Privacy Policy

1) Who Is Responsible?

Data controller: 17449275 Canada Inc., Manitoba, Canada.

Privacy inquiries: For any privacy-related question or request (access, correction, deletion, complaint), please use the contact form on the Site and select “Privacy” as the topic. We do not publish a public email address to reduce spam. We will acknowledge privacy requests within ten (10) business days.

2) What We Collect

A) Information you provide directly

• Account & access data: username, display name, email address, password (hashed—we cannot view it), and similar identifiers you choose to provide when registering for any of our products.
• Purchase data (via Stripe): when you purchase directly through the Site, payments are processed by Stripe, Inc. We receive your name, email, subscription plan, and payment status (e.g., active, cancelled, past-due). We never see, collect, or store your credit card number, CVV, or other sensitive payment-card data. Stripe’s handling of your payment information is governed by Stripe’s Privacy Policy.
• Purchase/entitlement data (via Resellers): when a licence is sold through a third-party merchant of record (a “Reseller”), they may share limited details so we can provision access (e.g., your name, email, plan/seat, licence status, and dates). We do not receive your full payment card details from Resellers.
• Support messages: content you submit through the Site’s contact form, including name, email, and message body.
• Promo codes: if you enter a promotional code at checkout, we record the code used and the associated discount. Promo codes do not contain personal information.

B) Technical & usage data (automatically collected)

• Device & network data: IP address, browser type/version, operating system, screen resolution, device type (desktop/mobile/tablet), and language preference.
• Usage data: referring/exit pages, timestamps, page views, feature usage, session duration, and interactions with specific tools.
• Cookies & local storage: small files or browser storage entries used to keep you signed in, remember settings, and (if enabled) run analytics. See Section 5 for full details.

C) Geospatial data that stays local to your browser

• Field boundaries: geometry you draw or load in browser-based tools is processed and stored only within your current browser session (e.g., memory/local storage) and is not uploaded to our servers unless you explicitly submit it for processing or export. Closing your tab, clearing browser data, or changing devices may permanently delete locally held data. We cannot recover it.

D) Files you upload to our servers

• Geospatial file uploads: you may upload digital elevation models (“DEMs”), field boundary shapefiles, and other geospatial data files as required by the specific product for processing. See Section 6 for how we handle, retain, and delete these files.

E) Information we do NOT collect

• We do not collect precise GPS location from your device.
• We do not collect biometric data.
• We do not collect data from social media profiles.
• We do not purchase data about you from data brokers.

3) Why We Collect It (Purposes)

• Provide the Services: authenticate you, render maps and analytics, create variable-rate management zones, process terrain and satellite data, generate prescriptions, deliver drainage mapping layers, compute precipitation analytics, and operate core features across all GIS4AG products.
• Account & entitlement management: verify and manage your plan/licence, process renewals, apply promo codes, and reconcile entitlements (including those purchased via a Reseller or directly through Stripe).
• Transactional communications: send account confirmations, subscription receipts, renewal notices, password resets, and service-critical alerts. These are not marketing and cannot be opted out of while you hold an active account.
• Support & operations: respond to contact-form requests, diagnose issues, monitor for abuse/fraud, maintain security, and generate operational audit logs.
• Analytics & improvement (optional): understand feature usage to improve performance, reliability, and usability. See Section 5 for opt-out options.
• Aggregated & anonymized insights: we may aggregate or anonymize data so that it no longer identifies you, and use it for product development, benchmarking, and service improvement. Aggregated data is not personal information.
• Legal & compliance: meet legal obligations, enforce our Terms of Service, and respond to lawful requests from authorities.

4) Legal Basis for Processing

We rely on the following legal bases depending on the type of data and purpose:

• Performance of a contract: processing necessary to provide the Services you requested—account creation, zone generation, file processing, licence provisioning, and delivering subscription features.
• Consent: for non-essential cookies and analytics. You may withdraw consent at any time (see Section 5); withdrawal does not affect the lawfulness of processing before withdrawal.
• Legitimate interests: security monitoring, fraud prevention, service diagnostics, error logging, and product improvement—where these interests are not overridden by your rights.
• Legal obligation: where we are required to retain or disclose information under applicable law.

