Privacy Policy

• Account and subscription details. Your email address, your role in the portal (subscriber or admin), your subscription status synced from Substack, and — if you choose to provide them during onboarding — your name, employer, and role.
• Sign-in and security data. One-time login codes and magic links we email to you, passkey public keys if you register a passkey (biometric data never leaves your device), session identifiers (stored by us only in hashed form), and security metadata such as IP address and browser or device type.
• Usage and content. The research surfaces you use, questions you ask the research agent and the responses it returns (conversation logs), request and token-usage metrics, and files that admins upload to the knowledge base.
• Connected-app activity. If you connect CS Atlas to a third-party AI assistant, we receive the queries that assistant sends on your behalf and log the requests and access tokens we issue.
• Support and inquiry messages. The name, email address, topic, and message you submit through our support or inquiry forms.
• iOS app data. A push-notification token if you enable notifications, and the device pairing used to connect the app to your account.

• Operate the portal and authenticate your access.
• Keep your access aligned with your subscription status on Substack.
• Deliver research features, including the research agent and its cited answers.
• Troubleshoot problems — for example, reviewing the logs of a specific agent conversation you report to us.
• Maintain quality, security, and abuse prevention across the service.
• Send service emails such as sign-in codes and replies to your support requests. We do not send marketing email from the portal.

We do not sell personal information, and we do not use it for third-party advertising.

The research agent generates answers from our ingested research corpus. Your agent conversations are processed by third-party AI model providers through an AI gateway to generate responses, and are logged — along with request traces — so we can debug failures, evaluate quality, and prevent abuse. Model providers under our gateway configuration process content to serve our requests; we do not permit them to use your conversations to train their models under the terms we contract for.

Please do not include sensitive personal information in agent conversations; the service is designed for professional research questions.

You can use CS Atlas from third-party AI assistants — for example the Creative Strategies Research app in ChatGPT or an MCP connector in Claude — and sign in to approved third-party tools with your CS Atlas account. In those flows, the assistant platform processes your prompts under its own privacy policy; we receive the queries it sends to us, apply your subscription entitlements, return research content, and log the requests. You can disconnect an assistant at any time from that platform, and we can revoke its access tokens on request.

The portal uses essential cookies only: an HttpOnly session cookie (named with the ds_portal_session prefix, scoped to thediligencestack.com) that keeps you signed in, and a local theme preference. We do not use advertising or cross-site tracking cookies.

We use a small set of processors to run the service, each receiving only what it needs:

• Vercel — web hosting and AI gateway routing
• Railway — application and realtime hosting
• Convex — application database
• Cloudflare — transactional email delivery
• Substack — subscription management and billing
• Langfuse — AI request tracing and quality review
• Sentry — error monitoring
• UploadThing — file upload storage
• Apple — maps on the data-center dashboard and push notifications for the iOS app

We share personal information only with the service providers above, when required by law or legal process, to protect the security and integrity of the service, or as part of a corporate transaction such as a merger or acquisition (in which case this policy continues to apply until updated).

We keep account information for as long as your subscription is active and for a reasonable period afterward. Conversation logs and request traces are kept as needed for quality, troubleshooting, and abuse prevention. You can ask us to delete your account data at any time.

All traffic is encrypted in transit. Session tokens are stored only as cryptographic hashes, sign-in codes expire after ten minutes, and internal access to production data is restricted. No system is perfectly secure, so please contact us immediately at max@creativestrategies.com if you suspect unauthorized access to your account.

You can request access to, correction of, export of, or deletion of your personal information by emailing max@creativestrategies.com. Depending on where you live, local law (such as the GDPR or the CCPA) may give you additional rights; we honor valid requests regardless of location. We will respond within a reasonable timeframe and never discriminate against you for exercising these rights.

The Creative Strategies Atlas is a professional research service and is not directed to anyone under 16. We do not knowingly collect personal information from children.

We may update this policy as the service evolves. We will post the new version at this URL and update the date above; material changes will be communicated to active subscribers.

Questions about privacy? Email max@creativestrategies.com or use the support page.