The short version. We store your email address, the optional name and use case you gave us, your key's identifier and plan, and if you pay, Stripe's identifiers for your customer and subscription. We count requests per key and keep technical logs for 30 days. We do not store the coordinates you send; converted files are deleted after seven days. Card details go to Stripe and never reach us. We do not sell or share your data for advertising, and we email you only about your key, your plan and changes to the API. Email us to see, correct or delete what we hold.
1.Who this covers
This policy describes how GeoidLife, Los Angeles, California ("GeoidLife", "we", "us") handles personal data in connection with the GeoidLife API: requesting a key, calling the API, subscribing to a paid plan and using the documentation page. GeoidLife is the controller of this data. The browser tools elsewhere on geoidlife.com are not covered by this policy.
2.What we collect
| When | What | Where it lives |
|---|---|---|
| You request a key | Email address; name and "what are you building" if you fill them in; the time of the request, the IP address it came from, and how many times the key has been re-sent. | Our key table and our general sign-up list (so we can see demand for the API). The key itself is created and held by AWS API Gateway and is sent to you once by email; we do not return it over the API. |
| You call the API | Per request: the key identifier, the endpoint, the HTTP method and the response time; the number of requests per key per day or month. An unexpected server error is logged with its error message. The coordinates, heights and CRS codes in your request and response are not written to logs or to any database. | AWS CloudWatch logs (30 days) and API Gateway usage-plan counters. |
| You convert a file | The uploaded file is processed in memory and temporary storage; the converted result is written to private storage so you can download it from a time-limited link. | AWS S3, deleted automatically after seven days; the download link expires after one hour. |
| You start a paid plan | Stripe collects your card, billing address, tax ID if you enter one, and the email on the subscription. We receive and store Stripe's customer ID, subscription ID, subscription status and the plan, plus the time the plan was applied. We never see your full card number. | Stripe (under its own privacy policy) and our key table. |
| You ask for a "Manage subscription" link | Your email address, to send you a signed link to Stripe's customer portal. The link is valid for 24 hours. | Email via AWS SES; a log line records only the domain part of the address. |
| You read the documentation page | Standard web-server data (IP address, user agent, pages requested) may be recorded in our content-delivery provider's logs. The pages load fonts from Google Fonts, which sees your IP address when the font is fetched. We run no analytics or advertising scripts on the API pages. | AWS CloudFront; Google (fonts only). |
Operational log lines about keys and billing record only the domain of your email address (for example example.com), not the address itself.
3.Why we use it
- To provide the service (performance of our contract with you): issuing and delivering your key, enforcing quotas, running billing, moving your key between plans, and sending you the service emails that go with those events.
- To keep the service running and secure (our legitimate interest): diagnosing errors, measuring load, detecting abuse and preventing fraud.
- To understand demand (our legitimate interest): the sign-up list tells us how many people want the API and what they build, so we know what to work on next. We look at this in aggregate and at the free-text use cases people volunteer.
- To tell you about changes (our legitimate interest, and our obligation under the Terms): we email the address on your key about breaking changes, price changes, security issues and material updates to the Terms or this policy. These are service messages, not marketing; we do not send newsletters or promotions to API customers, and we do not share your address with anyone for marketing.
- To meet legal obligations: tax and accounting records for paid plans, and responding to lawful requests.
We do not use your inputs or outputs to build datasets or train models, we do not profile you, and we make no automated decisions with legal or similarly significant effects on you.
4.Who processes it for us
- Amazon Web Services (US East, Northern Virginia): hosting for the API, the key table, logs, file storage and outgoing email (SES).
- Stripe: payments, subscriptions, invoices, tax calculation and the customer portal. Stripe is an independent controller for the payment data it collects.
- Google Fonts: typefaces on the documentation and legal pages.
- cdn.proj.org (the PROJ project's content delivery network): our servers fetch datum and geoid grids from it. Your requests and your IP address are not sent there; only our server fetches the grid files.
We share personal data with no one else, except as needed to comply with the law, to enforce the Terms, or as part of a sale or transfer of the service, in which case we will tell you before your data is handed over. We do not sell personal data and we do not share it for cross-context behavioural advertising.
5.How long we keep it
| Data | Kept for |
|---|---|
| Key record (email, name, use case, sign-up IP address, key identifier, plan, Stripe identifiers) | While the key exists. Delete it any time by emailing us; Free keys unused for twelve months may be deleted by us. |
| Sign-up list entry | Until you ask us to remove it. |
| Technical logs | 30 days, then deleted automatically. |
| Usage counters | Daily and monthly totals per key; reset each period. |
| Converted files | Up to seven days, then deleted automatically. |
| Billing records held by Stripe and our accounting copies | As long as tax and accounting law requires, typically seven years. |
6.Your choices and rights
Email geoidlife@gmail.com from the address on your key and we will, within 30 days:
- tell you what we hold about you and give you a copy;
- correct it;
- delete your key and record, after cancelling any active paid plan (billing records that the law requires us to keep are retained);
- rotate your key, or stop a specific use.
If you are in the European Economic Area, the United Kingdom or Switzerland you also have the right to restrict or object to processing based on our legitimate interests, to data portability, and to complain to your data-protection authority. If you are a California resident, the California Consumer Privacy Act gives you rights to know, delete and correct, and the right not to be discriminated against for using them; we do not sell or share personal information as the Act defines those terms. We honour these requests whoever you are.
Because service emails about your key and plan are part of operating the service, you cannot opt out of them while you keep a key; delete the key and they stop.
7.Security
All traffic to the API and to these pages uses TLS 1.2 or later. Keys are generated and held by AWS API Gateway, are tied to one usage plan, and are never returned by the API after issue. Stripe secrets and other credentials are kept in an encrypted parameter store, not in code. Access to the systems that run the service is restricted to the people who operate it. No system is perfectly secure; if we learn of a breach affecting your data we will notify you by email without undue delay and as the law requires.
The "Try it" console on the documentation page keeps the key you paste into it in your browser's session storage only, so it survives a reload and is gone when the tab closes. It is never sent anywhere except to the API with your own requests.
8.Where data is stored
Our systems run in Amazon Web Services' US East (Northern Virginia) region, and Stripe processes payments in the United States. If you use the API from outside the United States, your data is transferred to and processed in the United States. For data from the EEA, the UK and Switzerland we rely on our providers' standard contractual clauses and, where they participate, the EU-US Data Privacy Framework and its UK and Swiss extensions.
9.Cookies and browser storage
The API pages set no cookies of their own and load no analytics or advertising trackers. The documentation page uses browser session storage for the "Try it" console key, as described above. Stripe Checkout and the Stripe customer portal set Stripe's own cookies when you use them; see Stripe's cookie policy for those.
10.Children
The API is a developer service and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their data, email us and we will delete it.
11.Changes to this policy
When we change this policy we update the version and date at the top. If a change materially affects how we use your data, we email the address on your key at least 30 days before it takes effect.
12.Contact
Privacy questions and requests: geoidlife@gmail.com. GeoidLife, Los Angeles, California, USA.