PIPEDA (Canada). We comply with Canada’s Personal Information Protection and Electronic Documents Act. You may withdraw consent for non-essential processing at any time by contacting us or adjusting your browser settings; however, withdrawing consent for essential processing may mean we can no longer provide the Services to you.

Users outside Canada. If you access the Services from outside Canada, your information will be transferred to and processed in Canada (and potentially the United States or other jurisdictions where our service providers operate). By using the Services, you consent to this transfer. If you are located in a jurisdiction with specific privacy legislation (e.g., GDPR, CCPA/CPRA, POPIA), see Section 12 for additional rights that may apply to you.

5) Cookies, Local Storage & Tracking Technologies

Types of cookies we use

• Strictly necessary (essential): required for authentication, session management, security (e.g., CSRF protection), and core tool functionality. These cannot be disabled without breaking the Services.
• Functional: remember your preferences, settings, and display options (e.g., last-used tool, map view state). These improve your experience but are not required.
• Analytics (if enabled): we may use privacy-respecting analytics tools (e.g., Google Analytics or similar) to measure traffic, understand feature usage, and improve the Services. Analytics cookies collect aggregated, non-identifying data. If Google Analytics is used, Google’s data practices are governed by Google’s Privacy Policy.

Local storage & session storage

Some tools use your browser’s local storage or session storage (not cookies) to hold temporary data such as field boundaries, map state, or tool settings. This data is stored only on your device and is not transmitted to our servers unless you explicitly submit it.

How to control cookies

You can block or delete cookies through your browser settings. Most browsers allow you to: (a) see what cookies are set; (b) block third-party cookies; (c) block all cookies; (d) clear cookies when you close the browser. Note: blocking essential cookies may prevent login and core functionality. Blocking analytics cookies will not affect your access to the Services.

“Do Not Track” signals

There is no industry-standard interpretation for “Do Not Track” (DNT) browser signals. We do not currently respond to DNT signals, but we limit tracking to what is described in this Policy.

6) File Uploads, Satellite Data & Server-Side Processing

A) Files you upload

Purpose-limited licence. By uploading a file (DEM, shapefile, or other geospatial data), you instruct and grant us a non-exclusive, royalty-free licence to host, process, cache, transform, and temporarily store the file solely to provide the Services you requested (e.g., analytics layers, zone maps, drainage mapping). No other uses are permitted—no resale, publication, model training, or promotional use of your uploaded data.

Retention. Uploaded files are stored on our servers only for the duration of processing and for up to two (2) hours thereafter, then scheduled for deletion via automated rolling jobs.

No backups. We do not keep backups of user-uploaded files. Minimal operational metadata (timestamps, file size, processing status, error codes) may be retained for diagnostics; this metadata does not include your file content.

No human review by default. Uploaded file content is not reviewed by a human unless: (a) you request support that requires it; (b) we must investigate abuse, security incidents, or processing errors; or (c) required by law.

B) Satellite data retrieved on your behalf

When you submit a field boundary for zone generation in TerraZoner™, our servers retrieve and process publicly available satellite imagery (e.g., Copernicus Sentinel-2 NDVI composites) on your behalf. This imagery is sourced from public APIs, is not personal data, and is not stored beyond the processing session. Zone outputs you generate are yours; we retain no copies after your session or export, except for minimal operational metadata.

C) Drain-IQ™ portal data

If you use the Drain-IQ™ service, we host processed elevation and drainage map layers on a custom portal for your viewing. These layers are derived from data you provide or that we collect on your behalf as part of the done-for-you service. Portal access data (login timestamps, map views) is logged for security and support purposes. Processed map layers are retained for the duration of your service agreement and a reasonable wind-down period thereafter.

7) Third-Party Data Sources (Not Your Personal Data)

The Services access or visualize public and licensed data sources to deliver functionality. These are not personal information:

• USGS 3DEP (United States): public-domain elevation data.
• NRCan HRDEM (Canada): elevation data under the Open Government Licence—Canada.
• Copernicus/Sentinel-2: publicly available satellite imagery used for NDVI composites and zone generation in TerraZoner™.
• Weather data APIs: publicly available or licensed meteorological data used by Rain Odds™ for precipitation analytics.

