Privacy Policy

Last updated: July 2026

What data we collect

When you use the Austin Geospatial Innovation, we collect and process the following:

• Your messages — sent to Google Gemini (via the Gemini API) to generate responses. Messages are not retained by Google beyond the API request lifecycle per the Gemini API Terms. Your messages are also screened by Google Cloud Model Armor for content safety before reaching the language model.
• Your identity — for subscribers via the GCP Marketplace, your stable account identifier and email come from Google's Marketplace SSO JWT (verified server-side against Google's published keys). For direct sign-ins, your email comes from Google Sign-In. Identity is used solely for access control, session ownership, and admin authorization. We do not share, sell, or use your email for marketing.
• Session data — chat history (messages, tool calls, tool responses), generated maps, charts, thumbnails, and reports are stored in a database and storage bucket associated with the service. Sessions can be deleted by the user at any time.
• Custom scripts — if you save a script, the code, parameter definitions, and your current parameter values are stored in a database on the server. Scripts are associated with your user ID and can be deleted at any time.
• AI-generated code — the agent writes and executes Python code on your behalf. This code runs in a sandboxed environment and the execution output (stdout, stderr, generated files) is stored as part of your session. All AI-generated analyses, maps, and reports may contain errors or misrepresent conditions and should be independently verified before use in decision-making.
• Earth Engine queries — geospatial computations are executed via Google Earth Engine using a shared service account. Your queries are subject to the Earth Engine Terms of Service.
• Usage metrics (for billing and enforcement) — for each request we record the number of language-model tokens consumed (input, output, cache reads/writes) and the Earth Engine EECU-time attributed to your account. These figures are converted into Cloud Data Units (CDUs, the billing unit for your subscription) and stored per-user in the service database. This data is used to enforce your subscription’s monthly and rolling-window caps, to compute overage charges, to render the usage panel you see at /usage, and to invoice you accurately. It is never sold, shared with unrelated third parties, or used for advertising.
• Payment data (if you subscribe directly) — if you sign up outside of Google Cloud Marketplace, our third-party payment processor (Stripe or equivalent, named on the checkout page) collects your card details and billing address directly. Provider does not see or store your full card number. Provider does receive the subscription status, the billing email, the last four digits of the card, and the amounts charged, so that the account UI can reflect billing state accurately. Marketplace-channel customers do not share any card data with Provider at all — Google is the merchant of record.
• Session cookie — a single server-signed session cookie (HttpOnly, Secure, SameSite=Lax) is set at sign-in so subsequent requests know who you are. The cookie carries only your opaque identifier, email, and role — no tracking payload — and is deleted when you sign out. See "Cookies" below for the full list.
• Theme preference — your light/dark theme choice is stored in your browser's localStorage. This is not sent to the server.

Cookies

The Service uses two kinds of cookies:

First-party (set by the Service itself — strictly necessary)

• austin-geo_session — HttpOnly, Secure, SameSite=Lax, server-signed. Carries the signed session payload (subject id, email, role, source). Lifetime: 24 hours by default; cleared at sign-out. Without this cookie the Service cannot recognize you between requests.
• marketplace_pending — HttpOnly, Secure, short-lived (~10 minutes). Set only during the Marketplace SSO round-trip while a buyer’s entitlement is still provisioning; cleared as soon as the entitlement activates and the primary session cookie is issued.

Third-party analytics

Google Analytics is disabled on this deployment (google_analytics_id is unset or set to a disabled value). No analytics or advertising cookies are set.

The Service does not set advertising cookies of its own and does not load any advertising or cross-site tracking scripts.

Sub-processors

The Service processes Customer Data through the following sub-processors. Each acts under a data-processing agreement or industry-equivalent contractual protection:

• Google Cloud Platform — hosting (Cloud Run), object storage (GCS), Cloud SQL / per-tenant Postgres, Cloud Logging, Cloud Model Armor. Region determined by the tenant’s deploy configuration.
• Google Gemini API — language-model inference. Request payloads are processed by Google per the Gemini API terms and are not retained by Google beyond the request lifecycle.
• Google Earth Engine — geospatial compute + data.
• Google Maps Platform — Street View, Places, geocoding (only for prompts that use those tools).
• Google Cloud Marketplace — entitlement lifecycle, invoicing, and payment processing for Customers who subscribe via the Marketplace channel.
• Third-party payment processor (e.g. Stripe) — invoicing and payment for Customers who subscribe directly (outside of Marketplace). The processor in use at any given time is named on the checkout page.

