Privacy Notice

This Privacy Notice describes how Sarkoa (“we”, “us”) collects, uses, stores, and shares information when you use our marketing website, the Sarkoa web application, and related services (together, the “Services”). It is not legal advice. You may want independent advice for your situation.

Who we are

The data controller for the Services is Sarkoa Analytics Inc., registered at 527B Broadhead Ave, Ottawa ON, Canada. Contact: support@sarkoa.com.

What this notice covers

This notice applies to visitors of our public marketing site, authenticated users of the Sarkoa app, API clients using organization API keys, and anyone who opens a share link or embedded map we host. It does not govern third-party sites we link to.

Information we collect

Account and profile

When you create or use an account, we process identifiers and profile details required for account management (email address, name where provided, session data, and optional multi-factor authentication factors). Organization names, roles, and settings you configure are stored with your account.

Content you upload

You may upload geospatial files and related data. That content can include metadata and attributes inside your files. You are responsible for ensuring you have a lawful basis to upload personal data (if any) and for complying with applicable laws. We process uploaded content to provide storage, cloud optimization, visualization, sharing, and APIs as described in our product.

Billing

Paid plans are billed through third-party payment processors. We store billing-related identifiers and status in our systems; payment method and transaction processing are handled by those processors under their own terms and privacy notices.

Sharing and collaboration

When you invite others by email or create share links, we process the email addresses or tokens needed to deliver those features and enforce access controls.

API usage

Organization API keys are stored in hashed form. We record usage such as last-used timestamps. For requests authenticated with an API key, we log the HTTP method, path, organization, key identifier, client IP address, and user agent where available.

Product usage and access logs

To operate and secure the Services, we generate event records that may include timestamps, organization and asset or map identifiers, authenticated user identifiers when applicable, share identifiers, approximate client IP address, and user agent. Examples include asset view events, custom map access events, and API request logs. We use these records for operational, security, and (where exposed in product) analytics purposes.

Feedback

If you submit in-app feedback, we store the rating and optional notes you provide, associated with your user account and optionally an organization.

Technical data and localization

We receive standard HTTP data (such as IP address and user agent) and use them for security, debugging, and compliance. To suggest a default language on the app before you sign in, we may use coarse location derived from request headers (for example country) together with your browser language preferences. Signed-in users may have a saved language preference in their settings.

Landing site

The landing site (sarkoa.com) does not use the account features above unless you follow links into the app. It may load externally hosted assets, which can involve processing of IP address and technical request data by those providers. Theme preference on the marketing site may be stored in your browser’s local storage.

Cookies and similar technologies

We use cookies and similar storage as follows:

• Sign-in: HTTP-only session cookies so you can stay authenticated securely.
• Organization context: A secure cookie so we can remember your last valid organization for navigation within the app.
• Local storage on your device: UI preferences such as theme, table column widths, and in-product display options (for example how many days of access history to show). We do not use these for cross-site advertising in our application code.

We do not deploy third-party advertising or analytics pixels in our marketing site or app today; if we add them later, we will update this notice.

How we use information

We use the information above to:

• Provide, operate, and improve the Services;
• Authenticate users, enforce access control, and protect against abuse;
• Process subscriptions and invoices;
• Convert and deliver geospatial content;
• Communicate with you about the Services and support requests;
• Comply with law and enforce our terms.

Legal bases (EEA, UK, and similar jurisdictions)

Where GDPR or similar laws apply, we rely on one or more of the following:

• Contract: processing necessary to provide the Services you request;
• Legitimate interests: securing the platform, understanding usage in aggregate, troubleshooting, and improving the product, balanced against your rights;
• Legal obligation: where required by applicable law;
• Consent: where we expressly ask for it (for example optional communications if we offer them).

We apply these legal bases according to the specific processing activity and applicable law.

Service providers and recipients

We use trusted third-party providers to operate the Services, including for infrastructure hosting, identity and access management, database and storage operations, billing, customer communications, and related technical functions. We share personal information with these providers only as needed for them to perform services on our behalf under contract.

We may change specific vendors over time. We maintain a separate subprocessor list for our enterprise customers.

International transfers

Sarkoa Analytics Inc. is based in Canada. We and our service providers may process personal information in Canada, the United States, and other countries where we or they operate.

Where EU or UK data protection law applies and a transfer requires safeguards because the destination is not subject to an adequacy decision, we rely on approved transfer mechanisms in our vendor agreements, including the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum (or an equivalent UK transfer tool), together with technical and organizational measures appropriate to the risk.

Under Canadian privacy law, we remain accountable for personal information in our custody or control, including when it is processed in another country; we address cross-border processing through contracts and security measures with service providers.

For questions about international processing, contact support@sarkoa.com.

Retention

We retain information for as long as needed to provide the Services, comply with law, resolve disputes, and enforce agreements. Account and billing records typically persist for the life of the customer relationship plus a reasonable period. Uploaded content remains until you delete it or close the account subject to our terms and technical backups. Operational logs may be retained for a limited period consistent with security and product features (for example access history available in the product is bounded by the time window you select where applicable).

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. You may withdraw consent where processing is consent-based. To exercise rights, contact privacy@sarkoa.com. You may lodge a complaint with your local supervisory authority.

Security

We implement administrative, technical, and organizational measures appropriate to the risk, including transport encryption (HTTPS), access controls, and protecting secrets such as API key hashes rather than raw keys.

Children

The Services are not directed to children under the age where parental consent is required in your jurisdiction.

U.S. state privacy disclosures

Residents of certain U.S. states may have additional rights under local law (including California). Categories of personal information we collect are described above. We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are used under laws such as the CPRA. We engage service providers only so they can help us operate the Services on our behalf under contract; they may not use your personal information for their own purposes or combine it with data from other clients to profile you for advertising. California residents may request access and deletion as permitted by the CPRA through the contact above.

Changes

We may update this notice from time to time. We will post the revised version with a new “Last updated” date and, where appropriate, provide additional notice (for example by email or in-product message).