Privacy Policy
1. Who we are
Atlas Blue Carbon Intelligence ("Atlas", the "Platform") is operated by Twende Green Planet ("we", "us", "our"), which is the data controller for the personal data described in this policy. The Global NGO Stakeholders Summit is a partner in the Platform and appears in the "Powered by" notice, but is not a separate controller of your data.
Contact for everything in this policy: info@twende.green. The Platform is available at https://atlas.twende.green.
2. What this policy covers
This policy applies to everyone who visits the Platform, uses the guest preview, creates an account, asks the AI analyst a question, requests institutional access, requests data for a country, or contacts us. It also explains how we treat information about people that appears inside the third-party datasets we archive (section 6). It does not cover other websites we link to, which have their own policies.
3. The personal data we collect
3.1 Information you give us
| When | What we collect |
|---|---|
| Creating an account | Full name; e-mail address; password (stored only as a one-way hash, never in readable form); age range; gender; organisation name and type; sector or industry; job title; country and city; how you heard about Atlas; your interests; your intended use of Atlas; whether you agree to receive updates; and the time you accepted the Terms and this policy. |
| Requesting institutional access | Institution name, type, website and official e-mail; your role; country; why you need access and how your institution will use Atlas; the features you need; planned uses; team size; and the timeline. Our reviewer's decision and any message to you are also recorded. |
| Asking the AI analyst | The text of each question you type, the topic the analyst recognised, how long the answer took, and where you asked it (page or assistant panel). |
| Requesting data for a country | The country, your optional note, and (for institutional admins) your institution's name. |
| Partnership enquiries (About Atlas page) | Your name, e-mail, organisation and its type, the areas you are interested in, your message, and the first three parts of your network address to help us detect misuse. We use these only to reply and to keep a record of the conversation. |
| Contacting us | Whatever you choose to tell us, together with your e-mail address. |
| Profile picture (optional) | If you upload one, we store a small square copy (320 pixels) on our own server, remove hidden photo information such as location, and show it only to you and to the Atlas administrators. Remove it at any time on My account; it is deleted when you remove it or when your account is deleted. |
3.2 Information collected automatically
| Category | Details |
|---|---|
| Visit and page records | A visitor identifier and a session identifier; the pages you open and the time you were actually active on each (measured only while the page is visible and you are interacting); the first page of your visit; the website that referred you and any campaign tags in the link. |
| Device and browser | Device type (desktop, mobile, tablet), browser and operating system, language setting and time zone. |
| Approximate location | Country, region and city worked out from your IP address using a database stored on our own server (MaxMind GeoLite2). We store only the network prefix of your IP address (the first three groups for IPv4, the first three blocks for IPv6), never the full address. |
| Actions on the Platform | Sign-ins and sign-outs; layers and filters you apply on the map; scenarios you run; reports you build; downloads (institutional admins only); and the moment a guest preview starts and ends. |
| Partnership enquiries | For as long as the conversation or partnership continues and for a reasonable period afterwards; you can ask us to delete yours at any time |
| Security and audit records | Failed sign-in attempts, registrations, role changes, and administrative actions, each with a time and the account involved. |
We do not collect payment card or bank details (Atlas takes no payments), precise GPS location, contacts, photographs from your device (other than a profile picture you choose to upload), or any special categories of personal data such as health, religion or political opinion. Please do not type such information into free-text boxes.
4. Cookies and similar technologies
Atlas uses only the small amount of storage needed to work and to measure use. We do not use advertising cookies, social-media pixels or third-party analytics services.
| Name | Purpose | Lasts |
|---|---|---|
atlas_vis | Recognises a returning browser so we can count unique visitors | 1 year |
atlas_sid | Groups the pages of one visit together | Up to 30 days; a new visit starts after 30 minutes of inactivity |
atlas_trial | Remembers when your guest preview began so the countdown is accurate | 24 hours |
| Session cookie | Keeps you signed in and protects forms against forgery (strictly necessary) | Until you sign out or the session expires |
| Browser storage | Remembers small convenience settings, for example that you have dismissed a notice or seen the assistant introduction | Until you clear your browser data |
You can block or delete cookies in your browser settings, but the Platform cannot keep you signed in, and the guest-preview timer cannot work, without them.
5. Why we use your data, and our lawful basis
Under the Kenya Data Protection Act, 2019 we may process personal data only where there is a lawful basis. We rely on the following.
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account, signing you in, applying the guest-preview limit, and providing the features you use | Performance of the agreement you enter into with us when you accept the Terms of Use |
| Reviewing institutional-access requests and communicating the decision | Performance of the agreement; your request |
| Understanding who uses Atlas, how long and for what, so we can improve the Platform, report on our reach and plan which countries and data to add | Our legitimate interest in operating and improving a scientific information service, balanced against your rights (the data is limited and not shared) |
| Improving the AI analyst by reviewing the questions people ask | Legitimate interest |
| Keeping the Platform secure: preventing automated sign-ups, abuse and unauthorised access; keeping audit records | Legitimate interest; legal obligation where applicable |
| Sending you updates and news about Atlas | Your consent, which you can withdraw at any time without affecting the service |
| Complying with the law and responding to lawful requests | Legal obligation |
We do not make decisions about you by solely automated means that have legal or similarly significant effects. The AI analyst answers questions about data; it does not make decisions about people.
