Privacy Policy

TerraGrid (“we”, “us”, or “our”) is committed to protecting your personal information. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.

This policy applies to all users of the TerraGrid web application and website at TerraGrid.com. By using the Service, you consent to the practices described here.

We comply with the Protection of Personal Information Act 4 of 2013 (POPIA) and, where applicable, the EU General Data Protection Regulation (GDPR).

Information you provide directly:

• Email address and password (when you create an account).
• Organisation name (set during account creation).
• Map names, shape labels, layer names, and other content you create in the Service.
• Messages you send us via email or support channels.

Information collected automatically:

• IP address, browser type, and operating system.
• Pages visited, features used, and time spent in the Service (usage analytics).
• Error logs and diagnostic data to maintain Service reliability.

Payment information:

Payment card details are collected and processed directly by our payment provider (PayFast). We receive only a transaction reference and your subscription status — we never store full card numbers or CVV codes.

We use the information we collect to:

• Create and manage your account and organisation.
• Provide, maintain, and improve the Service.
• Process subscription payments and send billing receipts.
• Send you important service notifications (security alerts, downtime notices).
• Respond to your support requests.
• Detect and prevent fraud, abuse, or violations of our Terms of Service.
• Comply with legal obligations.

We do not sell your personal information to third parties. We do not use your data to train AI models or for advertising purposes.

We use trusted third-party providers to operate the Service. Each provider has their own privacy policy and is contractually bound to protect your data:

• Supabase — database, authentication, and file storage. Your map data and account information are stored in Supabase infrastructure.
• Mapbox — satellite imagery, map tiles, and terrain data displayed in the editor. Map viewport coordinates are transmitted to Mapbox to render imagery in accordance with their Privacy Policy.
• Vercel — hosting and edge delivery of the web application.
• PayFast — secure processing of subscription payments. We do not store payment card data ourselves.

We will notify you if we add or change material third-party providers.

We use session cookies and browser local storage to keep you logged in and to remember your preferences (such as your selected organisation and map viewport). We do not use tracking cookies for advertising.

You can disable cookies in your browser settings, but doing so may prevent the Service from functioning correctly.

We retain your account data and map content for as long as your account is active. If you delete your account, we will permanently delete your personal data and map content within 30 days, except where we are required to retain it for legal or regulatory purposes (such as billing records, which we retain for 5 years as required by South African tax law).

We use industry-standard security measures including TLS encryption in transit, encrypted storage at rest via Supabase, and row-level security policies that ensure users can only access their own data. Passwords are hashed and never stored in plain text.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to promptly investigating and disclosing any breaches that affect your data.

Under POPIA and applicable law, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Object to or restrict certain processing of your data.
• Receive your data in a portable format.
• Lodge a complaint with the Information Regulator (South Africa) if you believe we have mishandled your data.

To exercise any of these rights, email us at privacy@terragrid.com. We will respond within 30 days.

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by a prominent notice within the Service. The “Last updated” date at the top of this page reflects the most recent revision.

If you have questions or concerns about this Privacy Policy or your personal data, please contact us at privacy@terragrid.com.