm the account is yours. Most flags are dismissed at this stage. Only verified findings are shared with your airline or the authority, and they make any decision, not Atlas.
The shared registry
If a finding is verified, member airlines may see that a verified flag exists and its category when you apply to them. [ Counsel to define exactly what is visible, for how long, and the legal basis. ]
How long we keep it
While you work for or are authorised by the airline. When you leave, monitoring stops and your data is deleted within [ period ], unless a verified case must be kept by law.
Your rights
You can ask to see what is held about you, correct it, contest a finding, or object. Contact your airline's data protection officer or hello@atlaspalter.com; we will route your request and help respond. You can also complain to the Israeli Privacy Protection Authority or your national data protection authority. [ Counsel to note any national-security exemptions that limit access. ]
Responsible disclosure
If you believe you have found a security vulnerability in Atlas systems, report it to hello@atlaspalter.com or on Signal at @atlaspalter.01.
Please
Give us reasonable time to fix the issue before disclosure. Do not access, modify or keep data that is not yours; stop and report as soon as you encounter personal data. Do not run denial-of-service, social-engineering or physical tests.
We will
Acknowledge your report within [ 3 ] business days, keep you informed, and not pursue legal action for good-faith research within these rules. [ Counsel to confirm safe-harbour wording. ]