Data Controller
TerraLab SAS (SIREN: 104 501 861, RCS Paris), 173 rue de Courcelles, 75017 Paris, France, is the controller of your personal data. Privacy contact: yvann.barbot@terra-lab.ai.
Data We Collect
What we collect depends on what you use:
Account Data
Your email address, collected when you sign up with a magic link or register a free plugin. We use it for your account, support and updates.
Payment Data
Our payment processor handles payments. We never see or store your card number. To prevent repeated free trials we keep the card's one-way fingerprint and its country, also after your account is deleted.
Subscription Data
Plugin sign-in token, subscription status, usage per billing period and product information.
AI Edit
The area you select, your prompt and any reference images are sent for generation, with the area's location, extent, coordinate system and basemap. While you type, the prompt also goes to our servers in France to show a tip; it is not stored and not sent to the generation provider. Generation runs on a third-party image model on a global endpoint and may be processed outside the EU, under the EU-US Data Privacy Framework. The provider does not store these inputs after the request (they can stay in memory up to 24 hours), may log prompts and responses up to 30 days for abuse monitoring, and never uses them to train models. Your generations stay in your history on our servers in France (see Data Retention), so you can come back to them and we can support you.
AI Segmentation, on your own machine
Nothing you segment leaves your computer. The plugin still checks your licence and sends the diagnostics described below. Installing the on-device model downloads it from its publisher and the usual Python package sites.
AI Segmentation, Cloud AI clicks
Each click sends a small square of imagery around it to our servers in the EU, and the outline comes back. On Free we keep a technical copy of that square to measure and improve detection quality; you never see it, and you can object in your account settings or by email. On Pro no copy is kept. When you save an object, we store its outline and the area it covers, on EU infrastructure, for support and billing checks.
AI Segmentation, automatic detection
A run sends tiles of the zone you select, the object you type, any examples you draw, the zone outline, and the coordinates and coordinate system that place them, to our servers in the EU. We keep the tiles, the tiles with detections drawn on them, and the results, for your history, support and billing checks. On Free we also measure detection quality on them; on Pro we never do. Detailed masks leave our database 12 hours after they are created; if archiving them failed, they stay until the 12-month purge. When you press Finish, the polygons you kept are sent to us too.
AI Agent
A task sends your request, any attached image, the instructions, memory notes and profile saved in the plugin, earlier messages in the thread, the results of the QGIS actions it runs, and a description of the open project: file path, map extent, CRS and scale; each layer's name, type, CRS, feature count, field names and extent; one sample feature's attribute values for the first eight layers; your five latest Processing runs and three newest QGIS warnings. Layer contents and files stay on your computer, and secrets such as passwords in layer sources are masked first. On connection the panel also sends your sign-in token (stored only as a hash), a machine hash, plugin and QGIS versions, operating system and language. Open data queries go from the plugin straight to the service holding the data, which sees your IP address and the query, never your request text. Tasks are handled by our agent server in the EU and processed by a language model on our own cloud resource in the EU, which does not train on this data. The model provider may keep prompts and completions up to 30 days for abuse monitoring; we have requested the exemption and will update this policy when it is granted. On Free we keep conversations, steps and tool calls for 90 days, in our database in Paris and in a diagnostic file on the agent server, so you can reopen a thread and we can look into problems, and we read them to fix wrong answers and broken tools. The "Help improve AI Agent" switch in the plugin's settings stops that reading at no cost. On Pro we keep them for 30 days for the same reasons, and our team may read them; the same switch stops that reading, and the thread is still kept. Set History retention to 0 days, in the plugin's settings or your dashboard, and no transcript is stored. Under an Enterprise zero data retention contract no transcript is stored. Each model call also goes to our product analytics provider in the EU, linked to your account: the model, token counts, cost and duration. On Free, for runs our team may read (the "Help improve AI Agent" switch on, history kept), the request and the model's answer travel with it; on Pro, at 0 days of history and under zero data retention, never any text.
AI Agent, voice dictation
Voice dictation is optional and records only between your press on the microphone and your confirmation, 3 minutes at most. The clip goes to our agent server, which has a speech model on our own cloud resource in the EU turn it into text and puts that text in the message box; nothing reaches the agent until you press Send. Our server holds the clip in memory for that request and stores neither the audio nor the text; it records only the clip's length, its language, the outcome and the time taken. The model does not train on it, and the provider's abuse-monitoring terms above apply to it.
