Privacy Policy

1.1 Information You Provide Directly

• Account information: name, email address, password (stored in hashed form)
• Profile data: country of origin, current country of residence, age range, income range, relationship status, number of dependents
• Pathway selection: Explorer, Relocator, or Global Citizen designation
• Decision and preference data: destination preferences, lifestyle priorities, relocation goals, timeline, budget inputs
• Community content: posts, reviews, discussions, provider ratings, relocation stories, comments
• Provider inquiries: messages sent to Providers through the network
• Communications: emails or messages sent to us directly
• Provider request information: the details you submit in a Provider request, such as the service you need, your destination, your timeline, and any notes you choose to share, which are sent to our team at info@horizonatlas.ai and stored in our systems
• Concierge and booking information: your name, email address, phone number, destination, and scheduling details when you book a consultation call or a Relocation Planning Session (including through our embedded Google Calendar booking page), complete an intake, or engage Concierge Services, together with invoicing and billing details
• Phone number and communication preferences: the phone number you provide, your marketing consent choices, and the records of that consent (timestamp, form version, number, and the wording shown to you)
• Payment information: for Move Pass purchases and Concierge invoices, payment is processed through our third-party payment processor, Stripe, Inc., or another processor identified at checkout or on your invoice; we do not store full payment card numbers, and the processor's own privacy practices govern the payment details it collects directly from you

1.2 Information Collected Automatically

• Usage data: pages visited, features accessed, time spent, navigation paths, button clicks, and in-platform interactions
• Country and destination interactions: countries searched, viewed, saved, compared, and selected
• Checklist and planning behavior: tasks completed, milestones reached, plan progression stages
• Device and technical data: IP address, browser type and version, operating system, device type and identifiers, screen resolution
• Location data: general geographic region inferred from IP address — we do not collect precise GPS location without your explicit consent
• Session data: login timestamps, session duration, frequency of visits
• Referral and attribution data: how you found the Platform

1.3 Cookies and Tracking Technologies

We use the following types of cookies and similar tracking technologies:

• Essential/Functional cookies: required for Platform operation, authentication, and security — these cannot be disabled without affecting core functionality
• Analytics cookies: help us understand how users interact with the Platform (e.g., Google Analytics, Mixpanel, or similar tools) — these track page views, session duration, and feature usage
• Preference cookies: remember your settings and customizations
• Marketing cookies: used to measure the effectiveness of our marketing campaigns — these may be placed by third-party advertising partners

We show a cookie and privacy notice banner on our website and Platform. Third-party content embedded on our pages, such as our booking calendar, may also set its own cookies. You can manage cookie preferences through your browser settings or our in-Platform cookie preferences center (where available). Disabling essential cookies may impair Platform functionality. We honor legally required "Do Not Track" and "Global Privacy Control" signals where mandated by applicable law.

1.4 Data From Third Parties

We may receive data about you from third parties including analytics providers, advertising networks, and social media platforms if you interact with our content on those platforms or connect third-party accounts to the Platform.

We use your information for the following purposes:

• Providing and personalizing your Platform experience and AI-powered recommendations
• Generating country comparisons, budgets, relocation plans, and checklist guidance
• Processing Move Pass purchases and administering your access period and entitlements
• Delivering Concierge Services, including coordinating Providers, invoicing you, and paying Providers on your behalf
• Delivering Relocation Planning Sessions and applying any Concierge credit
• Reviewing Provider requests, matching you with Providers, and making introductions
• Notifying you of updates to our Terms of Service and Privacy Policy
• Surfacing relevant Provider recommendations in the network
• Operating community features and facilitating peer knowledge sharing
• Sending transactional and service-related communications (account verification, security alerts, Move Pass expiration notices, support responses)
• Sending marketing emails (where you have consented or where permitted by law) and marketing calls, text messages, and WhatsApp messages (only where you have given the consent described in Section 28 of our Terms of Service)
• Analyzing Platform performance, diagnosing bugs, and improving features
• Detecting and preventing fraud, abuse, unauthorized access, and security threats
• Complying with legal obligations and enforcing our Terms
• Training, evaluating, and improving AI and machine learning systems as described in our Terms of Service
• Creating aggregated, anonymized datasets and trend reports for commercial purposes — described in full in Section 5

