Privacy Policy

1. Who we are

Nature's Radar LLP (company number: OC455096) is the data controller for the personal data processed through Georaf. Our registered address is 71-75 Shelton Street, Covent Garden, WC2H 9JQ London, United Kingdom.

For privacy inquiries: [email protected]

Georaf is provided from the United Kingdom and is subject to the UK GDPR and the Data Protection Act 2018. Where you're located in the EU or EEA, the EU GDPR also applies to our processing of your personal data.

2. What we collect

We do not access, analyse, or use the contents of your uploaded geodata files for any purpose other than providing the service to you.

Georaf Landplot (mobile app)

Georaf Landplot runs on your device. It uses precise GPS location (only while the app is open, never in the background) to drop pins and record tracks, accesses the camera and photo library when you choose to attach a photo, and stores your projects, photos, and notes locally. None of this data is transmitted to Nature's Radar LLP servers. Anonymous usage events and crash reports are sent off-device so we can fix bugs. To delete all app data, uninstall the app; for analytics data, email [email protected].

3. Why we process it and our legal basis

4. Who we share data with

We use third-party service providers for infrastructure, hosting, authentication, map rendering, email delivery, and payment processing. These providers only process data on our behalf and under our instructions.

Some providers are based in the United States. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (see Section 5).

A full list of our sub-processors is available on request by contacting [email protected].

We do not sell your personal data. We do not share data with advertisers.

5. International data transfers

Some of our service providers are based in the United States. Where personal data is transferred outside the UK, we rely on:

• UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework) for DPF-certified providers
• Standard Contractual Clauses with the UK International Data Transfer Addendum for other providers

You can request copies of these safeguards by contacting us.

6. How long we keep data

We retain personal data only for as long as necessary to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. Account data and uploaded files remain available while your account is active and are deleted after closure. Technical logs are kept for a short period for security and troubleshooting purposes. Billing records are retained for the duration required by applicable tax law.

7. Your rights

Under UK GDPR, you have the right to:

• Access your personal data (Subject Access Request)
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing while concerns are resolved
• Data portability: receive your data in a commonly used, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time for consent-based processing

To exercise any of these rights, email [email protected]. We'll respond within one month.

8. Cookies and analytics

We use two categories of cookies and local storage:

Strictly necessary (always on, no consent required):

• Authentication cookies: keep you logged in (Supabase)
• Payment cookies: fraud detection during checkout (Stripe)

Product analytics:

• Privacy-friendly usage analytics so we can see which features are used and where people get stuck. Analytics data is processed within the EU.

Public visitors are asked to accept analytics via a cookie banner. Logged-in users have already consented at signup as part of accepting these Terms and Privacy Policy. To change your choice, clear your browser's site data for georaf.com or email [email protected].

We do not use advertising cookies, marketing pixels, or cross-site tracking.

9. Security

We protect your data with:

• Encryption in transit (TLS) and at rest
• Hashed passwords (never stored in plain text)
• Access controls and role-based permissions
• We review our security practices as the product evolves

10. Data breaches

If we become aware of a data breach that poses a risk to your rights, we will:

• Notify the competent supervisory authority within 72 hours, where required by law
• Notify affected users without undue delay if the breach poses a high risk

11. Automated decision-making

We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.

12. Children

Georaf is not directed at children under 18. We do not knowingly collect data from minors. If you believe a child has created an account, contact us and we'll delete it.

13. Complaints

If you're unhappy with how we handle your data, please contact us first at [email protected] so we can try to resolve it. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence.

14. Changes

We may update this policy. We'll post the updated version on this page and update the "last updated" date. Where changes are material, we'll notify you by email.