plotvera

Privacy Policy

Privacy Policy

This policy explains what personal data plotvera processes, why, on what legal basis, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR). We keep data collection to what the service needs to work.

Last updated 17 July 2026

1. Who is responsible

The controller for the personal data described here is Nastia Research, a company registered in France, operating as plotvera. For any privacy question, or to exercise your rights, contact [email protected].

2. Data we process

  • Account data. When you register with email and password, or with Google sign-in, we process your email address, authentication details and basic profile information. Sign-in and sessions are handled through our authentication library, Better Auth. Passwords are stored only as salted hashes; we never see your Google password.
  • Organisation, plot and supplier data. The core content you enter, such as company details, supplier records, plot geolocation geometries and production dates, is stored in our PostgreSQL database so you can build and keep your due diligence records.
  • Compliance documents. Due diligence statements, screening reports and document packs that the service generates for you.
  • Payment data. When you subscribe or buy credits, Paddle, our payment provider and Merchant of Record, processes your payment and issues your invoice. We receive confirmation and limited billing metadata, such as the last four digits and status, but not your full card number.
  • TRACES credentials. If you choose to prepare submissions for the EU TRACES system, any credentials you provide are encrypted at rest and used only to carry out the action you request.
  • Support and email. If you contact us, we keep the correspondence. Transactional email, such as verification and account notices, is sent through Zoho.
  • Technical data. Basic server logs needed to run and secure the service, such as IP address and request metadata.

3. Why we process it and the legal basis

  • To provide the service - creating your account, storing your records, running validations and screening, and generating documents. Legal basis: performance of our contract with you (GDPR Article 6(1)(b)).
  • To take payment - processing subscriptions and credits. Legal basis: performance of our contract and compliance with our accounting obligations (Article 6(1)(b) and 6(1)(c)).
  • To keep the service secure and working - logging, abuse prevention and troubleshooting. Legal basis: our legitimate interest in a secure, reliable service (Article 6(1)(f)).
  • To meet legal obligations - for example retaining billing records. Legal basis: legal obligation (Article 6(1)(c)).

We do not use your data for advertising, and we do not carry out profiling that produces legal or similarly significant effects on you.

4. Processors and third parties

We use a small set of service providers that process data on our behalf under data processing terms. They act on our instructions and only for the purposes below.

  • Paddle - payment processing and invoicing (Merchant of Record).
  • WHISP / Open Foris - satellite deforestation screening. When you run a screening, we send the plot geometry you provided to this service for analysis so it can return a result. We send geographic coordinates for analysis, not your account identity.
  • Zoho - transactional email delivery.
  • Hosting and database providers - to run the application and store your data securely.
  • EU TRACES - only if you choose to prepare or send a submission, using credentials you provide.

We do not sell your personal data, and we do not share it for others' advertising.

5. International transfers

We aim to process data within the EU or European Economic Area where we can. Some providers listed above may process data outside the EEA. Where that happens, we rely on an adequacy decision or on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguards that apply.

6. Cookies

We use only the cookies needed to run the service, chiefly a session cookie that keeps you signed in. We do not use advertising cookies or third-party tracking cookies, and we do not build advertising profiles. Because these cookies are strictly necessary to provide the service you asked for, they do not require consent under the ePrivacy rules.

7. How long we keep data

  • Account and content data is kept while your account is active. If you close your account, we delete or anonymise it within a reasonable period, except where we must keep something for a legal reason.
  • EUDR compliance documents. The due diligence records the service generates are retained so they remain available for the five-year record-keeping period that the EUDR expects for due diligence documentation, unless you ask us to delete them earlier and no legal obligation requires us to keep them.
  • Billing records are kept for the period required by tax and accounting law.
  • Server logs are kept for a short period for security and diagnostics.

8. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy;
  • have inaccurate data corrected;
  • have your data erased where the law allows;
  • restrict or object to certain processing;
  • receive your data in a portable, machine-readable format;
  • withdraw any consent you have given, without affecting past processing.

To exercise any of these, email [email protected]. You also have the right to complain to your local data protection authority if you believe we have not handled your data properly.

9. Security

We use technical and organisational measures to protect your data, including encryption in transit, encryption at rest for sensitive items such as TRACES credentials, access controls, and hashed password storage. No system is completely secure, but we work to keep risk low and to respond quickly to incidents.

10. Children

plotvera is a business tool intended for adults acting for an organisation. It is not directed at children, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy as the service evolves. If we make a material change we will take reasonable steps to notify you, and we will update the date above.

12. Contact

For any privacy question, email [email protected]. Operator details are on our Legal notice page, and our Terms of Service cover how the service itself may be used.