If you are located in the European Economic Area or United Kingdom, we process your personal data under the following legal bases:

• Contractual necessity (Article 6(1)(b)): processing required to provide the services you requested, including account creation, personalization, planning features, Move Pass purchases, Provider requests, and Concierge Services
• Legitimate interests (Article 6(1)(f)): improving the Platform, preventing fraud, developing our data products, and operating our business — we have conducted legitimate interest assessments and determined these interests are not overridden by your rights
• Consent (Article 6(1)(a)): for marketing communications, optional commercial data participation, non-essential cookies, and, for EEA and UK Users, sharing identifying information with Provider Network providers as described in Section 6.2 — you may withdraw consent at any time without affecting prior processing
• Legal obligation (Article 6(1)(c)): complying with applicable laws, regulations, and lawful requests

For special categories of personal data (if applicable), we rely on your explicit consent under Article 9(2)(a) GDPR.

We retain your personal data for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods:

• Account and profile data: retained for the duration of your account and up to 3 years after account closure, unless a longer period is required by law
• Behavioral and engagement data: retained for up to 3 years from collection
• Community content: may be retained after account closure in anonymized or de-attributed form
• Financial and transaction records: retained for up to 7 years as required by applicable tax and accounting laws
• Move Pass entitlement and access data: your saved countries, comparisons, budget inputs, checklist progress, and other data entered under a Move Pass are retained after that Move Pass expires and are not deleted; they remain associated with your account and become accessible again if you purchase a subsequent Move Pass
• Provider request and Concierge records: retained for up to 3 years after the request or engagement ends, or longer where invoicing, tax, accounting, or legal requirements apply
• Consent records: the timestamp, form version, phone number or email address, IP address, and wording shown when you consent to marketing communications, kept for as long as needed to prove that consent and to honor opt-outs
• Aggregated, anonymized data: retained indefinitely as it no longer constitutes personal data

Upon account deletion request, we will delete or anonymize your personal data within 90 days, except where retention is required by law.

This section describes how your data contributes to commercial data products — a core part of our business model.

Horizon Atlas generates proprietary data assets from aggregated, anonymized user behavior. This is central to our value proposition and long-term business strategy. By using the Platform, you acknowledge and agree to this practice, as disclosed in our Terms of Service.

5.1 What We Aggregate

• Migration trend data: movement patterns by demographic segment, origin country, and destination
• Destination popularity: most viewed, saved, and selected countries, cities, and neighborhoods
• Lifestyle and preference patterns: how users prioritize factors such as climate, safety, cost, and healthcare
• International school, healthcare, and service demand by destination
• Cost of living sensitivity and budget benchmarks by relocator profile
• Decision timeline data: how users progress through relocation planning stages
• Community sentiment: aggregated themes from expat discussions and reviews
• Provider demand patterns: which types of providers are most sought after by destination

5.2 Commercial Use of Aggregated Data

We may sell, license, or make available aggregated, anonymized data and derived insights to third parties including:

• Travel, hospitality, and tourism platforms
• Real estate companies and property platforms
• Financial institutions and international banking or currency services
• Immigration and relocation service companies
• Government economic development and investment promotion agencies
• Academic institutions and policy research organizations
• Enterprise partners accessing the Horizon Atlas data layer through ongoing licensing arrangements

All externally shared data is aggregated and anonymized using industry-standard techniques. It cannot reasonably be used to re-identify you individually.

5.3 Opt-Out

You may opt out of contributing to our commercial aggregated data products at any time by contacting info@horizonatlas.ai with subject line "Data Opt-Out" or through your account data preferences. Opt-out does not affect data already anonymized and incorporated into existing datasets, as such data is no longer personal data. Opting out may limit certain personalized features.

