Draft. This document is a working draft and is pending review by qualified counsel. It is not yet legal advice. In particular, the legal bases, retention periods, sub-processor list and international transfer safeguards must be confirmed by a data protection professional before publication. Placeholders shown as [ TO COMPLETE ]must be filled in.

Privacy Policy

Last updated: 8 July 2026 (draft)

This Privacy Policy explains how ALIGN processes personal data when you use our platform to build web maps and GIS applications (the "Service"), and the rights you have. We are based in the European Union and aim to comply with the General Data Protection Regulation (GDPR).

1. Who we are

The data controller is GEO NOVA SRL, a company registered in Belgium (enterprise number 1017.888.306) with its registered office at Rue de la Consolation 62/3, 1030 Schaerbeek, Brussels, Belgium. For any privacy question or request, contact us at contact@geonova.be. Our Data Protection Officer, where appointed, can be reached at[ TO COMPLETE: DPO contact, or "not appointed" ].

2. Scope

This policy covers our websites, the Service, and related communications. It does not cover third-party services you choose to connect, which have their own privacy policies.

3. What personal data we process

• Account data: your email address and name, managed through our authentication provider.
• Your content: the projects, geospatial data, files and code you create or upload. This may contain personal data if you choose to include it; you control what you put in.
• AI prompts: the messages and context you send to the AI assistant.
• Usage and technical data: logs, device and browser information, and events needed to operate, secure and debug the Service.
• Billing data: subscription, top-up and usage records; card details are handled by Stripe, our payment processor, and are not stored by us.
• Communications: messages you send us, including through the early-access form and demo bookings.

4. Why we process it, and our legal bases

• To provide the Service (create and host your maps and apps, run AI features, process payments): performance of a contract.
• To secure and improve the Service (prevent abuse, debug, measure reliability): our legitimate interests.
• To communicate with you about the Service: contract or legitimate interests.
• For optional analytics or marketing, where offered: your consent (which you can withdraw at any time).
• To meet legal obligations (accounting, responding to lawful requests): legal obligation.

5. How long we keep it

We keep personal data for as long as your account is active and as needed to provide the Service, then delete or anonymize it within a reasonable period, except where we must retain it to meet legal obligations (for example accounting records). Indicative retention periods:[ TO COMPLETE: retention schedule ].

6. Who we share it with

We do not sell your personal data. We share it with service providers ("sub-processors") that process data on our behalf, under contract, only to provide the Service:

• Google Cloud / Firebase: hosting, database, authentication, storage.
• AI model providers: to run AI features, your prompts and context are processed by the model provider powering the assistant, or, where you enable your own key, by the provider you selected.
• Database provider (Supabase): where you create or connect a database for your app.
• Stripe: to process payments, top-ups and any subscription billing.
• Form and scheduling tools: our early-access form relay and anti-bot protection, and our demo scheduling tool.

A current, detailed list of sub-processors is available on request at contact@geonova.be. We may also disclose data where required by law.

7. Where we process it, and international transfers

We aim to process personal data in the European Union. Some sub-processors may process data outside the EU. Where that happens, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses. Details of transfers and safeguards:[ TO COMPLETE: transfer mechanisms per sub-processor ].

8. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your supervisory authority. In Belgium, this is the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).

To exercise your rights, contact contact@geonova.be.

9. Deleting your account

You can delete your account and associated personal data directly from the app, in your account settings. We will delete or anonymize your data within a reasonable period, subject to legal retention obligations and routine backups.

10. How we protect your data

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, tenant isolation, and secret management. No system is perfectly secure, but we work to protect your data and to keep credentials out of anything you export or share.

11. Cookies

We use cookies and similar technologies as described in ourCookie Policy. Non-essential cookies are used only with your consent.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you.

14. Contact

For any question about this policy or your personal data, contact contact@geonova.be. See also ourTerms of Service andCookie Policy.