Draft. This document is a working draft and is pending review by qualified counsel. It is not yet legal advice. In particular, the legal bases, retention periods, sub-processor list and international transfer safeguards must be confirmed by a data protection professional before publication.

Privacy Policy

Version 0.7 · 10 August 2026 (draft)

This Privacy Policy explains how ALIGN processes personal data when you use our platform to build web maps and GIS applications (the "Service"), and the rights you have. We are based in the European Union and aim to comply with the General Data Protection Regulation (GDPR).

1. Who we are

The data controller is GEO NOVA SRL, a company registered in Belgium (enterprise number 1017.888.306) with its registered office at Rue de la Consolation 62/3, 1030 Schaerbeek, Brussels, Belgium. For any privacy question or request, contact us at contact@aligngeo.com.

2. Scope

This policy covers our websites, the Service, and related communications. It does not cover third-party services you choose to connect, which have their own privacy policies.

3. What personal data we process

• Account data: your email address and name, managed through our authentication provider.
• Your content: the projects, geospatial data, files and code you create or upload. This may contain personal data if you choose to include it; you control what you put in.
• AI prompts: the messages and context you send to the AI assistant.
• Usage and technical data: logs, device and browser information, and events needed to operate, secure and debug the Service.
• Billing data: subscription, top-up and usage records; card details are handled by Stripe, our payment processor, and are not stored by us.
• Communications: messages you send us.
• Feedback you publish: if you post on our public feedback board, the display name you choose there, your posts, comments and votes. That board is public: what you write is visible to anyone and can be indexed by search engines. Nothing is published there unless you write it yourself.

4. Why we process it, and our legal bases

• To provide the Service (create and host your maps and apps, run AI features, process payments): performance of a contract.
• To secure and improve the Service (prevent abuse, debug, measure reliability): our legitimate interests.
• To communicate with you about the Service: contract or legitimate interests.
• For optional analytics or marketing, where offered: your consent (which you can withdraw at any time).
• To meet legal obligations (accounting, responding to lawful requests): legal obligation.

5. How long we keep it

We keep personal data only as long as we need it, and no longer. Where the law sets a period, we follow it; otherwise we set one and can justify it.

The 30-day period after termination is there so you can export your work. After it, deletion is permanent. Billing records are the one exception we cannot make: Belgian accounting and tax law require us to keep them.

6. Who we share it with

We do not sell your personal data. We share it with service providers ("sub-processors") that process data on our behalf, under contract, only to provide the Service:

• Google Cloud / Firebase: hosting, database, authentication, storage.
• AI model providers: to run AI features, your prompts and the relevant context are sent to the model provider selected for the request. The provider keys are ours — you never supply your own — and each provider acts as our sub-processor. An organisation administrator can disable providers for the whole organisation. Current providers: Mistral AI (France) and GitHub / Microsoft for the models it hosts (Claude, Kimi, GPT).
• HERE: to power address search, reverse geocoding and route calculation. What is sent is the address you type or the coordinates concerned, from our servers using our own key, so your IP address is not sent to them. A map creator can replace this default with a provider of their own choice, using their own key; that provider then contracts with them, not with us.
• Database provider (Supabase): where you create or connect a database for your app.
• Stripe: to process payments, top-ups and any subscription billing.
• Brevo: to send transactional emails, such as organization invitations and account notices, and — where you have given your consent — our newsletter and product announcements. Brevo is a French, GDPR-compliant provider; the email data it processes for us (recipient address, organization name, inviter address) is hosted in the European Union.
• Featurebase: to host our public feedback board, if you choose to use it. Featurebase is operated by CORDNET OÜ in Estonia, and processes your data within the European Union. It never receives the content of your workspaces — only what you write on the board.

The full list of sub-processors is published on our sub-processors page, with the country of processing and the transfer safeguard for each. We may also disclose data where required by law.

7. Where we process it, and international transfers

We aim to process personal data in the European Union. Some sub-processors process data outside the EU. Where that happens, we rely on an appropriate safeguard under Chapter V GDPR — an adequacy decision, the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. Our sub-processors page states the country of processing and the exact safeguard for each one, provider by provider.

You can ask us for a copy of the clauses we rely on for any of these transfers. Write to contact@aligngeo.com and we will send them to you.

8. Do you have to give us this data

Your email address and name are needed to create an account and to provide the Service. Without them there is no contract we can perform, so we cannot open an account for you. Billing records are required of us by Belgian accounting and tax law, so we cannot leave them out either.

Everything else is yours to decide, in particular the content you upload. The Service works with as little or as much as you choose to put into it, and nothing obliges you to include personal data in what you create.

9. Automated decisions

We do not profile you, and we make no decision about you based on an assessment of your personal characteristics, your behaviour or your preferences.

Two things in the Service do happen automatically, and both follow from the contract rather than from any judgement about you. Your organisation's usage is measured against the allowance of its plan. And if a subscription payment fails, access is suspended at the end of the grace period. Both are triggered by facts you can check yourself, and a human will look at either of them if you write to contact@aligngeo.com.

10. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your supervisory authority. In Belgium, this is the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).

To exercise your rights, contact contact@aligngeo.com.

11. Deleting your account

You can delete your account and associated personal data directly from the app, in your account settings. Your data remains recoverable for 30 days so you can export it, and is then permanently deleted — subject to the legal retention obligations listed in section 5, and to any backup copies, which are overwritten in the ordinary course.

12. How we protect your data

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation, and secret management. No system is perfectly secure, but we work to protect your data and to keep credentials out of anything you export or share.

If a data breach occurs, we follow a documented procedure. Where the breach is likely to result in a high risk to your rights and freedoms, we inform you without undue delay, in clear and plain language. We tell you what happened and what data was affected, what the likely consequences are for you, what we have done and what we propose to do about it, what you can do on your side, and a contact point where you can get more information. Where we process data on behalf of an organisation, we notify that organisation without undue delay of becoming aware, so that it can meet its own obligations.

13. Cookies

We use only strictly necessary cookies and similar technologies, listed item by item in our Cookie Policy. We set no analytics, advertising or tracking technologies. Should we introduce anything that is not strictly necessary, we will ask for your consent beforehand.

14. Age

The Service is a paid, professional tool and is not open to minors. You must be of legal age to create an account. Where the Service is used in an educational setting, the account must be created and held by an adult, who remains responsible for it.

Belgian law allows a child aged 13 or over to consent to the processing of their own data by an information society service. That threshold concerns consent to processing; it does not make a minor able to enter into a paid contract, and it does not change the rule above.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you.

16. Contact

For any question about this policy or your personal data, contact contact@aligngeo.com. See also our Terms of Service and Cookie Policy.