1. Who is responsible
WestEdge Advisors LLC, trading as Mainline, is the controller of the personal data described here. Write to partners@mainline-railway.com for anything in this notice; the Managing Partner reads it daily.
2. What we collect, and why
- At the Atlas gate and the subscribe form: your full name, role, company, work email, and the market edition you chose. We use them to open your free edition, to send you the Brief, and to know who reads the platform. Our basis is our legitimate interest in publishing to the professionals the platform is built for; you can object or unsubscribe at any time (section 6).
- When you buy a paid edition: your billing name and address, your phone number, your VAT or GST number if you enter one, and your payment method. Stripe, acting as merchant of record through Link, collects and holds these to take the payment, compute and remit tax, and issue receipts; we never see your card details. On your Stripe customer record we keep your email, the editions you hold and the free edition you chose. Our basis is the contract with you and the tax law Stripe must comply with.
- When you ask for a sign-in link: your email address, used once to send the link. Our basis is the contract with you.
- When you write to us: whatever you send, used to reply.
- Technical logs: our host, Vercel, records the IP address, browser and page requested with each visit for security and to keep the site running. These logs are not joined to your name or email, and we do not use them to profile you.
We run no advertising trackers, we do not buy or enrich data about you, and we never profile individuals: the Atlas names institutions and firms, not people. We count page views, and that is the whole of our measurement; section 3 says how.
3. Cookies and browser storage
- ml_session — a signed, HttpOnly cookie set when you open an edition. It holds your email, name and a snapshot of the editions you hold so that the Atlas can open them on each visit. It lasts one year, or until you sign out from your editions view. It is essential to the service and needs no consent banner.
- Browser storage — the Atlas remembers in your own browser whether you dismissed the welcome strip and when you last visited, so it can show what changed. Nothing in it leaves your browser.
- ml_ft — a browser-session record of the page you arrived on and the site you came from, kept in your browser's session storage, cleared when you close the tab. It is not a cookie, it is never sent to anyone while you read, and it reaches us only if you choose to submit a form, so that we know which page brought you. No third party can read it.
- Page views — our host, Vercel, counts how often each page is read. The counter is served from our own domain, sets no cookie and stores nothing in your browser. It reports counts by page, country and device, and nothing else; it holds no name, email or account, and nothing it records is joined to your gate details, your subscription or your billing record. The Atlas also records, the same way, which of its own controls are used — a lens opened, a search suggestion tried, an entity viewed, the gate or Your editions opened, a checkout started — as anonymous counts, with no email or name attached.
- PostHog — we measure how the site and the Atlas are used with PostHog, hosted in the European Union, without cookies, unless you submit a form. Form submissions are stored in HubSpot, which we use to send you the Brief and our notes on the Atlas. If you want anything we hold about you deleted, reply to any email from us and ask.
- Stripe sets its own cookies on its checkout and billing pages, under Stripe's privacy policy.
There are no third-party advertising or analytics cookies on the platform.
4. Who processes it for us
- HubSpot — our CRM; the one list every capture point writes to.
- PostHog — measures how the site and the Atlas are used, hosted in the European Union.
- Stripe (with Link, its merchant-of-record service) — payments, tax, receipts and invoices, the customer portal, and the record of who holds which paid edition. Link may keep an account for you under Link's privacy policy.
- Resend — sends the sign-in link when you ask for one.
- Vercel — hosts the site and the Atlas API, and counts page views for us.
- Google Workspace — our mailbox, for anything you write to us.
Each holds data in the United States and, for some, in the European Union, under contracts that bind them to protect it. If you are in the EU, the UK or Switzerland, transfers rely on the standard contractual clauses and the providers' certifications under the applicable data-transfer frameworks. We share personal data with nobody else, except where the law requires it.
5. How long we keep it
- Your gate and list details: while you hold an edition or are on the list, and for up to 24 months after you leave, in case you return; deleted on request at any time.
- Billing records: as long as tax and accounting law requires, typically seven years after the transaction.
- Correspondence: for as long as we need it to deal with what you wrote.
- Technical logs: as retained by the host, typically days to weeks.
6. Your rights and choices
You can ask us for a copy of what we hold, ask us to correct or delete it, object to our use of it, or ask to move it. Write to partners@mainline-railway.com; we answer within a month. Every issue of the Brief carries an unsubscribe link, and you can sign out of the Atlas from your editions view. If you are in the EU or the UK and think we have handled your data badly, you can also complain to your data-protection authority.
7. Email
We send three kinds of email and no other: the Brief, fortnightly, to the list; a sign-in link when you ask for one; and receipts, invoices and payment notices from Link (Stripe) if you hold a paid edition. There are no promotional sequences and nothing is sent to the list beyond the publications you signed up for.
8. Security
The site is served over HTTPS. The session cookie is signed and cannot be read by page scripts. The withheld data of each edition is served only to a session that holds it. Payment details never touch our servers. No system is perfectly secure, and if a breach affects you we tell you and, where required, the authorities.
9. Children
The platform is for working professionals and is not directed at anyone under 18. We do not knowingly collect data from children.
10. Changes
We may update this notice; the date at the top changes when we do. A material change is announced on the site before it takes effect.
The rules for using the platform are in the terms.