1. About this policy
This policy describes how Contour Foundry handles information through contourfoundry.com, account services, map generation, credit purchases and support.
Contour Foundry is the operator and controller of personal information. Our address is Rua do Visconde de Anadia 11A, Funchal 9050-020 Madeira Portugal. Contact support@contourfoundry.com for service matters or privacy@contourfoundry.com for privacy matters.
Acknowledging this policy at signup records that it was presented and accepted. It is not consent to advertising, selling information or every possible future use. Where a particular activity requires separate consent, that consent must be obtained separately.
2. Information we handle
Account information: your email address, a one-way password hash, verification status, signup and sign-in times, account status and security-related records. We do not store your account password in readable form.
Optional Google sign-in: if you choose Continue with Google, we receive your Google account identifier, email address and email-verification information to create and authenticate your account. We store the identifier and email, but do not request or store your first or last name, Google password, contacts or files. We do not retain Google access or refresh tokens. Google sign-in is independent of optional Google Analytics consent.
Policy acceptance: your account reference, the server-recorded acceptance time, signup source, Terms and Privacy Policy version identifiers, checksums and copies of the accepted documents. We do not currently collect a separate IP address or browser fingerprint specifically for this acceptance record.
Design and generation information: locations or coordinates you enter, map area, labels, colors, dimensions, other settings, uploaded fonts where supported, generated previews and exports, build status and errors. A chosen map location can reveal a place important to you; do not submit sensitive locations unless needed for your project.
Billing information: credit purchases, amounts, currencies, tax amounts if applicable, Stripe transaction references, payment status, credit usage, refunds and billing holds. Payment-card details are entered directly on Stripe's hosted checkout. Our application does not store full card numbers or card security codes.
Support information: the subjects and messages you send, related account or build references, replies, and case status. Please do not include passwords, card details or unnecessary sensitive information in support messages.
Technical information: session and security cookies, request and error information, network information available to our hosting or payment providers, and limited operational logs used to protect and run the service. Rate-limit identifiers in our application are keyed hashes. Email recovery requests are temporarily queued for delivery.
3. How we use information
We use information to create and verify accounts; authenticate users and reset passwords; save or restore work where supported; retrieve geographic data and generate outputs; process purchases and maintain credit balances; provide downloads and support; document policy acceptance; and investigate failures, abuse, disputes and unauthorized access.
We also use necessary records for accounting, legal obligations, security and establishing or defending legal claims. With separate consent, we use Google Analytics to understand public-page visits and Google Ads measurement to attribute visits and completed account registrations to Contour Foundry advertising. We do not sell personal information, create third-party advertising profiles or enable personalized advertising in our Google tag.
4. Service providers and disclosures
AWS hosts the deployed service and related infrastructure. Stripe processes payments and may handle payment details, billing information, device information and fraud checks under its own privacy policy at stripe.com/privacy. Your account email, order reference, amount and currency are sent to Stripe when you start checkout.
Geographic search, map and elevation providers receive the location searches, bounding areas or tile requests needed to supply data. Providers may include OpenStreetMap-related public services and AWS Open Data terrain sources. Depending on the feature, a request can originate from our server or your browser. Browser requests disclose network information such as your IP address to the receiving provider. Map providers are not sent your password or payment-card details by our application.
Resend is our selected provider for verification, password-reset and account-security email. It processes recipient addresses, message contents and delivery information. Resend states that its primary processing operations are in the United States. See resend.com/legal/dpa and resend.com/legal/privacy-policy. We use this connection for account messages, not marketing subscriptions. Support conversations are also available inside the workspace.
Authorized administrators can access account, support, billing, acceptance and build records when needed to operate the service. We may disclose necessary information to comply with lawful requests, protect rights and safety, address fraud, or complete a business transfer with appropriate safeguards and notice where required. We do not publish private account information or designs as marketing examples without permission.
Google provides optional account authentication. Choosing Google sign-in takes you to Google, which receives the authentication request and associated browser/network information under its privacy policy at policies.google.com/privacy. Email/password signup remains available. We do not load Google sign-in scripts or contact its sign-in servers on the page before you choose this option.
Google provides optional public-page measurement through Google Analytics and Google Ads. These services load only after the visitor grants the corresponding consent. Depending on the choice, Google may receive first-party measurement identifiers, advertising-click information, browser/device information, public page paths and network information including an IP address in transit. Google signals, enhanced conversions, user-provided-data collection and advertising personalization are disabled in our site integration. See policies.google.com/privacy and Google's data-processing terms.
5. Cookies and browser storage
We use necessary cookies for secure sign-in, session management, protection against forged requests and remembering privacy choices. The studio uses browser storage for saved designs, editor settings, measurement preferences and safe checkout retry references. Some work is specific to that browser and device. See Cookie & privacy choices at contourfoundry.com/cookies/ for names, purposes, durations and controls.
Our notice records acknowledgment separately from optional consent. Necessary cookies are not conditioned on accepting optional processing. Google Analytics and Google Ads measurement are separate choices. The Google tag does not load before at least one corresponding choice is granted. Rejecting or withdrawing optional measurement prevents future collection and removes first-party Google measurement cookies accessible to our site. Signing up or accepting this Privacy Policy does not enable optional measurement.
Google Analytics, when consented to, measures visits to logged-out public marketing pages. Google Ads measurement, when consented to, helps attribute public-page visits and completed registrations to Contour Foundry advertising. Measurement can also run on the one-time, noindex signup-completion page after an account is created or an email is confirmed. Other account pages, the workspace, administrator, studio, support, checkout and legal pages are excluded. Depending on your choices, measurement can involve first-party cookie identifiers, advertising-click information, browser/device information, the public or completion page path and network information received by Google, including an IP address in transit.
