Privacy Policy

This Privacy Policy describes how Territory Creator ("we," "us," or "our") collects, uses, and protects your information when you use our service.

1. Information We Collect

We collect information you provide directly to us, including:

• Account information (name, email address)
• Payment information (processed securely through Stripe; we do not store your full card details)
• Content you create (territories, assignments, geographic data)
• Communications with us
• Your email address, if you choose to leave it in the interactive demo so we can follow up with you

We also automatically collect certain information when you use the Service, including your IP address, browser type, device information, and usage patterns.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments and questions
• Monitor and analyze trends, usage, and activities
• Detect and prevent fraud or abuse

We use your IP address to estimate your approximate location (country and state/region) so the interactive demo shows familiar geography; we do not store the estimate itself. The demo region you were viewing is saved only if you choose to leave your email or carry your demo work into a signup.

If you leave your email address in the interactive demo, we store it together with the page you were on, your referrer, your browser's User-Agent, how long and how much you used the demo, the demo region you were viewing, and the number of territories and assignments you created. We use it only to reply to you about the product.

3. Information Sharing

We do not sell your personal information. We share it with the following companies, each only for the purpose given, and in the other circumstances listed after them:

• Stripe processes payments and subscriptions. It receives your billing details and your organization's subscription.
• Resend delivers the emails we send you. It receives your email address and the content of each message.
• Cloudflare sits in front of our website as a content delivery network and security proxy. Every request to our site passes through it, so it sees your IP address and the pages you request. Cloudflare may also measure page loads with its Web Analytics beacon, which does not use cookies.
• DigitalOcean hosts our servers and database, and so holds all the information described in this policy.
• Google receives information in two places. Google Analytics measures visits to our public pages (see section 4). If you choose to sign in with Google, Google tells us your name and email address and learns that you signed in to our service.
• PostHog provides product and website analytics, including session replay, on our public pages and in the application (see section 4). Our server logs, which include your user id, your organization's id and a request id and, for a request blocked by a usage limit, your username and IP address, are processed by PostHog Logs and kept for 14 days.

We may also share information:

• To comply with legal obligations or respond to lawful requests
• To protect our rights, privacy, safety, or property
• In connection with a merger, acquisition, or sale of assets (you would be notified of any such change)

4. Cookies and Analytics

We use cookies and similar technologies to operate and improve the Service. Specifically, we use:

• Essential cookies to maintain your session and remember your preferences
• Google Analytics to understand how visitors use our public website. It is used only while you are signed out, and only after you agree where the law requires it (see our Cookie Policy).
• PostHog to understand how visitors use our public pages and how the application is used, on our public pages and in the application

Product and website analytics

While you are signed out, PostHog measures your visits under the cookie banner: outside Europe it is on until you turn it off, and in the European Economic Area, the United Kingdom and Switzerland it stays off until you accept. It receives the pages you open, the controls you click and recordings of your sessions (session replay), but no user id, name or email address. The recordings hide all text, form fields, images and video in the same way. If you sign up on a device where we were measuring your visits, PostHog links those earlier visits to your account.

While you are signed in, PostHog receives your user id and your organization's id, the pages you open and the controls you click, and recordings of your sessions (session replay). It does not receive your name, your email address or your organization's name. Session recordings hide all text, form fields, images and video, so they show where you clicked and how the screen was laid out, not what it said.

Our basis is our legitimate interest in knowing how the product is used so we can improve it. Outside Europe it is on until you turn it off. In the European Economic Area, the United Kingdom and Switzerland, it stays off until you turn it on. You choose, at any time, under "Product analytics" on your profile page (also linked as "Analytics Settings" in the footer). Turning it off stops the browser tools and the matching events we record on our servers. Those server events follow the same rule: where the law asks first, or where we cannot tell where you are, nothing that identifies you is recorded until you turn analytics on.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

5. Data Retention

We retain your information as follows:

• Active accounts: Your content is retained for as long as your account is active
• After your organization's subscription ends: We keep its content, read-only, for as long as the organization exists, so you can resubscribe and pick up where you left off, or export your maps from each map's page. Your organization's content belongs to the organization: if you are its only member, deleting your account deletes it; otherwise an admin can ask us to delete it at support@territorycreator.com
• After account deletion: Your content is deleted within 30 days of your deletion request
• Demo email submissions: Deleted automatically after 180 days; you can ask us to delete yours sooner
• Rate-limit records: When a request is blocked for exceeding a usage limit, we record the time, the page and your IP address, and delete the record after 90 days
• Sign-in records: Sign-ins, failed sign-in attempts and password or email changes on your account are kept for 365 days
• Organization activity history: Changes to maps, sharing, membership and billing are kept for as long as the organization exists, so its editors can see who changed what
• Expired sign-in sessions: Removed from our database daily
• Email records: Records of the emails we send you (address, subject, delivery status) are kept for 90 days
• Backups: Data deleted from our database may remain in our encrypted backups for up to 365 days, after which those backups are deleted. Backups are used only to recover from a failure. If we ever have to restore one, we delete your data again before the Service comes back. To be able to do that, we keep a record of each deletion request outside the database, in the same storage as our backups: an internal account number, whether the request is pending, taken back or carried out, and its dates. It holds no name or email address, and we delete it after 730 days

We may retain certain information as required by law or for legitimate business purposes.

6. Data Security

We take reasonable measures to protect your information from unauthorized access, use, or disclosure. This includes encryption of data in transit, secure storage practices, and limited access to personal data. However, no method of transmission over the internet is 100% secure.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information
• Data portability: Request a copy of your data in a portable format
• Objection: Object to certain processing of your information
• Restriction: Request that we limit how we use your information

To exercise any of these rights, please contact us at support@territorycreator.com. We will respond to your request within 30 days.

You may also:

• Access and update your account information at any time
• Delete your content at any time
• Cancel your subscription through your organization settings
• Opt out of promotional emails by clicking the unsubscribe link

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We take steps to ensure your information receives adequate protection in accordance with this Privacy Policy.

9. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at support@territorycreator.com.