Privacy
Data processing agreement
How BEST SOLUTIONS & STRATEGIES handles personal data that business customers put into OpnEarth's hosted services, and what we commit to in return.
Effective 24 September 2026. Last updated 4 October 2026.
Team library files and versions
Files deliberately uploaded to an organisation's team library are Customer Data on our servers. We store the original files and retained versions in Cloudflare R2, and names, version notes, member-attributed change summaries and access audit records in Cloudflare D1. Organisation members can read; authorised editors can upload. These files are readable by the service and are separate from the private encrypted file-sync vault.
Transfers use HTTPS. Cloudflare provides managed encryption at rest, including AES-256 encryption for R2 objects. Current versions remain until deletion. Earlier versions remain indefinitely by default; an organisation administrator can instead select 30 days, 90 days or one year. Expired versions are permanently removed. Downloaded copies on team computers are not remotely erased.
1. Parties and scope
This agreement is between the business customer that uses OpnEarth's hosted services (Customer) and BEST SOLUTIONS & STRATEGIES, a company incorporated in Quebec, Canada, which operates OpnEarth (Provider). It forms part of the agreement under which Customer uses OpnEarth: the licence terms, or a signed order that replaces them. A signed copy is available on request from [email protected].
It applies to personal information that Provider processes on Customer's behalf in the hosted OpnEarth services at opnearth.com (Customer Personal Data). It does not apply to:
- files Customer opens in the desktop application and does not publish, sync or upload to a team library. Those stay on Customer's machines and never reach Provider;
- information Provider handles for its own purposes as a business (billing, tax records, fraud prevention, the website's own analytics). Provider is responsible for that information under its privacy policy.
2. Roles
For Customer Personal Data, Customer is the controller (GDPR), the organisation with control of the information (PIPEDA, Principle 4.1.3), and the enterprise that entrusts the information to a mandatary (Quebec's Act respecting the protection of personal information in the private sector, the "Private Sector Act", s. 18.3). Provider is the processor, service provider and mandatary respectively.
3. What Provider processes
| Category | What is stored | Where | Kept for |
|---|---|---|---|
| Account data | Email address, name (if given), organisation membership and role, sign-in codes and sessions, MFA secrets and recovery codes, passkeys, licence keys, account settings | Cloudflare D1 | Life of the account |
| Installations | A random installation identifier generated on first run, with app version, operating system and version, processor type and update channel, and the computer’s name and model so Customer can recognise its machines (kept only while the machine is signed in). It is not derived from hardware and includes no serial number, MAC address or user name | Cloudflare D1 | Life of the account. A machine unused for 45 days stops counting as a seat |
| Published maps | The derived payload Customer chooses to publish (coordinates, the attributes Customer selects, the map title), share tokens, named recipients' email addresses, comments and mentions with who wrote them, notifications about them and each person's notification settings, a record of who opened a map and when, and field notes a recipient adds through a link that may comment: a category, text, the pin's position, the GPS position with its accuracy and heading when the note is placed at the writer's location, up to three photos, and the address the writer confirmed | Cloudflare D1 and R2 | Until Customer deletes the map or the account. A withdrawn map is kept, and opens for nobody, until Customer restores or deletes it |
| Open log (Security module) | Only for a map of an account with the Security module whose log Customer has not turned off: for each open in the viewer, KMZ or original download and password unlock, the time, the opener's email address when they confirmed it with a code or signed in (otherwise "anyone with the link"), their IP address, the approximate location Cloudflare derives from it (country, region and city, with no other lookup), and their browser and operating system summarised from the user agent. Shown only to the map's owner and, for an organisation's map, its owners and admins, to let them see who opened a shared map | Cloudflare D1 | One year from each open, then deleted automatically. Sooner with the map or the account |
| Synced files | Files Customer chooses to sync between machines, encrypted on the device before upload with a key derived from a recovery key only the user holds. Provider stores ciphertext, an opaque id, a byte count, a version and timestamps. File names and paths are also encrypted, and Provider cannot read the contents | Cloudflare R2 and D1 | Until deleted by the user or with the account |
| AI assistant relay | Only when Customer's users turn it on: the AI assistants each user connected (their registered name and the host they return to), hashed access and refresh tokens, which of the user's computers are connected, and an activity line per request with the tool's name, time, answer size and outcome. The requests and the tool results, which can include names, attribute values and coordinates from files open on the user's computer, pass through Cloudflare in transit and are not stored | Cloudflare D1 and Workers | Activity lines 90 days. Assistants and computers until disconnected or with the account. Requests and results are not kept |
| Live editing | Only for a map Customer's users share live: the edits the people in it make (names, descriptions, attribute values, styles, folders and the coordinates of shapes they draw or change), who has access and in what role, and, in transit only, who is in the map, what they have selected and where their pointer is. The map's file is not part of it | Cloudflare Workers, Durable Objects and D1 | While the map is shared live. Deleted at once when the owner stops sharing live, and within a day of the map being withdrawn or deleted, or the account erased |
| Mail records | Delivery events and suppressions (bounces, complaints) for mail sent to an address | Cloudflare D1, and Resend | Life of the account, or of the suppression |
| Logs | Request logs at Cloudflare (IP address, country, user agent, path). Opt-in crash reports, with a fixed schema and no file contents | Cloudflare, and Provider's collector | Cloudflare's standard retention. Crash reports 90 days |
Data subjects are Customer's staff and users, people Customer names as recipients or reviewers, people who open a map Customer shares, people who add field notes through a link Customer shares, and anyone identifiable from map attributes or comments Customer chooses to publish. Provider does not need special-category data (GDPR Art. 9) or sensitive information (Private Sector Act s. 12) to run the service. Customer decides what it publishes.
