Privacy Policy
Last updated: 27 August 2026
Wild Atlas Guide ("we", "us", "our") operates wildatlasguide.com, a platform for wildlife discovery, nature observation and eco-tourism. This Privacy Policy explains how we collect, use and protect your personal data when you use our website and services.
1. Who is responsible for your data?
Wild Atlas Guide is the data controller for personal data processed through this website. You can contact us at:
Email: hello@wildatlasguide.com
2. What data we collect
2.1 Account data
When you register, we collect your username, email address and password (stored as a one-way hash — we never store your plain-text password). If you register with Google, Google provides your verified email address, name and a unique account identifier; Google remains responsible for its own authentication service. We also retain the version, UTC date, language and registration method associated with your acceptance of the Terms of Use and acknowledgement of this Privacy Policy. Optionally you may provide a website URL, a short biography and a profile photo.
2.2 Content you create
When you use Wild Atlas Guide features, we store the content you voluntarily submit:
- Observation Lists — species sightings, dates, locations, notes, individual counts, and photos you attach to observations.
- My Lists — personal species lists you create and optionally share publicly.
- Reviews — star ratings, written reviews and tags for nature hotspots.
- Favourites and seen species — species you mark as favourites or as observed.
- Photos — images you upload to observations. We strip GPS metadata (EXIF) from uploaded photos before storing them and resize them to a maximum of 2000 px on the longest edge.
- Booking and custom trip requests — when you submit a booking request or a tailor-made trip enquiry, we store your name, email address, phone number, the details of your request (dates, number of people, message), and the conversation thread between you and the operator. This data is used solely to facilitate the enquiry and, if confirmed, the booking. The same data categories apply to custom trip proposals exchanged between you and the operator.
- Payments — where online payment is enabled, we store the amount, currency, status and external transaction references needed to operate the booking, reconciliation, refunds and fraud prevention. Card and bank credentials are entered with the payment provider and are not stored by Wild Atlas Guide.
2.3 Usage data
We automatically collect limited technical and usage data to keep the service working and improve it:
- IP address (used for rate-limiting on login, registration and content uploads; not linked to your browsing history).
- Search queries entered in the Wild Atlas Guide search bar (stored anonymously to help us understand what content is needed).
- Page view counts per hotspot, species and country page (aggregated, not linked to individual users for non-logged-in visitors).
- Session cookies necessary for login and CSRF protection (WordPress nonces). These expire at the end of your browser session or after a fixed period.
- When you consent to analytics cookies, Google Analytics receives limited device and usage information so we can measure visits and account creation. We configure IP anonymisation and do not use this data for advertising.
2.4 Data we do NOT collect
We do not sell personal data and we do not use advertising trackers or behavioural advertising. We do not store payment card or bank credentials.
3. Why we use your data (legal basis)
- Performance of a contract — Account data, observation content, reviews and lists are processed to provide you with the service you signed up for (GDPR Art. 6(1)(b)).
- Legitimate interests — IP-based rate limiting, aggregated analytics (view counts, search logs) and service security (GDPR Art. 6(1)(f)).
- Consent — Optional Google Analytics cookies, optional promotional email and specific photo uses rely on consent (GDPR Art. 6(1)(a)). You can withdraw those choices at any time without affecting prior lawful processing.
- Legal obligation — We may retain or disclose data when required by law (GDPR Art. 6(1)(c)).
4. Third-party services
- iNaturalist — We query the iNaturalist public API to retrieve Creative Commons-licensed species photographs. Only scientific names or taxon identifiers are sent; no personal data is shared.
- OpenStreetMap / Nominatim — Used for map geocoding. Only place names are sent; no personal data is shared.
- CARTO — Provides map tile images. CARTO receives your IP address when map tiles are loaded. See carto.com/privacy.
- Leaflet.js — Open-source mapping library loaded from the unpkg CDN. No personal data is shared.
- GBIF — Used to display species distribution maps. Only taxon identifiers are sent; no personal data is shared.
- Google — Provides optional account authentication and, only after cookie consent, Google Analytics traffic measurement.
- Cloudflare — Provides the optional Turnstile anti-bot challenge on registration when enabled.
- Stripe — Processes online payments for participating businesses through connected Standard accounts. The connected business is the merchant and Stripe receives the payment and verification data required for that service.
- Hosting and email providers — Process the limited server, backup and delivery data necessary to host the Platform and send account, security and booking messages on our behalf.
We do not use Facebook Pixel or cross-site advertising trackers.
5. How long we keep your data
- Account data — Kept for as long as your account exists. Deleting your account erases your personal data and all user-generated content (observations, reviews, lists, photos).
- Agreement and email-preference records — Kept with the account to demonstrate which version and choice applied.
- Photos — Deleted immediately when you remove them or when your account is deleted.
- IP logs for rate limiting — Cleared automatically after a short rolling window (minutes to hours).
- Search logs — Internal search queries are linked to your account for at most 30 days, after which they are automatically anonymised. Raw search log entries are deleted after 180 days.
- Page view statistics — Counted per page per day with no personal data attached. Daily detail is kept for 3 months, then consolidated into monthly totals which are retained indefinitely.
6. Your rights under GDPR
- Access — Request a copy of the personal data we hold about you.
- Rectification — Correct inaccurate data at any time from your profile settings.
- Erasure — Request deletion of your account and all associated personal data.
- Restriction — Ask us to restrict processing in certain circumstances.
- Data portability — Receive your content in a machine-readable format on request.
- Objection — Object to processing based on our legitimate interests.
- Complaint — Lodge a complaint with your national data protection authority.
To exercise any of these rights, email us at hello@wildatlasguide.com. We will respond within 30 days.
7. Cookies
We use strictly necessary WordPress cookies for login, security and form protection. These do not require consent. The wa_consent preference cookie remembers your analytics choice for one year.
Google Analytics and its analytics cookies are loaded only after you press Accept in the cookie notice. Pressing Decline keeps Analytics disabled. You can reopen the notice at any time through Cookie settings in the footer and change your choice. We do not use advertising cookies.
8. Data security
We take reasonable technical and organisational measures to protect your data: HTTPS encryption for all connections, hashed password storage, EXIF/GPS stripping from uploaded photos, server-side file type validation, and rate limiting on sensitive endpoints.
9. Children's privacy
Wild Atlas Guide is not directed at children under 16. We do not knowingly collect personal data from children under 16. Contact us if you believe a child has provided us data and we will delete it.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date and communicated where required. This policy provides information about processing; any new optional processing that requires consent will be presented as a separate choice.