Privacy

Visitors

You can search without an account. Each search is recorded as one entry holding the date (no time of day), the selected services, the city or ZIP searched, whether the place was recognized, and how many results were found. Profile views and presses of Call/Email/Website links are kept only as daily totals per listing. None of these records contain your IP address, a visitor ID or a device identifier. If you choose "Use my location", your browser's position is rounded to about a kilometer for that search, and only the nearest ZIP code is recorded.

Cookies

ATM Atlas uses a session cookie that keeps forms secure and, for providers, keeps you signed in. After a provider signs in, the browser also keeps a sign-in device cookie for up to 180 days. It holds only a keyed check value (not your email address), so that if someone else floods your address with code requests, your own browser can still get a code. There is no advertising, tracking or third-party analytics cookie.

IP addresses

Your IP address is used to limit how quickly requests can be repeated, which protects the directory from abuse. Those counters are temporary. When a sign-in code is requested or a listing is reported, a one-way keyed fingerprint of the IP address (not the address itself) is stored with that record so repeated abuse can be limited.

Providers

Your sign-in email is private and is used to send sign-in codes and important notices about your listing. Everything you enter in the public parts of your profile—name, contact details you choose to publish, services, areas, rates, photos—is shown publicly. An optional staff-only phone number is visible only to ATM Atlas staff. Optional social profile links are also public. Photos are re-encoded when uploaded, which removes location and camera metadata.

Email

Sign-in codes are sent through Resend. Replies and support requests are received in our Microsoft 365 mailbox. These providers process the information needed to deliver your messages. We store a one-way check value, never the code. We don't add providers to marketing email.

Reports

If you report a listing, we keep the report and, only if you provide it, your contact details so we can follow up. Once a report is closed, the contact details and the IP fingerprint stored with it are removed after 180 days; the report itself stays in the moderation history.

Deleting your account

Deleting a business profile immediately removes its public listing, photos, services, areas, contact details, bank and credit union capability details, private verification notes and its web address (the old address only answers that the listing was removed). Deleting your account also removes your sign-in email, pending sign-in codes and email-delivery records, and signs you out everywhere. We keep a minimal record (internal ids, the action and its time) and any listing reports for moderation history.

Retention and contact

Public profile information remains available until you pause or remove it. Expired sign-in challenges are removed after one day, email-delivery records after 30 days, and search-event records after 90 days. Expired sessions are removed during maintenance. Security audit records are retained to protect accounts. Reports and moderation history are retained to investigate misuse. Removed information may remain in recovery backups until those backups are replaced. Hosting providers may also keep operational request logs.

For privacy questions or a request to access or remove your information, email admin@atmatlas.com.