AI Agent, your own accounts
AI Agent can use your own accounts on data services: private databases and map servers (PostGIS, WMS, WFS, ArcGIS), NASA Earthdata and Copernicus Data Space. Your usernames, passwords, tokens and keys are stored only in the encrypted QGIS authentication database on your computer, protected by your QGIS master password. They never reach our servers or the language model, which sees only the connection's name, such as "NASA Earthdata". The plugin asks before each use of an account, once or for the whole conversation, and you can remove an account at any time in the plugin's Settings > Connected accounts. Data fetched with your account goes from the provider straight to your computer, not through our servers.
Diagnostics, all three plugins
The plugins report errors, plugin and QGIS versions, your operating system and the features you use, linked to your account, so we can fix what you run into. They never send your imagery, coordinates, layer names or full file paths. Turning them off in one plugin's settings turns them off in all three. With diagnostics on, AI Agent also records the country your connection comes from, read from your IP address when the plugin connects (the address itself is not stored), how long the plugin takes to start, and how often QGIS stopped responding during a task. Countries are read with DB-IP's IP to Country Lite database (IP Geolocation by DB-IP, https://db-ip.com), licensed CC BY 4.0.
Error Tracking
Errors from the plugins and the website are kept in our own event log and in our analytics tool, both in the EU, for 12 months, under our legitimate interest in service quality.
Analytics Data (with consent)
With your consent, we record page views, clicks and session recordings on every page except the blog. Text typed in forms is masked. An AI model run by our analytics provider may review some recordings to summarize what visitors did. You can decline analytics cookies at any time.
Website Interaction Data
Approximate location (country, city), device and browser type, and browsing behaviour, used to improve our services.
Free web tools
The format converters (KML, KMZ, GPX, GeoJSON, CSV, Shapefile), the coordinate and MGRS converters and the ogr2ogr command builder run in your browser: your files and coordinates never reach our servers. A file imported from a link is fetched by your browser, so that site sees your IP address. The building footprints and building height tools send the area you draw or view, and any place name you type, to our servers, which query our own geocoding and OpenStreetMap servers in the EU, IGN Géoplateforme, the Microsoft and Google open building datasets and our EU copy of Overture Maps. Those services never see your IP address. We do not store these requests; our host caches answers up to 7 days. Map backgrounds and satellite imagery load from our own servers in the EU, and aerial photos of France from IGN Géoplateforme; both see your IP address. Some tools keep your input in the page address so you can share a link; with analytics consent, that address is part of the recorded page view.
Student Price
For the student price we check a school email address. A student without one may email us a proof of enrolment, which we read only to confirm the status and delete within 30 days; we keep only the school, the confirmation date and the fact it was confirmed. Legal basis: steps taken at your request before a contract (Art. 6.1.b GDPR).
Device Identification
To secure licences and keep the free plans fair, our plugins create a technical device identifier:
- What it is: a one-way hash of a random value stored in your QGIS settings, or of your operating system's machine identifier. We never receive the underlying value, your computer's name, its hardware or your files. Because it can single out a computer, we treat it as personal data.
- Why: to detect an account shared between people, and to count free usage per computer so extra accounts on the same computer add no free usage. A paid account works on every machine you use.
- Accounts per computer: for each plugin we record which accounts are used on a computer, and when each was first and last seen there. Only the first two free accounts active on a computer in the last 60 days keep free use; paid and former paid accounts never count, and an account idle there over 60 days counts as new. A deleted free account active in the last 60 days leaves a pseudonymous marker (computer code, plugin and dates, with no link to you). A computer used to abuse the free plans can be excluded from free use; we review it on request.
- Legal basis: our legitimate interest in preventing fraud and abuse of our free plans (Article 6.1.f and Recital 47 GDPR) and the performance of your subscription contract (Article 6.1.b GDPR).
- Shared computer (a lab, a classroom) or a limit that looks wrong? Write to us: we can give that computer its own allowance. You can also object to this processing by email.
TerraLab app in ChatGPT and other AI assistants
The TerraLab app lets an AI assistant such as ChatGPT find places, extract open map data, read elevation and convert GIS files, without a TerraLab account. This section covers what happens when the assistant calls the app.
- What we receive: Only to answer your request: the place names, addresses, coordinates, areas and files you ask the assistant to process, and a hashed per-user identifier sent with each call (or, without one, a hash of the caller's IP address).
