Privacy Policy

1. Scope and responsible party

This Privacy Policy applies to the GeoLayers public website, GeoLayers Studio, accounts, cloud projects, subscriptions, support interactions, APIs, developer services, marketplace interactions and other GeoLayers services that link to this policy (collectively, the Services).

For purposes of POPIA, the responsible party is the GeoLayers operator identified in the Legal Centre. In some enterprise or organization workflows, a customer may be the responsible party for personal information contained in that customer's project data and GeoLayers may act as an operator processing that information on the customer's documented instructions.

2. Information we may process

Depending on how you use the Services, GeoLayers may process:

• Account and identity information: name, email address, authentication identifiers, profile details, organization or team membership, role and account status.
• Subscription and transaction information: plan, trial dates, billing status, invoices, payment references and transaction metadata. Where card or similar electronic payments are offered, the applicable payment provider may process payment credentials; do not send full card details through support forms or project fields.
• Project and spatial content: project names, layer metadata, uploaded files, GeoJSON, imagery, attributes, coordinates, analyses, layouts, dashboards, workflow definitions, comments and other content you intentionally store or process in GeoLayers.
• Collaboration information: invitations, collaborator identifiers, project roles, review comments, approval records and sharing settings.
• Developer information: developer app profiles, public collection settings, API key metadata, allowed browser origins, usage counters, webhook endpoints, request logs and related technical settings. Secret credentials are handled separately from ordinary project exports where the platform supports that separation.
• Support and communications: enquiries, support messages, feedback, bug reports and any information you include when contacting GeoLayers.
• Technical and security information: IP address, browser and device information, timestamps, authentication and security events, application errors, performance diagnostics and service logs.
• Website analytics and preference information: page interactions, referral information, approximate location derived from IP where supplied by analytics providers, theme choice, accessibility preferences, onboarding state and similar browser-stored settings.
• Marketplace and content interactions: products viewed or acquired, licence selections, download/access records and support interactions relating to marketplace items.

GeoLayers does not require you to upload special personal information merely to use ordinary GIS functionality. If your project contains health, biometric, criminal, children's, precise-personal-location or other sensitive information, you are responsible for ensuring you have a lawful basis, appropriate permissions and suitable safeguards before uploading or processing it.

3. How information is collected

Information may be collected directly from you when you register, subscribe, upload project data, publish content, create an API integration, contact support or otherwise use the Services. It may also be generated automatically through security, authentication, logging, analytics and platform-operation processes. Organization administrators may provide account or team information when inviting users.

4. Purposes of processing

GeoLayers may process personal information to:

1. create and administer accounts and organizations;
2. authenticate users and protect accounts, projects and infrastructure;
3. provide GIS, GeoAI, storage, collaboration, automation, publishing, API and marketplace functions;
4. save, synchronize, process, render, export and recover project content at the user's request;
5. provide subscriptions, billing administration and customer support;
6. monitor performance, diagnose faults, prevent abuse and improve reliability;
7. communicate service, security, billing and support messages;
8. improve product usability and understand aggregate website/service usage;
9. maintain audit, governance and compliance records;
10. comply with legal obligations, court orders and lawful regulatory requests; and
11. establish, exercise or defend legal rights.

5. Lawful grounds

Where POPIA applies, processing is carried out on one or more grounds permitted by law, including consent where appropriate, performance of a contract, compliance with legal obligations, protection of legitimate interests of a data subject, or pursuit of legitimate interests of GeoLayers or a third party where those interests are not overridden by the data subject's rights.

Where consent is the basis for a particular activity, you may withdraw consent subject to legal and technical limitations and without affecting processing that was lawful before withdrawal.

6. Project data and user content

Private project content does not become public merely because it is stored in GeoLayers. Sharing, publishing, public APIs, public links or marketplace distribution require an intentional user or administrator action.

You retain the rights you hold in your project content. You grant GeoLayers only the limited rights reasonably necessary to host, transmit, transform, back up, render and otherwise process that content to provide, secure and support the Services and to comply with your instructions.

GeoLayers does not claim ownership of customer source datasets solely because they are uploaded to the platform. Third-party datasets remain subject to their own licences and restrictions.

7. GeoAI and automated processing

GeoAI and GeoML features may analyse project inputs to generate suggestions, classifications, predictions, summaries or workflow assistance. Such outputs are decision-support materials and may be incomplete or inaccurate. GeoLayers does not intend ordinary platform functions to make legally binding or similarly significant decisions about an individual solely by automated means without human involvement. Customers remain responsible for the way they use AI-generated outputs in their own decisions.

See the Responsible GeoAI Notice for additional safeguards and limitations.

