Privacy Policy

Effective 22 August 2026 · Covers reliefmapper.org and the ReliefMapper application.

Controller

Panóplia Positiva Unipessoal Lda, trading as OneSevenOh Innovations, Avenida Heróis do Ultramar, 3100-462 Pombal, Portugal — innovations@onesevenoh.com.

The short version

We never see the areas you draw. They live in your browser and,
  if you connect one, in your own OneDrive or Google Drive. We operate no file
  storage. The only personal data we hold ourselves is a register of who signs in: name,
  email address, provider and dates.

What we process, and why

1. Your work — areas, sectors, projects

Polygons, sectors and project files are created on your device. While you work they are held in your browser's local storage so that closing the tab does not lose them. When you save to the cloud, the file is written directly from your browser to your own drive. It does not pass through us, and we hold no copy. Exports are generated on your device and downloaded by you.

2. Our user registry

When you sign in, we record your name, email address, sign-in provider, the identifier your provider gives us, the first and last time you signed in, and how many times you have signed in. We keep it so that we know who uses ReliefMapper and can operate, support and improve it — Art. 6(1)(b) GDPR (performing the service you asked for) and Art. 6(1)(f) (our legitimate interest in knowing our own user base). This register is never sold, never shared for marketing, and never used to profile you. It holds no information about your operations.

Retention: for as long as your account is in use, and up to 24 months after your last sign-in. Ask us and we delete your entry sooner.

3. Signing in with Microsoft or Google

Authentication happens at Microsoft or Google. We never see or store your password. Your provider tells us your name, email address and a stable identifier, and gives the application permission to write to the folder it creates for your projects — the Apps/ReliefMapper folder of your OneDrive, or a ReliefMapper folder in your Google Drive, limited to files this application creates. The access token stays in your browser; signing out ends the connection. Their own policies apply to what they do: Microsoft · Google.

4. The map — OpenStreetMap

The application is a map. To display it, your browser loads tiles from OpenStreetMap, and the search box queries Nominatim — both services of the OpenStreetMap Foundation, a UK non-profit. They receive what any website receives (your IP address and the tiles or search terms you request), set no advertising cookies, and are governed by the OSMF privacy policy. This is strictly necessary to provide what you asked for: a mapping tool cannot work without a map. We chose OpenStreetMap over commercial providers precisely because it carries no advertising ecosystem. Everything else — the map engine, the geometry and export libraries — is served from this site, not from third-party networks.

5. Technical connection data

Our hosting infrastructure processes the data your browser sends (IP address, pages requested) to deliver the site and protect it from abuse — Art. 6(1)(f) GDPR. These logs are not used to identify visitors.

6. Email

If you write to us, we process your address and message to reply — Art. 6(1)(b)/(f) GDPR — and keep the correspondence no longer than the exchange requires.

Cookies and what stays on your device

This site sets no cookies. The application does use your browser's local storage, strictly to give you what you asked for: your current work, your saved projects, your language, and — once installed — a cache of the application and of map tiles you have already viewed, so it works offline. None of this leaves your device, none of it is used for tracking, and all of it falls under the "strictly necessary" exemption of the ePrivacy rules. That is why there is no cookie banner: there is nothing to consent to. Clearing your browser data clears all of it.

We also keep anonymous, aggregate usage counters — plain "how many" numbers for clicks and page views, with no cookies, no IP addresses and no identifiers. They cannot be linked to any person.

Who else sees your data

Our hosting and database provider processes data on our behalf under a data processing agreement, and Microsoft or Google when you choose to sign in with them. Nobody else. We do not sell personal data and we run no advertising. Where a provider processes data outside the EEA, it does so under the European Commission's standard contractual clauses or an adequacy decision.

Your rights

Under the GDPR you may request access, rectification, erasure, restriction and portability, and you may object to processing based on legitimate interest — write to innovations@onesevenoh.com and we will answer within one month. You may also complain to the Portuguese supervisory authority, CNPD (www.cnpd.pt).

Children

ReliefMapper is a tool for operators and is not directed at children. We do not knowingly hold data about anyone under 16.

Changes

If this policy changes, the effective date above changes with it, and material changes will be signalled on the site before they take effect.