- What we log: For each call: the tool name, status, duration and number of results, without your query, file or IP address. Our open data service keeps the requested area (a bounding box) in its technical logs for 30 days, without any user identifier. The map shown in the chat also reports anonymous health counters (a fixed event name, a number and the app version), with no identifier, place or IP address.
- Usage statistics: To count how many people use the app, each call and each download is also logged with the assistant used (ChatGPT, Claude or another), the tool, its status, your country when the assistant sends it, and the format and size of downloaded files. We add a visitor identifier and a conversation identifier, computed with a keyed hash (HMAC) from the anonymous identifiers ChatGPT sends with each call, or for other assistants from the IP address combined with the date, so they change every day. They cannot be reversed into your identity or IP address, stay on our servers in the EU, and are deleted within 35 days. Our product analytics provider receives, without any identifier, the assistant, tool, status, country, download format and size, and for assistants other than ChatGPT a short sentence the assistant writes about why it calls the tool (we ask it to leave out names, addresses, coordinates and file names). Calls made with a connected TerraLab account are recorded the same way, without an account identifier. It never receives your IP address, request, place or file. Legal basis: our legitimate interest in measuring and improving the app.
- Rate limiting: The hashed identifier (or hashed IP address) is counted over a one-minute window to limit calls per minute, stays in server memory for at most two minutes, and is never written to disk. For calls from ChatGPT without a TerraLab account, a hash of ChatGPT's anonymous user identifier also stays in server memory for the current day to apply a daily limit, and is never written to disk.
- Files: Uploaded and linked files are processed in memory and not kept. Download files are not stored: each link carries its request and rebuilds the file when opened, so anyone with the link can rebuild it.
- Who processes it: Our servers in the EU host the app, our open data service and our geocoder. French addresses also go to the IGN Géoplateforme geocoder, and French parcel coordinates may go to IGN API Carto. Elevation tiles come from the Copernicus DEM copy on Amazon Web Services. The in-chat map loads aerial images from IGN. A file given by link is downloaded from its host. Links to terra-lab.ai carry utm campaign tags. Usage events go to our product analytics provider (EU), without any identifier.
- What we never do: We do not sell this data, use it for advertising or use it to train AI models.
- Contact and deletion: Questions or deletion requests: yvann.barbot@terra-lab.ai.
TerraLab account in AI assistants and the data API
When you connect an AI assistant or an agent to your TerraLab account, or call the data API or MCP server with an API key, the section above still applies and the following adds to it.
- What we store: Your account (email address, from sign-in). Your API keys: name, first 8 characters, a keyed hash of the key (never the key itself), creation, last use and revocation dates. Your connected applications: name, identifier, granted access, creation, last use and revocation dates, and hashed refresh tokens. A count of calls per day, and the date and client of your first call. No IP address.
- What we log for each call: Your account as a keyed hash (HMAC), how you signed in (connected application or API key), the assistant used, the tool, its status, duration and number of results. Never your query, place, coordinates, file or IP address. We hold the key, so we can link these logs to your account: they are pseudonymous, not anonymous. Kept 35 days at most.
- Product analytics: Connection events (application connected or revoked, key created or revoked, first call) are recorded with your account identifier in our product analytics. Each tool call is also recorded there without any account, session or other identifier: only the assistant used, the tool, its status, error code and duration, and a short sentence the assistant writes about why it calls the tool (we ask it to leave out names, addresses, coordinates and file names), or the feedback it sends about a missing tool. Never your query, place, coordinates, files or IP address.
- Rate limiting: Your account identifier is counted over a one-minute window in server memory and in the daily count above.
- Why, and on what legal basis: Contract performance (Article 6.1.b GDPR): signing you in, checking keys and applying your limits. Legitimate interest (Article 6.1.f GDPR): security, abuse prevention and measuring use of the service.
- How long: Keys and connected applications: until you revoke them or delete your account. Call logs: 35 days. Daily call counts: 13 months. Expired authorisation codes and refresh tokens: deleted within 35 days. Deleting your account deletes your keys, connections and counts.
- Who processes it: Our servers in the EU (the MCP server and data API), our account database in the European Union, and our website host for the sign-in and consent pages. The AI assistant you connect (ChatGPT, Claude, Cursor or another) is a third party you choose: it receives tool results under its own terms.
- Your control: Revoke keys and connected applications at any time in your dashboard. For any other request: yvann.barbot@terra-lab.ai.
