Privacy Policy

Geodesix is a service of Impact Tech, Inc. ("Impact", "we", "us"), 223 E. De La Guerra Street, Santa Barbara, CA 93101, USA. This policy explains what we do with personal information in connection with the Geodesix platform. Where Impact's general privacy policy at impact.com also applies, this policy governs Geodesix specifically.

Questions, or want to exercise a right? Email privacy@impact.com.

Who this policy is for

Three groups, with very different experiences of us:

• Account holders: retailers, publishers, creators and their teams who sign in to Geodesix.
• Visitors to our website: people browsing geodesix.com. The short version is in "Analytics on our website" below.
• Visitors to retailers' websites: people browsing a retailer's website where Geodesix is used to measure whether a citation was displayed. If that's you, the short version is in "Measurement on retailers' websites" below, and you can skip the rest.

Information about account holders

What we collect. Your name and email address, which is also how you sign in. Optionally a job title and time zone. Your password, which we store only as a cryptographic hash and never see. Which account you belong to and what you may do within it. When you last signed in.

We also keep the business records the service produces: the citations, placements and reporting associated with your account.

Where it comes from. From you, or from the colleague who invited you. There is no self-service signup; every account begins with an invitation.

Why we use it. To provide the service and keep your account secure; to send service email such as invitations and password resets; to bill retailers and pay publishers and creators; to prevent fraud and abuse; and to meet our legal obligations.

Our lawful basis (if you are in the UK or EEA) is performance of our contract with you or your organisation, our legitimate interest in operating and securing the service, and compliance with legal obligations such as tax record-keeping.

Information about enquiries

If you contact us or ask for an account through our website, we collect your name, email address, company website and whatever you write to us, and use it to reply and to consider your request.

Analytics on our website

This section is about our own website, geodesix.com. It does not describe the measurement on retailers' websites below, which works differently.

We use Google Analytics, loaded through Google Tag Manager, to understand how people use our website: which pages are visited, how visitors arrived, roughly where they are, and what kind of device they use. Google Analytics sets cookies named _ga and _ga_ followed by an identifier, which let it tell a returning browser from a new one. They expire after two years unless you clear them sooner.

• If you are in the UK, EEA or Switzerland, analytics is off unless you allow it. Nothing is set until you choose Allow.
• Everywhere else, analytics is on by default, and you can turn it off.
• You can change your choice at any time with Cookie settings at the foot of every page. Choosing Decline removes the Google Analytics cookies from your browser.
• We remember your choice in your browser's local storage so we don't ask on every page. That record holds your choice and nothing else.
• We do not use Google Analytics for advertising. Its advertising features and Google signals are turned off.

Google processes this information for us as our service provider, and it may be processed in the United States. Google states that Google Analytics does not log or store IP addresses. We keep analytics data for fourteen months.

Our lawful basis, if you are in the UK, EEA or Switzerland, is your consent, which you can withdraw at any time through Cookie settings. Elsewhere it is our legitimate interest in understanding and improving our website.

Measurement on retailers' websites

When you visit a retailer's website that displays a Geodesix citation, a small script records that the citation was shown, whether it was actually scrolled into view, and whether you clicked it. Alongside each of those we record the hostname of the page you came from, whether your device is a phone, tablet or computer, and your country.

We want to be specific about what we do not do, because it is unusual:

• We set no cookies and read none.
• We store nothing on your device. No local storage, no session storage, nothing.
• We create no persistent identifier. There is a random reference for each page view, held in your browser's memory and gone when you close the page, which exists only so we don't count the same event twice.
• We do not store your IP address. It is used momentarily to work out your country, and then discarded.
• We cannot tell that the same person visited two different retailers, and we have not built the means to.
• We do not sell or share this information, and we do not use it for advertising targeted at you across other websites.

Our lawful basis for this is our legitimate interest, and the retailer's, in knowing whether the content on their own pages was actually seen, and in billing accurately for it. Because we neither store nor read anything on your device, no cookie consent is required for it.

The retailer decides to use Geodesix on their site and is responsible for telling you so in their own privacy notice.

How long we keep information

Measurement data about visitors to retailers' websites is deleted or anonymised after ninety days, consistent with Impact's general practice. We keep aggregate totals, which identify nobody. Analytics data about visitors to our own website is kept for fourteen months.

Account and business records are kept while the account is open and for a reasonable period afterwards, and longer where we must for tax, accounting or legal reasons.

Who we share it with

We do not sell personal information.

We share it with service providers who help us run Geodesix, such as hosting, databases, email delivery, website analytics, security and fraud prevention, and payments. They act under contracts that limit them to acting on our instructions. We share it with other Impact companies where needed to provide the service. We will disclose information if the law requires it, and to protect our rights or someone's safety. If our business is sold or merged, information may transfer as part of it.

We don't list individual providers here because they change; email privacy@impact.com if you would like to know who they currently are.

Where information is held

We operate from the United States, and information is processed there. If you are in the UK, EEA or Switzerland, we rely on Standard Contractual Clauses, the UK Addendum, or another approved transfer mechanism to protect information that leaves your region.

Security

We encrypt information in transit. Access is restricted at the database itself, so that each customer's data is separated from every other's rather than relying on application code to keep them apart. Passwords are stored as hashes, checked against known breach lists when set, and must meet a published complexity standard. Sign-in and public forms are protected against automated abuse.

No system is perfectly secure, and we don't claim otherwise.

Your rights

If you are in the UK or EEA, you may ask us for a copy of your personal information, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. You may complain to your data protection authority. In the UK that is the Information Commissioner's Office.

If you are in California, you may ask what personal information we collect and why, ask us to delete or correct it, and opt out of its sale or sharing. We do not sell or share personal information, and we do not collect sensitive personal information as California law defines it. We will never treat you differently for exercising a right.

Other US states, including Virginia, Colorado, Connecticut, Texas, Oregon and Utah, give residents comparable rights, and we honour them on the same basis.

To exercise any right, email privacy@impact.com. We may need to verify who you are first, and we will respond within the time the law allows.

One honest limitation: if you are a website visitor, we usually cannot identify you from what we hold, and the law does not require us to collect more information in order to. If you tell us the retailer's website and roughly when you visited, we will do what we can.

Children

Geodesix is a service for businesses. It is not directed at children, and we do not knowingly collect information from anyone under 16.

Changes

We will post any change here and update the date at the top. If a change matters to account holders, we will email them.

Contact

Impact Tech, Inc. 223 E. De La Guerra Street, Santa Barbara, CA 93101, USA privacy@impact.com +1 (805) 324-6021