These data sources are provided by governments or public agencies; their availability, licensing, and terms may change without notice and are outside our control.

8) Disclosure to Third Parties

We may share limited personal information only in the following circumstances:

• Service providers (processors): hosting/CDN providers, error-logging services, analytics platforms (if enabled), authentication services, payment processors (Stripe), and email/contact infrastructure. These providers process data on our behalf, under contract, and only for the purposes we specify.
• Stripe (payment processor): Stripe processes your payment and receives your name, email, and payment-card data directly. We do not see or store card numbers. Stripe may use your data as described in Stripe’s Privacy Policy.
• Resellers / merchants of record: for purchases through a Reseller, we receive entitlement data from them and may share minimal technical information to resolve provisioning issues. We do not control Reseller privacy practices—consult their policies.
• Legal and safety: if required by law, court order, subpoena, or regulatory request; or to protect the rights, safety, or property of us, our users, or the public.
• Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, personal information may be transferred to the successor entity to allow continuity of service. We will notify you (via the Site or email) of any such transfer before your data is subject to a materially different privacy policy.

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes.

8A) Cross-Product Data Sharing

Because GIS4AG™, TerraZoner™, Geo-Surface™, Drain-IQ™, and Rain Odds™ are all operated by 17449275 Canada Inc., your account information (name, email, subscription status) may be shared across products to: (a) provide single sign-on or unified account management where available; (b) verify your entitlements across products; and (c) provide customer support. Your uploaded files, geospatial data, and tool outputs are not shared between products unless you explicitly request it.

9) International Data Transfers

We are based in Manitoba, Canada. Our servers, CDNs, and service providers may be located in Canada, the United States, or other jurisdictions. Your personal information may therefore be transferred to, stored in, and processed in countries other than your own.

We use reasonable contractual and technical safeguards to protect personal information during international transfers, including data-processing agreements with service providers. By using the Services, you acknowledge and consent to these transfers.

10) Security

We implement reasonable technical and organisational safeguards appropriate for a small-team service, including:

• TLS/HTTPS encryption for all data in transit
• Password hashing (we cannot view your password)
• Access controls limiting who can access personal data
• Automated rolling deletion of uploaded files (per Section 6)
• Hardened server configurations and regular security updates

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately via the contact form.

10A) Data Breach Notification

In the event of a security breach that results in unauthorized access to, or disclosure of, your personal information, we will:

• Investigate and take steps to contain and remediate the breach.
• Notify affected users without unreasonable delay, and in any event within seventy-two (72) hours of becoming aware of a breach that is likely to result in a real risk of significant harm.
• Report to the Office of the Privacy Commissioner of Canada and any other applicable regulatory authority as required by law.
• Provide you with information about what happened, what data was affected, and what steps you can take to protect yourself.

11) Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

• Account & entitlement data: retained while you have an active account or licence, plus up to twenty-four (24) months after cancellation or expiry for security, fraud prevention, auditing, and legal obligations.
• Transaction records: billing and payment records (excluding card numbers, which we never hold) are retained for seven (7) years for accounting and tax compliance.
• Support messages: retained for up to thirty-six (36) months after the last interaction, then deleted.
• Server logs & operational metadata: retained for up to twelve (12) months for security, diagnostics, and abuse detection.
• Analytics data: aggregated analytics are retained indefinitely; individual-level analytics data (if any) is retained for up to twenty-four (24) months.
• Uploaded files (DEMs, shapefiles): per Section 6—deleted within approximately two (2) hours of processing completion. No backups.
• Drain-IQ portal layers: retained for the duration of your service agreement plus a reasonable wind-down period (typically ninety (90) days), then deleted.

When retention periods expire, data is deleted or anonymized. Anonymized data (which cannot identify you) may be retained indefinitely.

