Privacy Policy

When you register, we collect your email address, full name, and a hashed password (we never store your password in readable form). We also store the number of airports you told us you serve when you signed up, your subscription tier and usage counters, the airports your account has activated, and a record of the version of our Terms and this policy you accepted, with the time and the IP address it came from. We keep a normalised form of your email address (lower case, with any +tag removed) so that one inbox holds one account.

An email address and a way to sign in are required to have an account. Without them we cannot provide the Service.

If you choose to sign in with Google, Google tells us your Google account identifier, email address and name. We store the identifier and address so we can recognise you next time, and use the name to fill in your profile. We never receive your Google password and request no other access to your Google account. An account created this way has no password until you set one.

Payments are processed by Stripe. We store only your Stripe customer and subscription identifiers, your plan, and your billing status. We do not receive or store full payment card numbers. At checkout Stripe also collects your billing name and address, and a tax ID if you give one, so that tax can be calculated. Those details are held by Stripe; we can see them, your invoices, and the brand, last four digits and expiry date of your card in our Stripe account, and we do not copy them into our own database. Stripe processes your payment details as an independent controller under its own privacy policy.

We automatically collect, in order to run and secure the Service:

• IP address, browser user-agent, and request identifiers;
• server logs of requests to the Service - IP address, time, the address requested and the result;
• timestamps and outcomes of security-relevant events - sign-in, failed sign-in (including the email address that was tried, when it is shaped like one), sign-out, reuse of a sign-in session that had already been replaced, registration, account deletion, changes to a workspace’s members, staff access to an account, billing changes, and deleting or replacing work in a workspace (projects, hotels, zone rules, snapshots, uploads and jobs), and downloading a hotel file (with its size, how much of it is zoned, and whether the account was on its free trial at the time) - retained in an audit log with the IP address and the person who acted;
• API request metadata and usage counts, used to enforce plan quotas and rate limits; and
• diagnostic data from errors, described in Section 2.5.

We also count visits to our public pages (such as the home page, pricing, the manual and these legal pages) and to the sign-in and sign-up pages, with a statistics tool that runs on our own server and sends nothing to anyone else. For each page viewed it records the page, the website that linked to it, any campaign tag in the link, the browser, operating system, device type, screen size and language, and the country, region and city the IP address is registered in. It also counts, without saying whose, that an account was created. It sets no cookie, stores nothing on your device and does not keep your IP address. To tell one visitor from another it uses a keyed hash of the IP address and browser that changes every day, so a visit is not linked to a visit on another day, to an account, or to a name. The pages you use after signing in are not counted, and neither is a browser that sends a Global Privacy Control signal.

We use strictly necessary authentication cookies and browser storage to keep you signed in - until you close your browser, or for 30 days if you choose to stay signed in. We store your settings on your device only if you accept the Cookie Policy. We do not use advertising, marketing, or third-party analytics cookies, and the visit statistics in Section 2.3 use no cookie and no browser storage. Full detail is in the Cookie Policy.

We do not track you across other websites, so the Service does nothing different when your browser sends a “Do Not Track” signal. How we treat Global Privacy Control is described in the Cookie Policy.

If enabled in our production build, we use Sentry to capture application errors. Sentry is configured not to send default personally identifiable information, and we filter authentication tokens, passwords, cookies, and authorization headers out of error reports before transmission. Error reports may still incidentally contain an IP address and technical context about the page where the error occurred.

The property lists you upload typically contain business information - hotel names, street addresses, and coordinates. They are not intended to contain personal data, and we ask that you do not upload personal data beyond business contact details. Where they do contain personal data, we process it only as a processor under the DPA.

An account holder can invite other people to their workspace. To send an invitation we store the email address the inviter enters, the role and any projects they chose, who sent it, and when it was sent, accepted or revoked. We send that address one invitation email, which names the inviter's email address and the role and contains nothing the inviter typed. We do not use an invited address for anything else. An invitation stops working after 7 days if it is not accepted, and the inviter can revoke it sooner. The invitation records are kept with the workspace, including expired and revoked ones, and are deleted when the workspace is deleted. If you received an invitation and want its record deleted, email privacy@groundzones.com.

Everyone in a workspace can see the name, email address and role of its owner and each of its members. The owner and its admins see every project in it and the jobs run there. A member can be given access to only some projects, and then sees only those projects and the jobs run in them. The work you do in a workspace you joined belongs to that workspace. It stays there if you leave, are removed or delete your account, and the jobs you ran there are then reassigned to its owner. If the owner deletes their account, the workspace and everything in it are deleted, and each member is told by email.

If you email us, we receive your email address, your name as your mail program sends it, and whatever you write or attach. Mail to our addresses is forwarded by a forwarding service to a mailbox hosted by Google, and our replies are sent through our email provider; all three are on the Subprocessors page. Please do not send passwords, card numbers or other people's personal data by email.

Our authorised staff can open a customer's account to give support, investigate a problem or protect the Service. Each such session requires a written reason, is view-only unless the ability to make changes is specifically requested, ends by itself after a short time, and is recorded in the audit log with the staff member's identity, as is each change they make and each action refused to them during it. A support session cannot use your billing, change how you sign in, accept terms for you, delete your account or download the export of your data.

We get personal data from you, from a workspace owner or admin who invites you, from Google if you sign in with Google, and from Stripe, which tells us whether a payment succeeded. We do not buy personal data or obtain it from data brokers. We do not collect the location of your device (the area in our visit statistics is looked up from the IP address), and we do not ask for or want special categories of personal data (such as health data or government identifiers).

Under the GDPR and UK GDPR you have the right to:

• access the personal data we hold about you, and get a copy;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict processing in certain circumstances;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interests, including at any time;
• withdraw consent where we rely on it, without affecting prior processing; and
• lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).

We do not carry out automated decision-making that produces legal or similarly significant effects on individuals.

Under the CCPA/CPRA you have the right to:

• know the categories and specific pieces of personal information we collect, the sources, our purposes, and the categories of recipients;
• delete personal information we hold about you, subject to legal exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information - note that we do not sell or share personal information, and have not in the preceding 12 months;
• limit use of sensitive personal information - we do not collect sensitive personal information as defined by the CPRA; and
• not be discriminated against for exercising these rights. We do not offer financial incentives tied to your data.

In the CCPA's terms, in the last 12 months we have collected identifiers (name, email address, IP address), commercial information (plan and subscription history) and internet or network activity (logs and usage of the Service), from the sources in Section 2.10, for the purposes in Section 3, disclosed them to the service providers in Section 5, and kept them for the periods in Section 7. We offer these rights whether or not the CCPA applies to a business of our size.

You may use an authorised agent to submit a request; we will require proof of authorisation and may verify your identity directly.

For anything else, email privacy@groundzones.com. We will respond within 30 days (or one month under the GDPR), and may extend by a further 60 days for complex requests, telling you why. We may need to verify your identity before acting. There is no charge unless a request is manifestly unfounded or excessive.

Customers use the Service from many countries and US states, and many of them give people rights like those above - for example Switzerland, Canada, Brazil, Australia and a growing number of US states. Whatever your location, you can use the export and delete tools in Section 8.3, and you can email privacy@groundzones.com to ask for access, correction or deletion. We will handle the request as the law that applies to you requires, and if we decline any part of it we will say why and how you can appeal or complain to your regulator.