Privacy policy
Alatus Labs, Largo da Graça 35, 1170-165 Lisboa, Portugal, runs Onde at onde.earth and is the controller of the personal data in this policy. You can reach us at [email protected].
What we store
- Account. Your email address and your plan. For a paid plan, also your customer ID at our payment provider.
- Sessions. For each sign-in, a session token, its expiry date, and the user agent of your browser, which names the browser and the operating system. We do not store your IP address.
- Keys. The name, the type, the allowed origins, and the dates of each key. We store a hash of each secret key and the full value of each public key.
- Usage. The number of requests of each key on each day.
- Sign-in links. Your email address and a hash of the link. The link expires after 15 minutes.
API requests
A request to the API contains the IP address of the sender, and usually a key and search text or a position. The API uses these to answer the request, to count the usage, and to apply the rate limits. The API does not store or log the search text, the positions, the keys, or the IP addresses. It keeps the IP address in memory only, for the rate limit of public keys.
Sign-in
To sign in, you enter your email address, and our email provider sends you the sign-in link. On the sign-in page, a security check from our content delivery provider checks that a person uses the browser. To limit the number of sign-in emails, the site keeps your email address and your IP address in memory for 60 minutes. The site does not write them to the database or to its log.
Hosting log
Our hosting provider writes a log of each request to the API and to the website. The log holds the IP address of the sender, the time, the host, the path, the status, the duration, and the user agent. The hosting provider deletes the log after 30 days.
Cookies
The site sets one cookie, the session cookie, when you sign in. The dashboard needs it. It expires up to 30 days after you last use the dashboard, or when you sign out. If you change the color scheme, your browser stores the choice and does not send it to us. We use no advertising and no trackers.
Analytics
We run our own analytics on our own servers to see how people use the website, for example which pages they read. It records anonymous events and totals, which cannot identify you. It sets no cookies, and no third party receives the data. The API sends nothing to the analytics.
Providers
These providers process personal data for us. On request, we name the provider in each category.
| Category | Purpose | Personal data |
|---|---|---|
| Hosting | Runs the API, the website, the database, and its backups | All data in this policy, and the data in API requests |
| Content delivery and security | Delivers and protects the traffic of the website, and runs the security check on the sign-in page | All requests to the website, with IP addresses |
| Payments | Processes the payments for paid plans | Email address, billing address, and payment details |
| Email delivery | Sends the sign-in emails | Email address |
Our servers and our database are in the European Union. Some providers, our hosting provider included, process data in the United States. These transfers occur under the EU-US Data Privacy Framework or under the Standard Contractual Clauses.
Legal bases
- Contract. Your account, your keys, the API, the sign-in emails, and the payments.
- Legitimate interest. The security check, the sign-in limits, the rate limits, and the logs protect the service from abuse. The anonymous analytics show how people use the website.
- Legal obligation. The invoices that tax law requires.
Retention
We keep your account data until you delete your account. To delete it, go to the Account page of the dashboard. The deletion removes the account, its sessions, and its keys. Our database backups keep a copy, with your email address, for up to 30 days. The daily usage counts stay, without your email address.
For a paid plan, we keep the invoices for as long as tax law requires.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, and object to or restrict its processing. Email us for each request. You can also complain to a data protection authority, such as the Portuguese Comissão Nacional de Proteção de Dados or the authority of your country.
Changes
We publish each change on this page with a new date. Before a change that affects you, we tell you by email.