12) Your Rights & Choices

A) Rights for all users

Subject to applicable law, you may:

• Access: request a copy of the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete personal information.
• Deletion: request deletion of personal information where it is no longer required for the purposes described in this Policy. Note: operational logs and legal/tax records may be retained as permitted by law; uploaded files follow the automatic 2-hour deletion schedule in Section 6.
• Withdraw consent: for non-essential cookies and analytics, via browser settings or Site controls (if provided). For other consent-based processing, contact us.
• Marketing opt-out: unsubscribe from any marketing communications using the unsubscribe link provided in the email. Transactional emails (account confirmations, renewal notices) are not marketing and cannot be opted out of while your account is active.
• Data portability: request your personal information in a commonly used, machine-readable format (e.g., CSV or JSON) where technically feasible.
• Complain: you may contact us via the contact form. You may also file a complaint with the Office of the Privacy Commissioner of Canada or your applicable provincial or national privacy regulator.

B) Additional rights for EU/EEA users (GDPR)

If you are located in the European Union or European Economic Area, you may also have the right to: (a) restrict processing of your personal information in certain circumstances; (b) object to processing based on legitimate interests; and (c) lodge a complaint with your local data protection authority.

C) Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know what personal information we collect, use, and disclose; (b) request deletion of your personal information; (c) opt out of the “sale” or “sharing” of personal information (we do not sell or share personal information for cross-context behavioral advertising); and (d) not be discriminated against for exercising your rights. To exercise these rights, contact us via the contact form.

D) How to exercise your rights

Submit a request via the contact form and select “Privacy” as the topic. We will verify your identity before processing your request and respond within thirty (30) days (or sooner if required by applicable law). If we need additional time, we will notify you.

13) Children’s Privacy

The Services are designed for professional agricultural use and are not directed to children or minors under the age of majority in their jurisdiction. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately and we will delete it.

14) Third-Party Purchases (Resellers)

If you purchase a licence through a Reseller (marketplace, app store, channel partner), they are the merchant of record. Your payment data is processed under their privacy policies, not ours. They may share limited entitlement information with us (name, email, licence status) for provisioning purposes. For billing, refunds, chargebacks, and invoices, contact the Reseller directly. We are not responsible for a Reseller’s data practices.

15) Automated Processing & Profiling

Some features use algorithmic processing to produce heuristic outputs, including:

• Zone generation from satellite NDVI composites (TerraZoner™)
• Terrain classification from LiDAR-derived elevation models
• Dual-layer productivity-by-wetness matrix classification
• Drainage flow-route and cut/fill analysis (Geo-Surface™)
• Precipitation probability analytics (Rain Odds™)

These outputs are suggestive, do not constitute profiling of individuals, and do not produce legal or similarly significant effects on you. They are tools for agricultural decision-making and require professional review. We do not make automated decisions about your account access or pricing based on profiling.

16) Third-Party Links

The Site may contain links to third-party websites, services, or resources (e.g., Stripe, government data portals, agricultural references). We are not responsible for the privacy practices, content, or security of third-party sites. We encourage you to review the privacy policies of any third-party site you visit. A link does not imply endorsement.

17) Email Communications

Transactional emails: We send account-related emails (registration confirmation, password reset, subscription receipts, renewal reminders, and service alerts). These are necessary for the operation of your account and cannot be opted out of while your account is active.

Marketing emails (if any): If we send promotional or marketing emails in the future, they will include a clear unsubscribe mechanism. You can opt out at any time; we will honour your preference within ten (10) business days.

No spam. We do not send unsolicited emails, and we do not share your email address with third parties for their marketing purposes.

18) Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will: (a) post the updated Policy on this page with a new Effective Date; and (b) where practicable, notify you via the Site or by email. Your continued use of the Services after the updated Effective Date constitutes acceptance of the revised Policy. If you disagree with any changes, your remedy is to stop using the Services and request deletion of your data per Section 12.

19) Governing Law

This Privacy Policy is governed by the laws of the Province of Manitoba, Canada, and the federal laws of Canada applicable therein, including PIPEDA. Any disputes arising under this Policy are subject to the exclusive jurisdiction of the courts of Manitoba, Canada.

20) How to Contact Us

For privacy questions, data requests, or complaints, please use the contact form on the Site and select “Privacy” as the topic.

Data controller: 17449275 Canada Inc., Manitoba, Canada.

We will acknowledge your request within ten (10) business days and provide a substantive response within thirty (30) days. If we require additional time, we will notify you of the reason and expected timeline.