4. Processing only on instructions
Provider processes Customer Personal Data only to provide, secure and support the service, on Customer's documented instructions. The choices Customer makes in the product (publish, share, sync, invite, delete) are instructions. Provider will tell Customer if it believes an instruction breaks applicable law. Provider does not sell Customer Personal Data, use it to train any model, or use it for advertising. (GDPR Art. 28(3)(a); Private Sector Act s. 18.3.)
5. Confidentiality and people
Only people who need access to operate the service have it, and they are bound by confidentiality. (GDPR Art. 28(3)(b).)
6. Security
Provider maintains the measures in Annex B and will not materially reduce them during the term. (GDPR Art. 28(3)(c) and Art. 32; PIPEDA Principle 4.7; Private Sector Act s. 10.)
7. Confidentiality incidents
Provider will notify Customer within 72 hours of becoming aware of a breach affecting Customer Personal Data. The notice covers what is known about its nature, the data and people affected, the likely consequences, and what has been done. Provider will update Customer as the investigation proceeds. Provider keeps a register of incidents, including ones judged not to need notification. Nothing here prevents Provider from making a notification the law requires of it. (GDPR Art. 28(3)(f) and 33; PIPEDA s. 10.1; Private Sector Act ss. 3.5 to 3.8 and s. 18.3.)
8. Return and deletion
On Customer's authenticated request, or at the end of the agreement:
- Export. Customer can export published maps from the application at any time. Provider will supply a copy of account data on request.
- Deletion. Customer Personal Data is deleted from Provider's live systems within 30 days of the verified request. An account owner can also delete the account directly from the account page, which removes the account, its published maps and its synced files at once.
- Provider confirms deletion in writing on request.
Provider may keep information the law requires it to keep, such as invoices and tax records, which are Provider's own records. (GDPR Art. 28(3)(g); Private Sector Act s. 18.3.)
9. Subprocessors
Customer authorises the subprocessors listed on the subprocessors page, which also says what each one handles. Provider publishes a change to that list before a new subprocessor handles personal data, and gives Customer 30 days' notice by email. Customer may object on reasonable data-protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected service and receive a pro-rated refund of prepaid fees. Provider binds each subprocessor to written terms at least as protective as these and remains responsible for it. (GDPR Art. 28(2) and (4).)
10. Help with requests
Provider will pass on any request it receives from a data subject about Customer Personal Data, and will help Customer answer access, correction, portability and deletion requests within the legal deadline (30 days under the Private Sector Act s. 32 and PIPEDA s. 8(3); one month under GDPR Art. 12(3)). Provider will also help with privacy impact assessments and consultations where the information needed is Provider's. (GDPR Art. 28(3)(e) and (f).)
11. Transfers outside Quebec and Canada
Customer Personal Data is stored and processed by the subprocessors on the subprocessors page, which are US companies, and may be processed outside Quebec and Canada, including in the United States. Provider relies on those companies' own data processing terms and the transfer mechanisms they offer. Before communicating personal information outside Quebec, Provider carries out the assessment the Private Sector Act s. 17 requires, and will share its conclusions on request.
12. Audits
Provider will make available the information needed to show compliance with this agreement: this document, the security measures in Annex B, the incident register entries that concern Customer, and written answers to a reasonable security questionnaire once a year. An on-site audit, where the law requires one, is at Customer's cost, on 30 days' notice, and may not expose other customers' data or production secrets. (GDPR Art. 28(3)(h).)
13. Liability, term and precedence
Liability is as set out in the main agreement. This agreement lasts as long as Provider processes Customer Personal Data. If it conflicts with the main agreement about personal information, this agreement prevails. Governing law and forum follow the main agreement.
Annex A. Contacts
Provider: BEST SOLUTIONS & STRATEGIES (OpnEarth), [email protected]. Karl Morin is the person in charge of the protection of personal information under the Private Sector Act s. 3.1. Customer: the contact on the account, or the one named in a signed order.
Annex B. Security measures
- TLS on every connection to opnearth.com.
- The application never uploads local KML and KMZ files. Publishing from it sends a derived payload only after the user confirms what will be disclosed. A file is stored only when a user uploads it in the account portal to share it, and is deleted with the map.
- Synced files are encrypted on the user's device before upload. Provider holds no key that can decrypt them.
- Published maps are served through signed, revocable, expiring share links. Named-recipient links are bearer links: forwarding one gives access.
- Tenant separation is enforced in application code and covered by tests. The database has no row-level security, and this agreement does not claim it.
- Sign-in by one-time email code, with optional MFA and passkeys. An organisation can require MFA for its members.
- Signing keys and API credentials are held as deployment secrets, outside the source code.
- Erasure is checked after it runs, and an automated test fails when a table starts holding personal data without an erasure rule.
- Crash reports and timing diagnostics are separately opt-in and use fixed schemas with no file contents.
- The open log of a shared map (Security module) is readable only by the map's owner and its organisation's owners and admins, through account-scoped queries with a role check. IP addresses in it are never written to application logs or sent to the people opening the map, the viewer tells them that opens are logged for the sender, and each entry is deleted automatically after one year.
Questions about this agreement go to [email protected].