Privacy policy

The short version

• We process account, company and order data to deliver and invoice maps. Not for tracking, not for ad profiling.
• Data lives with processors in the EU (Supabase in Stockholm, Render in Frankfurt). Payment and sign-in can involve lawful transfers to the US.
• Only strictly necessary cookies, which is why there is no consent banner. See Cookies.
• You can access, correct and delete your data, and complain to Datatilsynet.

1. Who is responsible

GeoAnvil AS, org. no. 938 139 962, is the data controller. Questions go to post@geoanvil.com.

2. What we process

• Account: name, email and sign-in method (email, Google or Microsoft).
• Company (optional): company name, organisation number and the billing details you provide.
• Orders: project name, the area you drew (coordinates), map, amount and status.
• Plugin devices: a device name and last-used time when you sign in from a CAD plugin, so you can see and revoke access from your account page.
• Payment: handled by Stripe. We store a payment reference and the amount, never card numbers.
• Technical: IP address and timestamps in server logs, for security and debugging. Sign-in may use Cloudflare Turnstile to tell people from bots.

3. Why, and on what legal basis

Delivering and invoicing what you order rests on the contract with you (GDPR art. 6(1)(b)). Security and abuse prevention rest on legitimate interest (art. 6(1)(f)). Keeping accounting records rests on legal obligation (art. 6(1)(c), Norwegian bookkeeping law, five years).

4. Who processes it for us

Supabase (database and sign-in, Stockholm), Render (servers, Frankfurt), Stripe (payment), Resend (transactional email) and Cloudflare (network and bot protection). Payment and sign-in providers may transfer data to the US under EU-approved mechanisms.

5. How long we keep it

Account data lives until you delete the account. Order and accounting records are kept five years, as bookkeeping law requires. Server logs rotate on short cycles.

6. Your rights

You can see, correct, export and delete your data. Deleting your account from the account page removes everything except what bookkeeping law forces us to keep, and you are offered an export first. Complaints can go to Datatilsynet, the Norwegian Data Protection Authority.

7. Changes

If this policy changes materially, the change is announced on the site before it takes effect.