We do not sell your personally identifiable information. We may share your personal information only as described below:

6.1 Service Providers

We share data with vetted third-party vendors who support Platform operations, including cloud hosting providers, analytics services, email delivery platforms, customer relationship management, text messaging, and WhatsApp messaging platforms, our payment processor Stripe, scheduling and booking tools such as Google Calendar, and customer support tools. These vendors are contractually bound to process data only on our behalf and in accordance with our instructions.

6.2 Provider Network

If you initiate contact with or make an inquiry to a Provider through the network, we share relevant profile information with that Provider to facilitate your request and to help the Provider assist you more effectively. This may include information such as your destination, timeline, inquiry details, relocation goals, household or family situation, budget or income range, employment situation, and other information you have provided to us, and may also include identifying information such as your name and contact details. The specific information shared may vary over time as we improve this feature, and we may expand or adjust what is shared with your consent where required by law. You control when this sharing occurs, as it happens only upon your action in contacting or inquiring with a Provider, or in asking Horizon Atlas to introduce you to one.

Providers who receive your information through the network are required by our Provider Network Agreement to use it only to respond to your inquiry, to keep it confidential, and to handle it in compliance with applicable data protection law.

For Users located in the European Economic Area or United Kingdom: before you access the Provider Network, we will request your explicit, affirmative consent to share identifying information (such as your name and contact details) with any Provider you subsequently choose to contact through the Network. This consent is separate from, and is not satisfied by, your acceptance of our Terms of Service; it applies specifically to the Provider Network feature and does not affect your ability to use any other area of the Platform. Even after you provide this consent, your identifying information is shared with a specific Provider only when you take the affirmative step of contacting or inquiring with that Provider, or of asking Horizon Atlas to introduce you to that Provider, consistent with the rest of this Section 6.2. You may withdraw this consent at any time through your account settings; withdrawal prevents future sharing of identifying information with Providers but does not affect information already shared with a Provider you previously contacted.

Provider requests and Concierge. When you submit a Provider request, our team receives it, reviews it, and may share the details with one or more Providers we think are a good fit so we can introduce you. For Concierge, we share the information the Providers on your engagement need to do their work, and Horizon Atlas pays those Providers on your behalf. Providers receive this information under our Provider Network Agreement, which limits their use of it as described above.

6.3 Legal Requirements and Protection

We may disclose personal information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or enforceable governmental request; (b) enforce our Terms of Service; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Horizon Atlas, our users, or the public.

6.4 Business Transfers

In connection with any merger, acquisition, financing, reorganization, sale of assets, or similar transaction involving Horizon Atlas (including a sale of our proprietary data assets), personal information may be disclosed or transferred to a successor entity. We will notify registered users by email or prominent in-app notice if such a transfer involves a material change to how your data is processed, and we will provide you with the opportunity to exercise applicable rights.

6.5 Aggregated Data

We may share aggregated, de-identified data with partners, investors, and the public as described in Section 5. This data does not personally identify you.

6.6 With Your Consent

We may share your information for other purposes with your explicit prior consent.

6.7 Phone Numbers and Text Messaging Consent

We do not share phone numbers or text and WhatsApp messaging consent with third parties or affiliates for their marketing purposes. This does not limit the sharing of your contact details with a Provider you ask us to introduce you to, as described in Section 6.2, or with the service providers described in Section 6.1, who may use them only to respond to your request or to support our operations.

Horizon Atlas is operated in the United States. Your personal data may be transferred to and processed in the United States and other countries where we or our service providers operate. These jurisdictions may have data protection standards that differ from those in your country of residence.

For EEA and UK users: We implement appropriate safeguards for international data transfers, including Standard Contractual Clauses approved by the European Commission (or equivalent UK mechanisms). You may request a copy of the applicable transfer mechanisms by contacting us at info@horizonatlas.ai.

For all users: By using the Platform, you consent to the transfer and processing of your personal data in the jurisdictions described above.