8. Service providers and operators

GeoLayers may use carefully selected service providers to operate the Services. Depending on the deployed configuration, these may include:

• Supabase for authentication, PostgreSQL/PostGIS database functions, file storage, realtime services and related backend infrastructure;
• hosting, CDN and infrastructure providers for delivery, availability, monitoring and security;
• Google Analytics or similar analytics services for public-site measurement;
• Google advertising services on the limited Marketplace, Case Studies, Learning Centre and Resources pages where advertising is enabled;
• email, support or communications providers used to send service or support communications; and
• mapping, imagery, data and software providers selected by users or required by a specific feature.

Providers receive only information reasonably required for their role and are subject to applicable contractual, confidentiality and security requirements. The exact provider mix may change as the platform evolves.

9. International transfers

Cloud infrastructure and third-party services may process or store information outside South Africa. Where POPIA applies, GeoLayers seeks to handle cross-border transfers consistently with section 72 of POPIA, including through an adequate law, binding agreement, consent or another permitted basis as applicable.

If an organization requires a specific data-residency arrangement, contact GeoLayers before uploading regulated data.

10. Security

GeoLayers uses reasonable technical and organizational safeguards appropriate to the nature of the service. These may include encrypted transport (HTTPS/TLS), authentication controls, project permissions, separation of public and private data paths, restricted handling of secrets, audit and operational logging, rate limits, security reviews, backups/snapshots and recovery tooling.

No online service can guarantee absolute security. Users are responsible for protecting their credentials, selecting appropriate sharing settings, using secure devices and promptly reporting suspected compromise.

If GeoLayers has reasonable grounds to believe that personal information under its control has been accessed or acquired by an unauthorized person, notification will be handled in accordance with applicable POPIA requirements and any lawful directions of the Information Regulator.

11. Retention

Information is retained for as long as reasonably necessary for the purpose for which it was collected, to provide the Services, maintain security and backups, resolve disputes, meet accounting or legal requirements, and enforce agreements.

Account and project deletion does not necessarily remove all copies immediately; temporary backup, security, audit or transaction records may remain until normal retention cycles expire or longer where required by law. Aggregated or de-identified information that no longer identifies a data subject may be retained for analytics and service improvement.

12. Cookies, analytics and advertising

The public website uses browser storage and may use cookies or similar technologies. Google Analytics is currently used for public-site measurement. Advertising technology is restricted to designated Marketplace, Case Studies, Learning Centre and Resources pages. More information is available in the Cookie Policy.

13. Direct marketing and communications

GeoLayers may send service-related messages necessary to operate an account or subscription. Promotional messages will be sent only where permitted by applicable law. You may opt out of promotional electronic communications using the unsubscribe mechanism where available or by contacting GeoLayers. Opting out of marketing does not prevent essential account, billing, security or service messages.

14. Your POPIA rights

Subject to applicable law and verification of your identity, you may request:

• confirmation of whether GeoLayers holds personal information about you;
• access to your personal information;
• correction or updating of inaccurate information;
• deletion or destruction where permitted by law;
• objection to certain processing;
• withdrawal of consent where processing is based on consent; and
• information about third parties or categories of third parties that have had access to your personal information where POPIA provides that right.

Requests should be sent to info@geolayers.co.za with the subject Privacy / POPIA Request. GeoLayers may request information reasonably necessary to verify the requester and locate the relevant records.

You may also lodge a complaint with the Information Regulator (South Africa). Current contact information is available at inforegulator.org.za; the Regulator currently publishes enquiries at enquiries@inforegulator.org.za and 010 023 5200.

15. PAIA access requests

Formal requests for records under PAIA are handled under the GeoLayers PAIA Manual. A request for access to your own personal information may also engage POPIA rights.

16. Children's information

GeoLayers is designed primarily for professional, organizational, research and higher-education use. Where a user processes information about a child, the user or relevant organization is responsible for ensuring that such processing is legally authorized and appropriately safeguarded. GeoLayers should not be used to create public profiles of children or publish sensitive child information without lawful authority.

17. Third-party websites and data services

The Services may link to or retrieve information from external websites, basemaps, imagery services, data portals, APIs and libraries. Those third parties have their own privacy practices. GeoLayers is not responsible for a third party's handling of information outside GeoLayers' control.

18. Changes to this policy

GeoLayers may update this policy to reflect legal, technical or service changes. Material changes will be communicated through the website, account interface, email or another reasonable channel where appropriate. The effective date at the top of the page identifies the current version.

19. Contact

Privacy and POPIA enquiries: info@geolayers.co.za
Telephone: +27 74 379 6476
Location: Johannesburg, South Africa