1. Introduction

This Privacy Policy describes how Stratamap ("we," "us," or "our") collects, uses, shares, and protects your personal information when you use our website at stratamap.io and our 3D map generation services (collectively, the "Services"). Stratamap is operated from New Zealand. By using our Services, you agree to the practices described in this policy. This Privacy Policy forms part of our Terms of Service.

2. Information We Collect

We collect several types of information to provide and improve our Services:

Account Information

When you create an account, we collect:

  • Name and email address: Provided directly by you, or obtained from your Google account if you choose to sign in with Google.
  • Profile photo: If you sign in with Google, we may receive your profile photo.

Project Data

When you use our Services, we store:

  • Map projects: Your designs, including selected geographic areas, layers, colors, shapes, annotations, and view preferences.
  • Generated files: The 3D mesh files we create from your designs.

Note: We do not collect your physical location. Geographic areas in your projects are selected by you, not automatically detected from your device.

Payment Information

When you make a purchase or subscribe, our payment processor Polar collects and processes:

  • Billing email address
  • Payment method details
  • Subscription and transaction history

We do not directly store your full payment card details. We receive subscription status updates and transaction confirmations from Polar to manage your account.

Technical and Usage Information

We automatically collect:

  • IP address: Recorded with each session for security purposes.
  • Device information: Your browser type, operating system, and device type.
  • Session data: When you log in and how long your session lasts.
  • Error logs: Technical errors that occur while you use our Services, along with contextual information to help us diagnose issues.

3. How We Use Your Information

We use the information we collect to:

  • Provide the Services: Create and manage your account, store your projects, generate 3D mesh files, and deliver your exports.
  • Process payments: Manage your subscription, process payments, and track export usage.
  • Communicate with you: Send transactional emails including login links, purchase confirmations, export notifications, and responses to support inquiries. If you subscribe to a paid plan, we may send you updates relevant to your subscription tier. You can unsubscribe from non-essential communications at any time. We do not send marketing emails unless you explicitly opt in.
  • Improve the Services: Diagnose technical issues, monitor service performance, and develop new features.
  • Ensure security: Detect and prevent fraud, unauthorized access, and other malicious activity.

4. Legal Basis for Processing

We process your personal information under the following legal bases:

  • Contract performance: Processing necessary to provide the Services you requested, including account management, project storage, mesh generation, and export fulfillment.
  • Legitimate interests: Processing for our legitimate business interests, such as improving our Services, ensuring security, and preventing fraud, where these interests are not overridden by your rights.
  • Consent: Processing based on your consent, such as setting analytics cookies or sending optional communications. You can withdraw consent at any time.
  • Legal obligations: Processing necessary to comply with applicable laws, such as tax and accounting requirements.

If you are located in the United Kingdom, references to the GDPR in this policy include the UK General Data Protection Regulation (UK GDPR) as retained under the Data Protection Act 2018.

5. Third-Party Service Providers

We share information with the following third-party service providers who help us operate our Services:

Polar (Merchant of Record)

All payments are processed securely by our Merchant of Record, Polar.sh. Because they are the Merchant of Record, they act as the Data Controller for your payment transactions. When you make a purchase or subscribe, Polar directly collects your email address, payment details, and subscription information. See Polar's Privacy Policy.

Google (Authentication)

If you choose to sign in with Google, we use Google's OAuth service to authenticate your account. Google receives information about the authentication request, and we receive your name, email address, and profile photo from Google. See Google's Privacy Policy.

Amazon Web Services (Cloud Infrastructure)

We use AWS to store your project data, generate 3D mesh files, and run our processing infrastructure. Your project snapshots and generated files are stored securely in AWS. See AWS's Privacy Notice.

Resend (Email Delivery)

We use Resend to send transactional and service-related emails, including login links, export notifications, and subscription updates. Resend receives your email address to deliver these messages. See Resend's Privacy Policy.

Sentry (Error Tracking)

With your consent, we use Sentry to monitor errors and diagnose technical issues. When enabled, Sentry may receive error logs, user identifiers, and session replay data. See Sentry's Privacy Policy.