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure. These measures include encryption of data in transit (TLS) and at rest, access controls and authentication requirements, regular security assessments, and vendor security reviews.

However, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of your data. You are responsible for maintaining the security of your account credentials and for notifying us promptly of any suspected unauthorized access.

8.1 Data Breach Notification

In the event of a data breach that affects your personal information and poses a risk to your rights and freedoms, we will notify affected users without undue delay and in accordance with applicable law. For EEA/UK users, we will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, as required by GDPR.

The Platform is not directed to and is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a user is under 18, we will promptly close that account and delete or anonymize associated personal data. If you believe a minor has created an account, please contact us at info@horizonatlas.ai.

10.1 All Users

• Access and review your account information at any time through account settings
• Correct or update inaccurate personal data
• Request deletion of your personal data (subject to retention requirements described in Section 4)
• Opt out of marketing communications at any time via the unsubscribe link in any email or by contacting us
• Withdraw your consent to marketing calls, text messages, and WhatsApp messages at any time by replying STOP to any text or WhatsApp message or by emailing info@horizonatlas.ai
• Opt out of commercial data aggregation as described in Section 5.3

10.2 California Residents — CCPA and CPRA Rights

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to:

• Know: request disclosure of the categories and specific pieces of personal information we have collected, the purposes of collection, and the categories of third parties with whom we share it
• Delete: request deletion of personal information we hold about you, subject to certain exceptions
• Correct: request correction of inaccurate personal information
• Opt out of sale or sharing: we do not sell personally identifiable information; we share only aggregated, anonymized data — however, you may opt out of our commercial aggregation program as described in Section 5.3
• Limit use of sensitive personal information: request that we limit our use of sensitive personal information to purposes permitted by CPRA
• Non-discrimination: we will not discriminate against you for exercising your CCPA/CPRA rights

To submit a California privacy request, contact us at info@horizonatlas.ai with subject line "California Privacy Request" or use the request form in your account settings. We will respond within 45 days.

10.3 EEA and UK Residents — GDPR Rights

Under GDPR, you have the right to:

• Access: obtain a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete personal data
• Erasure: request deletion of personal data where it is no longer necessary, consent has been withdrawn, or processing is unlawful
• Restriction: request that we restrict processing of your personal data in certain circumstances
• Portability: receive your personal data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests or for direct marketing purposes
• Withdraw consent: at any time, without affecting the lawfulness of prior processing
• Complaint: lodge a complaint with your local data protection supervisory authority

To exercise your GDPR rights, contact us at info@horizonatlas.ai with subject line "GDPR Request." We will respond within 30 days, extendable by an additional 60 days for complex requests with notice.

10.4 Other International Users

Users in other jurisdictions may have privacy rights under applicable local laws, including Canada (PIPEDA), Australia (Privacy Act 1988), Brazil (LGPD), and others. We will endeavor to honor such rights where legally required. Contact us at info@horizonatlas.ai to make a request.

The Platform may contain links to third-party websites and may integrate with third-party services. Examples include Google Calendar, which powers the booking page embedded on our website and may collect information directly from you under Google's privacy policy; Stripe, which processes payments; and our company page on Facebook, which is operated by Meta under its own privacy policy when you follow a link there. This Privacy Policy applies only to the Horizon Atlas Platform. We are not responsible for the privacy practices of any third-party services, and we encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify registered users of material changes via email or prominent in-app notice and will update the "Last Updated" date at the top of this document. Your continued use of the Platform after the effective date of a revision constitutes your acceptance of the updated Privacy Policy.

Where required by applicable law, we will obtain your renewed consent before applying material changes to our data processing practices.

Horizon Atlas

Email: info@horizonatlas.ai

Website: horizonatlas.ai

For all privacy inquiries, data subject requests, or concerns regarding this Privacy Policy, please contact us at info@horizonatlas.ai with the relevant subject line indicated in the applicable section above.

For EEA and UK users: You also have the right to lodge a complaint with your national or regional data protection supervisory authority if you believe our processing of your personal data does not comply with applicable law.