Privacy & Cookie Policy

1. Information We Collect

The DataGarden is a trading name of Bossare B.V., Teding van Berkhoutlaan 17, 2111 ZA Aerdenhout, the Netherlands (Dutch Chamber of Commerce number 34338943). Bossare B.V. is the controller of the personal data described in this policy. We collect only what we need to provide the Services.

Your account

When you create an account we store your name, your email address and, if your sign-in provider supplies one, your profile picture. You can sign up with an email address and password, or with your Google or GitHub account. If you use Google or GitHub, that provider tells us your name, email address and profile picture; we do not receive your password for that account and we ask for no other access to it. Section 4 describes what we do with the data Google provides.

What you add to the Services

We store what you create while using the Services, such as projects, saved filters, lists of locations you upload and API keys you issue, together with the account they belong to.

Purchases

When you buy access, our payment provider Stripe collects your payment details. We never see or store your full card or bank details. We keep a record of each order: what you bought, the amount, the billing name, address and email address Stripe passes to us, and the period of access.

Mailing list and demo requests

If you sign up for updates or request a demo, we store your email address and any details you enter in the form, and which form you used.

Technical data

When you use the Services, our servers record technical data such as your IP address, the pages and API calls requested, and the time of each request. We use this to run, secure and troubleshoot the Services and to apply usage limits. We do not use analytics or advertising tools, and we do not build profiles of how you browse.

2. How We Use Your Information

• To provide the Services: to create your account, sign you in, keep your projects and settings, and give you the access you bought. The legal basis is the performance of our contract with you.
• To process payments: to take payment, issue receipts and meet our accounting and tax obligations. The legal basis is our contract with you and our legal obligations.
• To communicate: to answer your questions, send messages about your account or orders, and — only if you signed up for them — send product updates. You can unsubscribe from updates at any time using the link in each email. The legal basis is our contract with you or, for updates, your consent.
• To keep the Services secure: to prevent abuse, apply usage limits and fix faults. The legal basis is our legitimate interest in running a secure, reliable service.

We do not sell your personal data, and we do not use it for advertising.

3. Cookies

What Are Cookies?

Cookies are small text files stored on your device (computer, tablet, or mobile) by websites you visit. They are widely used to make websites work and to provide basic functions. Cookies can also be used to remember preferences or for tracking, but we do not use any tracking cookies.

Types of Cookies We Use

We only use cookies that are necessary for the Services to work. They are set by Clerk, the service that handles signing in for us, and they keep you signed in securely:

• __session: a short-lived token that proves you are signed in. It is renewed automatically while you use the Services.
• __client_uat: records when you last signed in or out, so the Services can tell whether your session is still valid.
• __client: set on our sign-in domain, clerk.the-datagarden.io; it identifies your signed-in browser to Clerk.

Clerk may add a suffix to these names (for example __session_ followed by a short code). We do not set any other cookies. The Services also keep a few display preferences, such as which map layers you hid, in your browser's local storage; these never leave your device.

No Tracking or Analytics Cookies

We do not use any tracking or analytics cookies, including third-party services such as Google Analytics or similar products, to monitor your browsing behavior. We do not collect data to build profiles or track your activity.

Your Cookie Choices

Since we only use cookies that are necessary for the Services to work, we do not ask for consent to store them. You can manage or delete cookies in your browser settings. If you block them, you will not be able to sign in.

4. Sign in with Google

If you sign in with Google, Google shares your name, email address and profile picture with us, after you agree to this on Google's sign-in screen. We use this information only to create your account, sign you in and show your name and picture in your account menu. We do not request access to your Gmail, contacts, files, calendar or any other Google data.

The DataGarden's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information, use it for advertising, or transfer it to anyone except the service providers in section 5 who help us provide the Services. No one at The DataGarden reads it unless you ask us to, it is needed for security or to comply with the law.

You can remove The DataGarden's access to your Google account at any time at myaccount.google.com/connections. To delete the account you have with us, see section 8.

5. Who We Share It With

We share personal data only with service providers that process it on our behalf and under our instructions, to the extent each one needs:

• Clerk: sign-in and account management (name, email address, profile picture, sign-in details, cookies).
• Stripe: payment processing (payment and billing details).
• Brevo: sending email and managing our mailing lists (email address, the lists you joined).
• Railway: hosting of our servers and databases (all data held by the Services).
• CARTO: the map backgrounds shown in the Services. Your browser loads them directly from CARTO, which therefore receives your IP address.
• Google and GitHub: only if you choose to sign in with them, as described above.

Some of these providers are located in, or process data in, the United States. Where personal data is transferred outside the European Economic Area, this happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. We may also disclose personal data if the law requires it.

6. How Long We Keep It

• Account data and what you added to the Services: for as long as you have an account. After you ask us to delete your account, we delete it within 30 days.
• Order records: seven years, as required by Dutch tax law.
• Mailing list and demo requests: until you unsubscribe or ask us to delete them.
• Technical data in server logs: no longer than 90 days, unless we need it longer to investigate a specific security incident.

7. Data Security

We protect your data with appropriate technical and organisational measures: all traffic is encrypted, access to our systems is limited to the people who need it, and passwords are handled by Clerk and never stored by us. However, no electronic transmission or storage method is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Under the General Data Protection Regulation you have the right to access, correct or delete your personal data, to restrict or object to its processing, to receive it in a portable format, and to withdraw any consent you gave. To exercise these rights, including to delete your account, email us at info@the-datagarden.io from the email address on your account. We respond within one month.

If you believe we handle your data unlawfully, you can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Policy Updates

We may update this policy, including how we use cookies, to reflect changes in the Services or for legal reasons. The effective date at the top shows when it last changed. If we make significant changes, we will notify you by email (if you have an account or have given us your address) or by a notice on the Website.

10. Contact Information

If you have any questions about this policy or about how we handle your data, contact us at info@the-datagarden.io, or write to Bossare B.V., Teding van Berkhoutlaan 17, 2111 ZA Aerdenhout, the Netherlands.