We do not send Google account identities, design coordinates, search terms, payment details, URL query strings or fragments in configured page-view events. Google signals, enhanced conversions, user-provided-data collection and advertising personalization are disabled. Google may process information outside the EEA. See policies.google.com/privacy and Google's data-processing terms for its practices.
Optional measurement consent is voluntary. You may choose Analytics only, Ads measurement only, both, or neither, and withdraw through the permanent Cookie & privacy choices link. Withdrawal stops future collection and removes first-party Google measurement cookies from that browser; it does not itself delete information already sent to Google or affect earlier lawful processing. Contact our privacy address for applicable deletion requests. Preferences are browser-specific.
We honor Global Privacy Control as a sale/sharing opt-out and disable all optional Google measurement when it is received. We do not sell personal information or share it for cross-context behavioral advertising. You can record an opt-out without an account. Removing GPC does not automatically grant consent.
Privacy-choice receipts record the server time, a random browser/receipt reference, notice version, checksum and copy, acknowledgment, separate Analytics and Ads measurement choices, and GPC/opt-out action. Records made while signed in are linked to the account. The current anonymous receipt may also be linked when you sign in on that browser; other anonymous records remain unlinked. We do not collect an additional IP address, browser fingerprint or page-view history for these receipts.
You can clear or block browser storage, but doing so may sign you out, remove local designs or prevent features from working. Stripe uses its own payment and fraud-prevention storage on its separate hosted checkout. We do not load Stripe as an advertising script on our pages.
6. Retention and deletion
We keep information for the purposes described here and for as long as reasonably needed to provide the account and service, resolve support or payment issues, prevent abuse, and meet applicable legal and accounting obligations.
Recovery email queue records are scheduled for removal after seven days. Reset links expire after one hour and are invalidated by a successful password reset. Operational rate-limit records expire and are removed periodically. Other account, transaction, acceptance and support records may be retained after account closure where necessary and lawful.
Browser drafts remain until you delete them, clear browser data or the browser removes them. Server files are not guaranteed permanent storage. Backups may retain earlier copies until their normal rotation or an approved deletion process removes them. Contact us to request deletion; some records may need to be retained with restricted use rather than immediately erased.
The privacy preference cookie lasts 180 days after a saved choice. Privacy-choice receipts are automatically removed from the active database after 12 months. Analytics cookies, where accepted, are configured for a maximum of 180 days without automatic renewal. Google Ads measurement cookies may last up to 90 days. Google account retention settings separately control data held there. Deletion from rotated backups follows the backup lifecycle; backups are restricted to recovery use.
7. Your choices and rights
Depending on applicable law, you may have rights to access, correct, delete or receive a portable copy of personal information, object to or restrict certain processing, and withdraw consent where processing relies on it. Withdrawal does not affect processing that was lawful before withdrawal. We may need to verify your identity and consider legal retention requirements. We will respond within applicable legal time limits.
Email privacy@contourfoundry.com to exercise your rights, ask about personal information or request account closure; signing in is not required to email us. You can also use Help & messages. You may complain to Portugal's Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt, or another competent supervisory authority. You can delete local drafts in the studio or clear browser storage. There is not currently a separate automated account-deletion tool.
Our legal bases are performance of the service contract for account access, map generation and purchases; legal obligations for required financial records and lawful requests; and legitimate interests in proportionate security, fraud prevention, service reliability, support and evidence of agreements. Where processing needs separate consent, we will ask for it. You may object to processing based on legitimate interests. Necessary account information is required to provide the service; without it we cannot create or maintain an account.
8. Additional information for California residents
The categories described above include identifiers, commercial information, internet or electronic activity (including separately consented public-page and signup-completion Analytics or Ads measurement), location information you supply for a map, and information in support messages. Sources include you, your interactions with the service and our service providers. Purposes, recipient categories and retention criteria are described in this policy. We disclose necessary information to hosting, payment, email and geographic-data providers, and to Google for optional sign-in or separately consented measurement as described above.
Where the California Consumer Privacy Act applies, you may have rights to know/access, correct and delete personal information, receive a portable copy, and opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics for advertising. We do not knowingly sell or share information of people under 16. Our service is intended for adults.
Email privacy@contourfoundry.com to exercise applicable rights, or use Help & messages while signed in. You do not need an account to email us or use our browser opt-out controls. We may verify identity for access, correction or deletion requests. An authorized agent may contact us and may need to show authority to act. We will respond within applicable legal deadlines, explain any lawful refusal and not discriminate against you for exercising your rights. These explanations do not mean the CCPA necessarily applies to every small business; rights are subject to applicable law.
9. Security and international processing
We use safeguards including HTTPS, access controls, password hashing, restricted access to generated files and encrypted storage for configured service credentials. No system or transmission method can guarantee absolute security. Use a unique password and tell us if you suspect unauthorized access.
AWS, Stripe, Resend and other providers may process information outside Portugal or the European Economic Area, including the United States. Contact privacy@contourfoundry.com for information about safeguards.
10. Children
The service is intended for people aged 18 or older and is not directed to children. We do not knowingly seek personal information from children under 13. If you believe a child has provided information, contact us so we can investigate and take appropriate steps.
11. Updates and contact
The version and effective date appear at the top of this page. We will update this policy as our service or legal requirements change and provide appropriate notice of material changes. We preserve the document associated with a recorded signup acceptance; a new policy does not overwrite that evidence.
Privacy contact: privacy@contourfoundry.com. Service support: support@contourfoundry.com. Postal address: Contour Foundry, Rua do Visconde de Anadia 11A, Funchal 9050-020 Madeira Portugal.