6. Information about other people inside the datasets we archive
To keep a complete and verifiable archive, we copy every layer published by the sources we draw on. Some source layers (for example survey responses, farmer or stakeholder records, and wildlife-enforcement records) may contain personal details of people who are not Atlas users. We handle these as follows.
- During import each layer is automatically screened for fields that look like personal data, anti-poaching or patrol content, or stakeholder surveys, and flagged as restricted.
- Restricted layers are stored separately with tighter file permissions and are visible only to the super administrator. They never appear on public maps, pages, downloads, reports or AI answers.
- We hold them only to maintain an authentic archive and for authorised monitoring and reporting. We do not combine them with account data, contact the people concerned, or publish them.
- Carbon-project registries. The carbon-project register lists organisations (and occasionally named individuals) as the registries publish them. We show names, countries, project details and, where an open legal-entity record exists, its public details. We do not add contact details or other personal information, and we do not combine this with account data. If a record about you is wrong or you would like it reviewed, write to info@twende.green.
- If you believe a restricted record concerns you, write to info@twende.green and we will locate, correct or remove it as the law requires.
7. Who we share data with
We do not sell, rent or trade personal data. Access is limited as follows.
- Atlas administrators. The super administrator can see account details, registration answers, access requests, session records and AI questions, which are needed to run the Platform.
- Infrastructure providers. The Platform runs on servers operated by our hosting provider, who process data on our behalf to keep the service running and are not permitted to use it for their own purposes.
- Map background. When a map is displayed, your browser requests background tiles directly from the OpenStreetMap tile servers, which receive your IP address and browser details as part of that request. The data shown on top of the map comes from Atlas.
- E-mail delivery. If we send you an e-mail (for example a decision on an access request), the message passes through our mail provider.
- Optional language-model wording. If we switch on an optional service that rephrases analyst answers, the text of your question and the computed facts for that answer are sent to that provider. It never receives the database. At the date of this policy this service is not enabled, and we will update this policy before enabling it.
- Aggregate statistics. We may publish figures such as "visitors from 40 countries" that cannot identify you.
- Legal and safety. We may disclose information if required by law or a court, or to protect the rights, property or safety of Atlas, our users or the public.
- Organisational change. If the Platform is transferred to another organisation, your data may transfer with it, subject to this policy.
8. Where your data is stored and transfers abroad
Your data is stored on the servers used to host the Platform. Our hosting and service providers may be located outside Kenya. Where personal data is transferred outside Kenya we take the steps required by the Data Protection Act, 2019 and its regulations, including ensuring that the recipient is bound to give the data an appropriate level of protection.
9. How long we keep data
| Data | Retention |
|---|---|
| Account and registration details | While your account is open, and until you ask us to delete it |
| Institutional-access requests and decisions | While your account is open, and for as long afterwards as needed to evidence the decision |
| Visit, page and action records | Kept as a permanent record of Platform use so we can report on reach over time; on request, we delete or anonymise the records linked to you |
| AI analyst questions | Kept with the visit record on the same basis |
| Security and audit records | Kept for as long as needed to protect the Platform and to evidence administrative actions |
| Backups | We keep only the most recent weekly backup, so data you ask us to delete disappears from backups within about a week |
10. How we protect your data
- All traffic uses encrypted HTTPS connections.
- Passwords are stored as salted one-way hashes; we cannot read them.
- Access to administrative features and to restricted data is limited to the super administrator by role.
- Sign-in and registration are rate-limited, and registration includes automated-abuse checks.
- Full IP addresses are not stored; only a network prefix.
- Administrative actions, downloads and sign-ins are written to an audit log.
- The database is backed up weekly and the backups are held in a restricted location.
No system is completely secure. If a breach is likely to put your rights at risk we will notify the Office of the Data Protection Commissioner and affected people as the law requires.
11. Your rights
Under the Kenya Data Protection Act, 2019, and in line with good international practice, you have the right to:
- be informed about how your data is used (this policy);
- access the personal data we hold about you and receive a copy;
- object to or restrict processing, including processing for marketing;
- correct data that is inaccurate or incomplete;
- delete data that we no longer need or that we have no basis to keep;
- data portability, meaning a copy of the data you gave us in a common format;
- withdraw consent at any time where we rely on it, for example for updates;
- complain to the Office of the Data Protection Commissioner of Kenya if you believe we have not respected your rights.
To use any of these rights, write to info@twende.green from the address linked to your account. We may need to confirm your identity first. We will respond promptly, and in any event within 30 days. You can edit most of your registration details yourself under My Account.
12. Children
Atlas is intended for adults. You must be 18 or over to create an account, and we ask you to confirm this at registration. We do not knowingly collect personal data from children. If you believe a child has registered, please tell us and we will delete the account.
13. Links to other websites
The Platform links to data publishers, scientific papers and partner sites. We are not responsible for their content or privacy practices. Links in the footer to our partners open in a new tab.
14. Changes to this policy
We may update this policy when the Platform or the law changes. The effective date at the top shows the current version. If we make a material change, for example collecting new kinds of data or enabling an additional service provider, we will show a notice in the Platform before it takes effect. Continuing to use Atlas after a change means you accept the updated policy.
15. Contact us
Twende Green Planet
E-mail: info@twende.green
Website: twende.green