Cloudflare (Hosting and Security)

Our website is hosted on Cloudflare. Cloudflare processes request data, including IP addresses, for security and performance purposes. See Cloudflare's Privacy Policy.

Google Fonts (Typography)

Our website loads fonts from Google Fonts. When you visit our site, your browser connects to Google's servers to download font files, which means Google may receive your IP address. No cookies are set by this service. See Google's Privacy Policy.

6. Sharing and Disclosure of Information

We do not sell your personal information. We may share your information in the following circumstances:

  • With service providers: As described above, to operate our Services.
  • When you share projects: If you create a share link for a project, anyone with that link can view a snapshot of that project.
  • For legal compliance: If required by law, regulation, legal process, or governmental request.
  • To protect rights and safety: To protect the rights, property, or safety of Stratamap, our users, or the public.
  • Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

7. Data Retention

We retain your information for as long as necessary to provide the Services and fulfill the purposes described in this policy:

  • Account data: Retained while your account is active and for a reasonable period after deletion.
  • Project data: Retained while your account is active. You can delete individual projects at any time.
  • Generated mesh files: Download links expire after 90 days. For exports, we retain the source data needed to regenerate your files.
  • Temporary processing files: Automatically deleted within 3 days.
  • Payment records: Retained as required for accounting, tax, and legal purposes.
  • Purchase history and export balance: Records of your purchases and remaining map export balance are retained while your account is active and as required for accounting and legal purposes.

8. Data Security

We use appropriate technical and organizational measures to protect your information:

  • All data is transmitted using HTTPS encryption.
  • Session tokens are cryptographically secured before storage.
  • Download links expire automatically and cannot be guessed.
  • Access to our systems is restricted and monitored.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request correction of inaccurate personal information.
  • Deletion: Request deletion of your account and personal information, except where we need to retain it for legal or accounting purposes.
  • Objection: Object to processing of your personal information in certain circumstances.
  • Data export: Request a copy of your project data in a portable format.
  • Complaint: If you are located in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email us at privacy@stratamap.io.

10. Cookies and Tracking Technologies

We use cookies to provide and improve our Services. When you first visit our site, we ask for your consent before setting non-essential cookies.

Essential Cookies

These cookies are required for the website to function and cannot be disabled:

  • Session cookie: Keeps you logged in. Expires after 7 days of inactivity.
  • UI preferences: Remembers your interface settings. Expires after 7 days.
  • Cookie consent: Stores your cookie choices. Expires after 12 months.

Analytics Cookies

These cookies help us identify errors and understand how you use our site. They are only set with your consent:

  • Sentry: Error tracking and performance monitoring. When enabled, Sentry may record session replays to help us diagnose issues.

Managing Your Preferences

You can change your cookie preferences at any time through our website. You can also configure your browser to block cookies, though this may affect functionality.

Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting. We do not track users across third-party websites, so we do not respond differently to DNT signals. Our tracking practices are the same regardless of your DNT setting.

11. International Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, where our service providers operate. These countries may have different data protection laws than your country of residence.

Where required by applicable data protection law, we rely on appropriate safeguards for international transfers, such as Standard Contractual Clauses approved by the European Commission, adequacy decisions, or other legally recognised mechanisms. We take appropriate steps to ensure your information remains protected in accordance with this Privacy Policy when transferred internationally.

12. Children's Privacy

Our Services are not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use our Services. If we learn that we have collected personal information from a child under 13, we will delete that information promptly.

13. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to know: You can request information about the categories and specific pieces of personal information we have collected about you.
  • Right to delete: You can request deletion of your personal information, subject to certain exceptions.
  • Right to opt-out of sale: We do not sell your personal information to third parties.
  • Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at privacy@stratamap.io. We will verify your identity before processing your request.

14. Changes to This Privacy Policy

We may update this Privacy Policy at any time. We will notify you of changes by posting the updated policy on this page and updating the "Last updated" date. Except as otherwise indicated, any changes will become effective when we post the revised Privacy Policy on our website.

Your continued use of the Services after changes take effect means you accept the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at privacy@stratamap.io. Please include the email address associated with your account.