Privacy Policy

Effective: 1 August 2026  ·  Last updated: 1 August 2026

1. Who We Are

geog.ai operates the geog.ai spatial reasoning API and associated web services. References to "we", "us", or "our" mean geog.ai. Our contact details are on our contact page.

2. Data We Collect

Account data

• Email address and password hash (for account creation and login).
• Billing information (processed by Stripe — we do not store card numbers).
• API keys (stored as salted hashes; plaintext shown only once at creation).

Usage data

• API request logs: endpoint called, HTTP status, latency, Data Credit charge, and a truncated (anonymised) request fingerprint.
• Query geography: bounding boxes or coordinates submitted in API calls, retained for billing verification and abuse detection.
• Simulation inputs: parameters submitted to propagation endpoints (plume, flood, RF, fire spread, routing) — retained for 30 days for debugging and job recovery.
• Webhook delivery logs: URLs, payloads, and response codes.

Technical data

• IP address, User-Agent, and referrer for security and rate-limiting.
• Session cookies for the web dashboard (HttpOnly, SameSite=Lax).

3. How We Use Your Data

• Service delivery — fulfilling API requests, billing, and account management.
• Security & abuse prevention — rate limiting, fraud detection, and anomaly alerting.
• Model improvement — anonymised aggregate statistics (never individual trajectories or PII) to tune spatial models.
• Communications — transactional emails (billing, key rotation, alerts). No marketing emails without separate consent.
• Legal obligations — complying with applicable law.

4. Data Retention

• API request logs: 90 days rolling, then aggregated to anonymised counters.
• Simulation inputs / job results: 30 days, then purged.
• Billing records: 7 years (legal / tax requirement).
• Account data: retained while your account is active, then deleted within 90 days of account closure on request.
• Webhook delivery logs: 30 days rolling.

5. Third-Party Data Processors

We share data with the following processors to operate the Service:

• Stripe — payment processing. Stripe's privacy policy applies to card data: stripe.com/privacy.
• Resend — transactional email delivery.
• AWS S3-compatible object storage — GeoParquet export storage and STAC asset hosting. Files are encrypted at rest.
• Redis — ephemeral job queuing and rate-limit counters. No PII stored beyond session tokens (short TTL).
• PostgreSQL (managed) — primary database for account, billing, and usage records.

We also query the following public data sources on your behalf when you make API requests — see our Attribution page for full details. No user PII is sent to these providers.

6. Spatial Data & Third-Party Sources

geog.ai retrieves data from publicly licensed sources (NOAA, USGS, NASA, Overture Maps, WorldPop, and others) to answer spatial queries. Coordinates you submit are used to query these services. The coordinates are not sold or shared for advertising.

7. Your Rights

Depending on your jurisdiction you may have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Request deletion of your data (subject to legal retention requirements).
• Object to or restrict certain processing.
• Data portability (export of your usage logs in machine-readable form).

To exercise these rights, contact us via our contact page.

8. Cookies

The geog.ai web dashboard uses a single session cookie for authentication (HttpOnly, SameSite=Lax, no cross-site tracking). We do not use advertising or analytics cookies.

9. Security

We implement industry-standard security measures including TLS in transit, encryption at rest for sensitive fields, API key hashing, and rate limiting. No transmission over the internet is 100% secure; use the Service at your own risk.

10. Children

The Service is not directed to children under 16. We do not knowingly collect data from children under 16.

11. Changes to This Policy

We will notify you of material changes via email or dashboard notice at least 14 days before changes take effect.

12. Contact

Privacy questions or rights requests: see our contact page.