Provider will provide reasonable advance notice of any material change to the sub-processor list; continued use of the Service after such notice constitutes acceptance of the new processor.

Your rights over your data

Depending on where you are located, applicable privacy law (GDPR in the EEA and UK, CCPA/CPRA in California, LGPD in Brazil, and other regional statutes) may give you the following rights over the personal data we hold about you:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct data that is inaccurate or incomplete.
• Deletion — ask us to delete your data. Session data is user-deletable from the Sessions panel at any time; on request we will also delete your account record, saved scripts, and consumption history, subject to any legal retention obligations.
• Portability — receive your data in a machine-readable format for transfer to another controller.
• Objection / restriction — object to, or ask us to restrict, particular processing activities where the law permits.
• Complaint — lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at the address in the "Contact" section below. We may need to verify your identity before acting on a request. We do not sell personal data or share it with third parties for cross-context behavioral advertising as defined by CCPA/CPRA.

What data we do NOT collect

• We do not set advertising cookies of our own and we do not embed any cross-site behavioral-advertising trackers on the Service’s pages.
• Google Analytics is disabled on this deployment. We do not use any analytics or telemetry product beyond the standard Cloud Run request logs kept by our hosting provider.
• We do not access your Google Drive, Gmail, Calendar, Photos, or any other personal Google services.
• We do not sell your personal data, and we do not share your identity, chat content, or generated outputs with unrelated third parties.

Shared sessions

You can share a session via a link. When you share a session:

• The recipient can view your full chat history and all generated artifacts (maps, charts, thumbnails) for that session.
• The recipient can clone (copy) the session into their own account to continue the conversation independently.
• Sharing does not grant the recipient access to your other sessions, scripts, or account settings.
• You can delete a shared session at any time, which removes it for all viewers.

Content screening

All user messages and model responses are screened through multiple safety layers:

• Local filters — regex-based detection of prompt injection, code injection, data exfiltration attempts, and social engineering.
• Google Cloud Model Armor — cloud-based content safety screening (when configured) for hate speech, dangerous content, and prompt manipulation.
• Sandbox enforcement — all executed code runs in a restricted environment that blocks filesystem access, network calls, and system operations.

Content that triggers these filters is blocked and not forwarded to the language model or executed.

Data retention

Different categories of data have different retention rules. Deleting a session removes the content of that session (messages, generated artifacts) but does not erase the billing / accounting record of what compute you consumed — those figures must be retained to invoice you accurately, to reconcile with our upstream cloud bills, and to satisfy tax and audit obligations.

• Sessions — retained until you delete them. Deleting a session removes the chat messages, tool calls, tool responses, agent-written code, and every artifact file (maps, charts, thumbnails, filmstrips, reports) associated with that session. Deleting a session does not undo the billing charge for the compute already consumed in that session.
• Custom scripts — retained until you delete them. Script code, parameter definitions, and your saved parameter values are removed on deletion.
• Account record — retained while your subscription is active and for a reasonable period afterward for offboarding. Explicit deletion is available on request under Section "Your rights over your data"; where allowed we replace the record with a tombstone rather than a hard delete so foreign-key integrity for historical billing / audit rows is preserved.
• Usage metrics and billing history — per-user CDU consumption (Gemini token counts, EE EECU-time), grants, top-ups, subscription state, invoices, and payment references are retained even after you delete individual sessions. Typical retention is seven (7) years to satisfy US federal / state tax-record requirements and equivalent obligations in other jurisdictions where we operate. Retention may be shorter for pre-subscription free-trial usage.
  • These retained records store only aggregated / metered numbers and identifiers (your account email, session id, question id, timestamp, CDU count, source). They do not retain your chat messages, prompt content, or the generated artifacts — those are removed with the session as described above.
  • You can request permanent deletion of your billing history under Section "Your rights over your data"; we will delete or anonymize where legally permitted (typically after any active regulatory retention window elapses).
• Session cookies — cleared at sign-out or at the 24-hour session expiry, whichever comes first.
• Server logs — standard Cloud Run request logs and Cloud Logging entries are retained per Google Cloud's default retention policy (typically 30 days for _Default logs, 400 days for _Required). We do not extend these defaults for behavioral analytics purposes.

Third-party services

The Austin Geospatial Innovation integrates with the following third-party services, each with their own privacy terms:

• Google Gemini API — language model processing
• Google Earth Engine — geospatial data and computation
• Google Cloud Platform — hosting, storage, and Model Armor
• Google Maps Platform — Street View and Places API (when used)

Contact

For questions about this privacy policy, contact the austin_geo team at ihousman@redcastleresources.com.