Privacy Policy

Last updated: 2026-07-29 Effective: 2026-07-29

This Privacy Policy explains what personal information SeafloorSpeciesmapper LLC ("we", "us", "our") collects when you use the SeafloorSpeciesmapper platform ("Service"), how we use it, who we share it with, and the rights you have over it. If you have questions, email us at [email protected].

We designed the Service to collect as little personal data as possible. If a piece of information isn't essential for delivering the Service, we don't ask for it.

1. What we collect

Account information. When you create an account we collect your email address, your chosen display name, and a hashed password (we never store your password in plain text — we hash it with argon2id).

Usage information. We record which scoring runs you submit, which species packs you use, which regulatory overlays you toggle, and what files you upload. This is essential for delivering the Service and for billing you correctly under the Pay-per-use tier.

Survey and observation data. Customer Data you upload (survey CSV files, ground-truth observations, environmental data) is stored on our infrastructure so we can process your runs and re-run them at your request. This data belongs to you — see the Terms of Service, section 8.

Payment information. Payments are processed by Paddle.com Market Ltd. ("Paddle"), our Merchant of Record. We never receive or store your full card number or bank details; Paddle gives us a customer ID and a payment status.

Technical logs. Our servers log the IP address that made each request, the request path, the response status, and the response time. Logs are retained for 30 days and used only for debugging and abuse prevention.

Cookies. The web application uses one first-party cookie to keep you signed in (a JWT token stored in localStorage, not a traditional cookie). We do not use third-party analytics or advertising cookies. No Google Analytics. No Facebook Pixel. Nothing.

2. How we use your information

We use the information above only to:

• Deliver the Service (run your scoring jobs, store your files, show you your results).
• Bill you correctly and process refunds where applicable.
• Send transactional emails (verification, password resets, run-complete notifications, invoices).
• Debug problems and detect abuse.
• Comply with legal obligations.

We do NOT use your data to train machine learning models unless you explicitly opt in via the EULA §8 "contribute to model improvement" toggle. Opting in is off by default.

We do NOT sell your data. Ever. There is no arrangement under which we could sell your data even if we wanted to — it's not in our terms with Paddle, and we have no advertising partnerships.

3. Who we share it with

We share limited information with a small number of infrastructure providers ("sub-processors") who help us deliver the Service:

• Paddle.com Market Ltd. (payment processing, tax remittance).
• Amazon Web Services or Fly.io (compute + storage for the Service — the exact provider depends on where your organisation is located).
• Supabase (managed PostgreSQL database).
• Cloudflare (DNS, CDN, DDoS protection).
• Resend (transactional email delivery).
• Proton Mail (our human-authored email inbox).

Each sub-processor is bound by a data-processing agreement that restricts what they can do with your data.

We may also share information if legally required (subpoena, court order, tax audit) or to protect our rights or the rights of others. Where we can, we notify you first.

4. Where your data lives

Our default region for storage and compute is US-East (Virginia). If your organisation requires EU data residency, contact us at [email protected] — Enterprise contracts can specify EU-West storage.

5. How long we keep your data

• Account data: for as long as your account is active, plus 90 days after cancellation.
• Survey and observation files: for as long as you keep them uploaded. You can delete any file from the dashboard at any time.
• Run history and audit logs: for the duration of your subscription, plus 30 days.
• Billing records: 7 years, as required by US tax law.
• Transactional email logs: 90 days.

You can request full deletion of everything associated with your account by emailing [email protected]. We complete deletion within 30 days.

6. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access. Request a copy of all personal data we hold on you.
• Rectification. Correct inaccurate data.
• Erasure. Ask us to delete your data ("right to be forgotten").
• Portability. Receive your data in a machine-readable format.
• Objection. Object to certain kinds of processing.
• Withdrawal of consent. Withdraw any consent you've given us (e.g. the model-improvement opt-in).

To exercise any of these rights, email [email protected]. We respond within 30 days.

If you're in the EU or UK, you also have the right to complain to your local data protection authority.

7. Data protection roles

Controller. For account and billing data, SeafloorSpeciesmapper LLC is the data controller.

Processor. For survey and observation data you upload, we act as a data processor on your behalf. If your uploaded data contains personal information about third parties (e.g. researcher names in a survey log), you are responsible for having a lawful basis to share it with us. See our Data Processing Addendum for the full terms of this relationship.

8. Security

We hash passwords with argon2id, encrypt data in transit using TLS 1.3, and encrypt data at rest using AES-256. Access to production systems is limited to the company's sole member and is protected by MFA. We do not currently hold a SOC 2 attestation but plan to pursue Type I in year two. See the Security page for our current controls.

9. Children

The Service is not intended for and not directed at anyone under 18. We do not knowingly collect information from minors.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the dashboard and by email to your account address, with at least 30 days' notice. Continued use of the Service after the effective date means you accept the updated policy.

11. Contact

SeafloorSpeciesmapper LLC Attn: Privacy 30 N Gould St, Suite R, Sheridan, WY 82801, United States [email protected]

For EU / UK data subject requests, our representative is: (to be appointed if we cross the threshold — as a solo-founder US LLC we do not currently trigger the Article 27 requirement for a UK/EU representative, but will update this section if we do).