Privacy Policy

This Privacy Policy explains how GeoSphere ("we", "us", or "our") collects, uses, stores, and shares your personal data when you use our website and elevation API service (the "Service"). We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

Please read this policy carefully. If you have any questions, contact us at support@geosphere.info.

1. Data We Collect

We collect the following categories of personal data:

Account data

• Email address (required to create an account)
• Hashed password (if you use email/password sign-in; we never store your password in plain text)
• OAuth provider identity (if you sign in via Google, GitHub, or GitLab)

API and usage data

• API keys associated with your account
• API request counts and quota consumption
• Request timestamps and basic telemetry (used for quota enforcement and service monitoring)

Payment data

• Stripe customer ID and invoice references (we do not store card numbers or full payment details — these are held by Stripe)
• Subscription status, plan, and billing history

Contact form messages

• Your name, email address, company (optional) and message, if you write to us through the contact form on our home page

Technical data

• Cookies and session identifiers (see our Cookie Policy)
• Browser type and approximate location derived from IP address (via Google Analytics)

2. How We Use Your Data

We use your data to:

• Create and manage your account
• Provide, maintain, and improve the Service
• Process payments and send billing-related communications
• Enforce API quotas and usage limits
• Detect and prevent fraud, abuse, or security incidents
• Respond to your support requests
• Analyse how the Service is used in aggregate (via Google Analytics)
• Comply with our legal obligations

3. Legal Bases for Processing (UK GDPR)

We rely on the following legal bases:

• Contract — processing necessary to provide the Service you signed up for (account management, API access, billing)
• Legitimate interests — security monitoring, fraud prevention, and aggregate analytics
• Legal obligation — where we are required to process data to comply with UK law
• Consent — for analytics cookies where required (you can withdraw consent via cookie settings)

4. Third-Party Processors

We share data with the following third parties, each of whom processes data on our behalf or as an independent controller. All processors are required to handle your data securely and in accordance with applicable law.

Stripe (payments)

We use Stripe to process payments. When you purchase a subscription or one-time plan, Stripe collects and stores your payment method details. GeoSphere does not receive or store full card numbers. Stripe's privacy policy is available at stripe.com/gb/privacy.

Google, GitHub, GitLab (OAuth sign-in)

If you choose to sign in using a social account, the relevant provider authenticates you and shares your email address with us. We do not receive your password from these providers. Each provider's privacy policy governs how they handle your data during authentication.

Google Analytics

We use Google Analytics to understand how visitors use our website. Google Analytics collects data such as pages visited, time on site, and general geographic location (derived from IP address). This data is aggregated and does not identify you personally. Google may use this data in accordance with its own privacy policy. You can opt out via your browser's cookie settings or using the Google Analytics Opt-out Browser Add-on.

Resend (email delivery)

We use Resend to send our emails, such as sign-up verification, password resets and billing notices, and to deliver contact form messages to our support inbox. Resend processes your email address and the content of these emails. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Cloudflare Turnstile (sign-up and contact form protection)

Our sign-up page and the contact form on our home page use Cloudflare Turnstile to check that new accounts and messages come from people rather than bots. On the home page it loads only when you scroll to the contact form. Turnstile collects information about your browser and device, along with your IP address, and sends it to Cloudflare for this check. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

5. Data Retention

We retain your personal data for as long as your account is active. If you request deletion of your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal or regulatory reasons (for example, financial records which we retain for 7 years under UK law). API request logs may be retained in anonymised or aggregated form for service improvement purposes.

6. International Data Transfers

Some of our third-party processors (including Stripe, Google, Cloudflare and Resend) may process your data outside the UK and the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or standard contractual clauses approved by the relevant authority.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate or incomplete data
• Erasure — request deletion of your data where we no longer have a lawful reason to process it
• Portability — receive your data in a structured, commonly used, machine-readable format
• Restriction — ask us to restrict processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at support@geosphere.info. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use cookies and similar technologies to operate the Service. For full details, including how to manage your preferences, see our Cookie Policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a notice in the Service. The effective date at the top of this page will always reflect when the policy was last updated.

10. Contact

For any privacy-related questions or to exercise your rights, contact us at support@geosphere.info.