PRIVACY POLICY

1. Information We Collect

1.1 Personal Information

We collect the following categories of personal information:

• Account Information: Email address, name, password (hashed), avatar/profile picture, authentication provider details (Google OAuth ID if applicable)
• Subscription Information: Subscription tier (Free, Starter, Pro, Enterprise), payment method details (processed by third-party payment processors), billing address, transaction history
• Usage Data: IP address, browser type and version, device information, operating system, access times and dates, pages viewed, features used, actions performed within the Service
• Communication Data: Messages sent through the Service, support requests, feedback, collaboration reviews and ratings

1.2 Technical Data and Point Cloud Files

• Point Cloud Data: LAZ, LAS, and other 3D point cloud files uploaded by users, including metadata such as coordinate systems, classification data, RGB values, and intensity information
• Project Data: Project names, descriptions, version histories, measurement annotations, vector layers, analysis results
• Cookies and Similar Technologies: Session cookies for authentication, preference cookies for user settings, analytics cookies to understand Service usage patterns

1.3 Information from Third Parties

• Authentication Providers: When you sign in with Google OAuth, we receive your email address, name, and profile picture from Google
• Payment Processors: Transaction confirmation data from our payment processing partners (we do not store full credit card numbers)

2. Legal Basis for Processing (GDPR)

We process personal information on the following legal bases under GDPR Article 6:

Processing Purpose	Legal Basis
Account creation and management	Performance of contract (GDPR Art. 6(1)(b))
Providing the Service and its features	Performance of contract (GDPR Art. 6(1)(b))
Processing payments and subscriptions	Performance of contract (GDPR Art. 6(1)(b))
Improving the Service and analytics	Legitimate interests (GDPR Art. 6(1)(f))
Compliance with legal obligations	Legal obligation (GDPR Art. 6(1)(c))
Marketing communications (optional)	Consent (GDPR Art. 6(1)(a))

3. How We Use Your Information

3.1 Service Provision

• Create and manage user accounts
• Process and display point cloud data
• Enable project creation, versioning, and collaboration features
• Store and serve converted point cloud files
• Generate measurement tools and analysis results
• Facilitate team collaboration and project sharing

3.2 Service Improvement

• Analyze usage patterns to improve user experience
• Identify and fix technical issues
• Develop new features based on user behavior
• Optimize performance and loading times

3.3 Communication

• Send transactional emails (account verification, password resets, upload notifications)
• Provide customer support
• Notify users of Service changes or updates
• Send subscription renewal reminders

3.4 Security and Compliance

• Detect and prevent fraud, abuse, and security threats
• Enforce our Terms of Service and Acceptable Use Policy
• Comply with legal obligations and respond to lawful requests
• Maintain audit logs for security purposes

4. Data Sharing and Disclosure

4.1 Third-Party Service Providers

We share personal information with the following categories of service providers who process data on our behalf:

• Authentication Services: Supabase (database and authentication infrastructure)
• Cloud Storage: Cloudflare R2 (point cloud file storage)
• AI Services: OpenAI (AI-powered topography analysis features)
• Payment Processing: Third-party payment processors (to be implemented)
• Infrastructure Providers: Hosting and content delivery services

All service providers are bound by data protection agreements and are prohibited from using personal information for purposes other than providing services to us.

4.2 Collaboration and Sharing

• When you invite collaborators to a project, we share your name, email, and project data with those collaborators
• When you share a public link to a version, anyone with the link can view the associated point cloud data and measurements (read-only)
• Collaboration reviews and ratings are visible to other users as part of your public profile

4.3 Legal Requirements

We may disclose personal information if required by law, court order, or governmental authority, or if necessary to comply with legal processes, enforce our Terms of Service, protect the rights, property, or safety of Viizor, our users, or the public, or detect, prevent, or address fraud, security, or technical issues.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal information may be transferred to the acquiring entity. We will notify users via email and/or prominent notice on the Service prior to such transfer.

5. Data Retention

Data Category	Retention Period
Account information	Duration of account + 30 days after deletion
Point cloud files and projects	Duration of account + 30 days after deletion
Payment and billing records	7 years (legal requirement)
Usage and analytics data	24 months
Support communications	3 years
Collaboration reviews	Permanent (anonymized after account deletion)
Security logs	12 months

We retain personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

6. Your Rights

6.1 GDPR Rights (EU/EEA Users)

Under the GDPR, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal information we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal information
• Right to Erasure (Art. 17): Request deletion of your personal information ("right to be forgotten")
• Right to Restriction (Art. 18): Request limitation of processing of your personal information
• Right to Data Portability (Art. 20): Receive your personal information in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent for processing at any time (where consent is the legal basis)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

6.2 CCPA Rights (California Residents)

Under the CCPA, California residents have the following rights:

• Right to Know: Request disclosure of categories and specific pieces of personal information collected in the last 12 months
• Right to Delete: Request deletion of personal information collected from you
• Right to Opt-Out: Opt-out of sale of personal information (Note: Viizor does not sell personal information)
• Right to Non-Discrimination: Exercise your rights without discriminatory treatment

6.3 Exercising Your Rights

To exercise any of the above rights, please contact us at: support@viizor.app

We will respond to your request within 30 days for GDPR requests or 45 days for CCPA requests (may be extended by 45 days with notice). We may require verification of your identity before processing requests.

7. Data Security

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction:

Technical Measures:

• Encryption of data in transit using TLS/SSL (HTTPS)
• Encryption of sensitive data at rest
• Secure password hashing using industry-standard algorithms
• Regular security audits and vulnerability assessments
• Firewall and intrusion detection systems
• Access controls and authentication mechanisms (JWT tokens)

Organizational Measures:

• Restricted access to personal information on a need-to-know basis
• Employee training on data protection and security best practices
• Data protection impact assessments for high-risk processing
• Incident response procedures for data breaches
• Regular review and update of security policies

Data Breach Notification

In the event of a data breach affecting personal information, we will notify affected users and relevant supervisory authorities as required by law (GDPR: within 72 hours; CCPA: without unreasonable delay).

8. International Data Transfers

Your personal information may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country.

When we transfer personal information from the EU/EEA to third countries, we ensure appropriate safeguards are in place: Standard Contractual Clauses (SCCs) approved by the European Commission, Adequacy decisions by the European Commission, or Binding Corporate Rules (where applicable).

9. Cookies and Tracking Technologies

Cookie Type	Purpose	Duration
Strictly Necessary	Authentication, session management, security	Session / 7 days
Functional	User preferences, UI settings, language selection	30 days
Analytics	Usage statistics, performance monitoring	24 months

You can control and delete cookies through your browser settings. However, disabling strictly necessary cookies may affect the functionality of the Service.

10. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without parental consent, we will take steps to delete such information promptly. If you believe we have collected information from a child under 16, please contact us at: support@viizor.app

11. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to such third-party services. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated Privacy Policy on the Service with a new "Last Updated" date, sending email notification to the address associated with your account, or displaying a prominent notice within the Service. Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Contact:
Email: support@viizor.app
Subject Line: Privacy Policy Inquiry

Supervisory Authority:
EU/EEA users have the right to lodge a complaint with their local data protection authority. A list of authorities is available at: https://edpb.europa.eu/about-edpb/board/members_en