Legal Basis for Processing
We rely on these legal grounds:
- Contract performance (Article 6.1.b GDPR): providing our services, managing your subscription and processing payments.
- Consent (Article 6.1.a GDPR): analytics cookies and session recordings. You can withdraw it at any time.
- Legitimate interest (Article 6.1.f GDPR): security, service improvement and account-linked plugin diagnostics.
- Legitimate interest (Article 6.1.f GDPR), improving the product: on Free we keep Cloud AI click squares for 12 months to measure detection quality, and we read AI Agent conversations kept for 90 days to fix wrong answers, broken tools and failure patterns. On Pro we read AI Agent conversations kept for 30 days for the same reasons; Pro click squares are never kept. Part of this reading is automatic: a language model notes whether each task was finished and scores a sample of them each day. You can object at no cost, with the "Help improve AI Agent" switch in the plugin's settings or by email, with no other effect on the service: the conversation is still kept so the thread survives our updates. On Pro, choosing 0 days of history stores no conversation at all, and also stops the other copies of your history. Enterprise zero data retention accounts are excluded. We do not train models on customer data today; if that changes, this policy and a settings switch come first.
- Legitimate interest (Article 6.1.f GDPR), free web tools: answering the area or place you ask about, and counting requests per IP address for 65 seconds to prevent abuse.
- Contract performance and legitimate interest (Article 6.1.b and 6.1.f GDPR), TerraLab account in AI assistants and the data API: signing in, checking API keys, applying limits, security and usage measurement, as described in that section.
Service Providers and Data Transfers
Providers that process data for us:
| Service | Purpose | Location | Basis |
|---|---|---|---|
| Database and authenticationUser accounts and data storage | User accounts and data storage | EU | Contract |
| Payment processingSubscription billing and invoicing | Subscription billing and invoicing | International | Contract |
| AI image generation (AI Edit)Image generation from the area you select, your prompt and reference images | Image generation from the area you select, your prompt and reference images | Worldwide (global endpoint; EU-US Data Privacy Framework) | Contract |
| AI detection (AI Segmentation)Object detection on the tiles and click squares you send | Object detection on the tiles and click squares you send | EU (our own infrastructure) | Contract |
| Prompt translation (AI Segmentation)Translating into English the object name you type (8 words at most), when the plugin cannot do it on your computer. Each phrase is translated once and kept in a shared dictionary with no link to your account | Translating into English the object name you type (8 words at most), when the plugin cannot do it on your computer. Each phrase is translated once and kept in a shared dictionary with no link to your account | Worldwide (global endpoint; EU-US Data Privacy Framework) | Contract |
| AI Agent language modelPlanning and answering AI Agent tasks, and checking their quality | Planning and answering AI Agent tasks, and checking their quality | EU (abuse-monitoring exemption requested) | Contract |
| AI Agent speech modelTurning a dictated clip into text | Turning a dictated clip into text | EU | Contract |
| AI Agent serverRunning AI Agent conversations and their QGIS actions, with one diagnostic file per task kept 90 days (30 days on Pro, none at 0 days of history) | Running AI Agent conversations and their QGIS actions, with one diagnostic file per task kept 90 days (30 days on Pro, none at 0 days of history) | EU | Contract |
| Image storagePlugin inputs, outputs, reference images, segmentation tiles and Cloud AI click squares | Plugin inputs, outputs, reference images, segmentation tiles and Cloud AI click squares | EU | Legitimate interest |
| Website hostingWebsite delivery and performance | Website delivery and performance | International (functions run in Paris; EU-US Data Privacy Framework) | Contract |
| Product analyticsWebsite analytics and session recordings (consent); account-linked plugin diagnostics (legitimate interest); AI Agent model-call traces and TerraLab app tool usage (legitimate interest) | Website analytics and session recordings (consent); account-linked plugin diagnostics (legitimate interest); AI Agent model-call traces and TerraLab app tool usage (legitimate interest) | EU | Consent / Legitimate interest |
| Transactional emailsAuthentication and notification emails | Authentication and notification emails | United States (EU-US Data Privacy Framework) | Contract |
| Rate limitingOne request counter per IP address or account, kept 65 seconds, against abuse of the free tools and plugin services | One request counter per IP address or account, kept 65 seconds, against abuse of the free tools and plugin services | EU (Ireland) | Legitimate interest |
| Open data lookups (free tools)IGN Géoplateforme and the Microsoft and Google open building datasets, queried from our server, never with your IP address | IGN Géoplateforme and the Microsoft and Google open building datasets, queried from our server, never with your IP address | EU and international | Legitimate interest |
| Map backgroundsBackground maps and satellite imagery from our servers in the EU, aerial photos of France from IGN Géoplateforme, loaded by your browser | Background maps and satellite imagery from our servers in the EU, aerial photos of France from IGN Géoplateforme, loaded by your browser | EU | Legitimate interest |
| Website audience measurementAggregated page view counts with no cookie and no cross-site tracking | Aggregated page view counts with no cookie and no cross-site tracking | International (EU-US Data Privacy Framework) | Legitimate interest |
| Website translationMachine translation of website pages | Machine translation of website pages | International | Legitimate interest |
For transfers outside the EU we rely on the EU-US Data Privacy Framework where the provider is certified (AI Edit image generation, email delivery, hosting), and on Standard Contractual Clauses otherwise (payments).
