Privacy Policy

1. Who we are and how to contact us

Geometry Mapping Tool (“GMT”, “we”, “us”) is an online tool for learning and teaching Descriptive Geometry, available at geometrymappingtool.com.

GMT is run by an individual, not a company. The controller responsible for the personal data described here is João Romano Barbosa, acting as a self-employed sole trader (autónomo) established in Spain, tax number Z2120363K, at Calle de Orense 6-B6, 28020 Madrid, Spain.

For any privacy question, or to exercise the rights described in section 8, write to info@geometrymappingtool.com. We have not appointed a Data Protection Officer, and are not required to: none of the cases in Article 37 of the GDPR applies to an operation of this kind and size.

2. What personal data we collect

We collect only what we need to run the service:

• Account and profile: your email address, your username, an optional job or role, and your password — stored only as a salted hash, so we never see it in plain text. If you sign in with Google we also receive your Google account identifier and name.
• What you create in the tool: your worksheets and sandbox geometry, the bug reports you send us, your interface settings, and the date of your last sign-in.
• Billing: payments are handled by Stripe. We store your Stripe customer and subscription identifiers and your plan status. We never receive or store your card number.
• Analytics: only if you accept analytics cookies, Google Analytics collects usage events and identifiers. See our Cookie Policy for the detail.
• Members enrolled by an institution: when a school or organization enrols you, we receive your email address and name from that institution.

3. Why we use your data, and our legal basis

Under Article 6 of the GDPR, every use of your data rests on one of the following bases:

• Creating and running your account and providing the tool — performance of our contract with you.
• Taking payment and managing subscriptions, and keeping the accounting records the law requires — performance of a contract and compliance with a legal obligation.
• Keeping the service secure, preventing abuse and diagnosing faults — our legitimate interests in a working, safe service.
• Sending service emails such as email verification, password resets and organization welcome messages — performance of a contract and our legitimate interests.
• Measuring how the tool is used so we can improve it — your consent, given through the cookie banner and withdrawable at any time.

4. Automated decisions and profiling

We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal effects or similarly significant effects, within the meaning of Article 22 of the GDPR. Analytics, where you have consented to it, is used in aggregate to understand how the tool is used — not to make decisions about individuals.

5. Who we share your data with

We do not sell your personal data. We share it only with providers that process it on our instructions, under a written data-processing agreement, and only as far as running the service requires:

• Resend — delivery of transactional email.
• Stripe — payment processing and subscription management.
• Google — “Sign in with Google” and, where you have consented, Google Analytics.
• Google Cloud — hosting of the application on Cloud Run in europe-west1 (Belgium).
• Neon — the Postgres database, hosted on AWS in eu-central-1 (Frankfurt, Germany).
• If a school or organization enrolled you, we confirm your membership and its status to that institution.
• We may also disclose data where the law obliges us to, where a competent authority validly requires it, or where it is necessary to establish or defend legal claims.

6. Transfers outside the EEA

The application runs in Belgium and its database in Germany, both inside the European Economic Area.

Google and Stripe may also process data outside the EEA, including in the United States. Both are certified under the EU–U.S. Data Privacy Framework, the adequacy decision the European Commission adopted in July 2023, and both additionally commit to the Commission’s Standard Contractual Clauses where the Framework does not cover a transfer. Google LLC states it adheres to the Data Privacy Framework Principles; Stripe names the Framework and the Clauses in its data processing agreement.

7. How long we keep your data

• Account and the content you create: for as long as your account exists. Deleting your account erases them, as described in section 8.
• Accounts that are never activated or show no activity may be removed after about 30 days.
• Single-use links expire quickly by design: email verification after 24 hours, password resets after 2 hours, and organization set-password links after 30 days. Sign-in sessions last about 30 days.
• Billing, invoicing and tax records: kept for the period Spanish law requires, which we cannot shorten at your request — generally 6 years for commercial records under Article 30 of the Commercial Code, and 4 years for tax purposes under the General Tax Law.
• Backups are rotated on a fixed cycle, so deleted data may persist in a backup for a short period before being overwritten.

8. Your rights

You have the right to ask us for access to your personal data, and for its rectification or erasure; to ask us to restrict or to object to how we use it; to receive it in a portable format; and to withdraw any consent you have given, at any time, without affecting what we did before you withdrew it.

You can act on most of these yourself, immediately: Dashboard → Profile → Your data lets you export everything we hold about you as a file, and delete your account permanently. You can correct your details on the same page, and change your cookie choice from the cookie banner at any time.

For anything else, write to info@geometrymappingtool.com. We answer within one month, as Article 12 of the GDPR requires; if a request is complex we may extend that and will tell you why.

If you think we have handled your data badly, you can complain to the supervisory authority in the country where you live or work. Because we are established in Spain, our lead authority is the Agencia Española de Protección de Datos (AEPD), at aepd.es, and Spanish law adds to the GDPR through Organic Law 3/2018 (LOPDGDD).

9. Schools, organizations and children

Where a school or organization creates your account as part of a programme, that institution decides why and how your data is used for that purpose. It is the controller, and it is responsible for having a lawful basis, for informing students, and for obtaining parental consent where the law requires it. In that arrangement GMT acts as a processor on the institution’s behalf, under a data-processing agreement.

We do not knowingly create accounts for children outside that arrangement. The age below which a parent must consent varies across the EU — 14 in Spain, under Article 7 of Organic Law 3/2018, as well as in Italy; 13 in Portugal; 16 in some other member states — and meeting the applicable threshold is the enrolling institution’s responsibility.

10. How we protect your data

We use measures appropriate to the risk, including passwords stored only as salted hashes, encrypted transport (HTTPS) for everything you send us, role-based access controls, and single-use expiring links instead of ever sending a password by email.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the supervisory authority and, where the GDPR requires it, you as well.

11. Changes to this policy

We may update this policy — for example when we add a feature or change provider. The current version is always on this page and the date above tells you when it last changed. If a change materially affects your rights, we will tell you directly rather than rely on this page alone.