Privacy
Subprocessors
The providers used by the hosted service and website, what they handle, and the external services a desktop user can choose. Their legal roles depend on the service and applicable agreements.
Last updated 6 October 2026.
Who processes what
Cloudflare, Inc.
Team library original files and retained versions are stored in R2. Library metadata, comparison summaries and member access audit records are stored in D1. Library files use HTTPS and managed encryption at rest, and are readable by the service.
Hosting, the database, object storage, the bot check on our forms, and the access control on our own admin pages. Everything the website stores passes through them: email addresses, the install identifier the desktop application generates, the country your request came from, and the field notes recipients add to a shared map, including their photos and GPS positions. It also runs the relay (mcp.opnearth.com) that lets an AI assistant a customer connects reach the OpnEarth application on the customer's computer: the assistant's requests to the application's tools, and the answers, pass through Cloudflare in transit and are not stored. And it runs live editing (collab.opnearth.com): for a map its owner shares live, the edits the people in it make (names, descriptions, attribute values, styles and coordinates they change) and who is in it are carried between them, and the edits are stored in that map's own Durable Object until the owner stops sharing live, or for up to a day after the map is withdrawn, deleted or erased. Processed through their global network. Contact us for the verified storage configuration and contractual terms of your deployment.
Resend (Plus Five Five, Inc.)
Email delivery: sign-in and confirmation codes or links, downloads, map shares, invitations and notices. They receive the address and message. Hard-bounce suppression blocks all mail; complaints block marketing while allowing transactional messages the recipient explicitly requests.
Amazon Web Services, through Resend
Resend uses AWS for hosting and sending. This downstream email role is separate from the desktop elevation service below. See Resend's complete supplier list for its other downstream providers. There is no direct SES SDK integration in the OpnEarth mail sender.
Geoapify
Place search for Pro and Enterprise accounts that haven't set up their own search provider. When someone presses Enter on a search, our server sends Geoapify the words typed, and nothing else: no name, email address or account. Requests come from our server, so Geoapify does not see the person's IP address. Geoapify keeps successful requests for no longer than 24 hours, for operations and billing, and hosts its service in EU data centres. We cache answers for a week, keyed by a hash of the words, and don't log the searches.
Google Analytics on the marketing website loads only after you allow it. It receives page/event and browser/network information and uses cookies. The privacy page lets you withdraw consent. YouTube's player is loaded when you click a video. Neither is marketing analytics in a shared-map viewer.
Stripe, Inc.
Payments. They see the email address on the account and whatever billing details you give them. We never see or store a card number. The payment form is theirs rather than ours, and what comes back to us is an identifier and a subscription status.
Not subprocessors, but worth knowing about
These are contacted by your own computer when you use the relevant feature. Your selected provider and its terms determine the arrangement; a direct desktop connection alone does not determine its legal role.
- Esri serves satellite imagery, when you choose that basemap. They receive the coordinates of the area you are looking at, which is a map location and not the contents of your file.
- Amazon Web Services serves elevation data, when you measure a route. The tile requests identify the area being sampled; the source file and an explicit route document are not sent.
- MapTiler does address search, only if you switch it on and supply your own key. They receive what you type into the search box, when you press Enter, and the centre of the map view so nearby places rank first. Nothing is sent while you type. A near-net quote sends them the address text of rows with no coordinates, without the map view.
- Natural Resources Canada (Geolocation Service) and the Government of Québec (Adresses Québec geocoder) look up Canadian civic addresses. They receive what you type into the search box, when you press Enter, and the address text of the rows of a near-net quote that have no coordinates. To find a civic number on a Québec street known by another name, the Adresses Québec geocoder is also sent the position of that street as the first lookup returned it. No key, no account, and never the map view.
- Services you add as live layers (a WFS or an ArcGIS FeatureServer whose address you paste in) are asked for features only when you add the layer or refresh it. Each receives the rectangle of the map view and nothing else. You choose them; we have no arrangement with them.
- OpenStreetMap Overpass servers (overpass-api.de, run by FOSSGIS e.V. in Germany, or another server you type in) are asked for buildings only when you run Buildings passed, for roads only when a near-net quote follows real roads, and for roads, railways and rivers only when you make a route package. Each receives rectangles (about 5 km along the route, or about 2 km round the near-net addresses) and nothing else. The buildings are © OpenStreetMap contributors under the Open Database License. We have no arrangement with these servers.
- The AI provider you choose answers Ask the map questions, only if you set one up in Settings: Anthropic, or any service that speaks the OpenAI-compatible API, under your own key, or a model on your own computer (Ollama or LM Studio), in which case nothing leaves it. The provider receives your question and, to answer it, the names of the open files, their folder and column names, and the names, attribute values and distances the in-app tools return. It never receives the file itself. The request goes from your computer to that provider under your key and your agreement with them; nothing goes through OpnEarth, and we have no AI service or key of our own. We have no arrangement with these providers. Work offline turns off any provider that is not on your computer.
Apart from the AI provider you choose, as described above, none of them ever receives a file you opened, its name, or its contents. The offline basemap and any imagery you mount yourself involve none of them at all.
When this list changes
We publish a change here before a new subprocessor starts handling personal data, and we will give 30 days' notice to customers with a signed agreement, so there is time to object. To be told directly, write to [email protected] and we will add you to the notification list.
When we stop using a subprocessor, we update this list.
Getting your data, or having it deleted
Write to [email protected]. We answer within 30 days, as Law 25 and GDPR require, and usually much sooner. Deleting your account removes it from our database. Backups roll off within a further 30 days, so your data leaves them too.
Questions about any of this go to [email protected].