Pre-filled under Article 28(3) GDPR with TerraLab as processor. Complete the controller block, sign it and send it to our privacy contact. We reply with the named list of sub-processors, and we email you 30 days before any change. Download the DPA (PDF, October 2026)
Data Retention
We keep data only as long as needed:
- Account data: until you delete your account or ask us to. Encrypted backups still holding erased data are deleted within 12 months and 7 days.
- Payment data: kept by our payment processor under its policy and legal obligations. Invoices: 10 years, as French commercial law requires (Code de commerce, article L123-22).
- Plugin imagery (AI Edit inputs, outputs and reference images; AI Segmentation input tiles, the same tiles with detections drawn on them, and the returned masks): on EU infrastructure for the lifetime of your account. Deleted with their preview copies on account deletion, earlier on request, or on Pro at the age you choose.
- Cloud AI click squares: technical copies kept 12 months on Free, never on Pro. Squares can pass through a technical cache deleted within one day; no person reads it, only our servers read it back to avoid asking the plugin to resend the square. Saved outlines and their areas: lifetime of your account, or earlier on request. Hover previews are never stored.
- Usage records: your subscription plus 12 months, for billing. AI Agent task and connection records (plugin and QGIS versions, operating system, language, country, hashed sign-in token and machine): 365 days, with request text blanked after 90 days.
- AI Agent transcripts: Free, 90 days. Pro, 30 days, none at 0 days of history. Enterprise zero data retention, never stored.
- Device identification: per-computer free-usage counts, 60 days. Refused free tasks, 90 days. Accounts seen per computer, 60 days after last seen there. Markers left by deleted free accounts, 60 days after their last use. Exclusions after abuse, as long as they last.
- Operational logs: Free, 12 months; Pro, 90 days. Analytics: 25 months at most. Product analytics on Free is linked to your account (opt-out); on Pro it holds lifecycle events and counts only, no content.
- TerraLab app in AI assistants: usage logs with hashed visitor and conversation identifiers, deleted within 35 days. Usage events in our product analytics follow the analytics period above.
- TerraLab account in AI assistants and the data API: call logs linked to your account by a keyed hash, 35 days. Daily call counts, 13 months. Keys and connected applications, until revoked or your account is deleted.
- Free web tools: files and coordinates opened in the browser tools never reach us. Building-tool requests are not stored; cached answers expire within 7 days. Rate-limit counters: 65 seconds.
- Your history: Free, until you delete it or your account. Pro, your choice in any plugin's settings or your dashboard: 0 days, 30 days, 90 days, 6 months, 1 year, or until you delete it. At 0 days no copy is written, except AI Edit generations and saved outlines, which stay until you delete them. New Pro accounts start at 30 days; accounts on Pro before 6 October 2026 start at 0 days. A limit keeps applying if your plan ends. Enterprise, set by contract.
- Who sees your work: on Free, you and our team when it measures detection quality or looks into a problem; on Pro, you alone, except AI Agent conversations, which our team may read to look into failures and improve the agent; on Enterprise zero data retention, you alone. Pro and Enterprise history is never used to measure detection quality or train a model.
- Zero data retention: Enterprise contracts only, on request. No tile, click square, run export or AI Agent transcript is written, and the results history lasts as long as the contract says, down to one day. AI Edit is the exception: the image you send and the result are kept at least one day so the plugin can download the result.
- Student price proof of enrolment: read only to confirm the status, deleted within 30 days. We keep only the school, the confirmation date and the fact it was confirmed (Art. 6.1.b GDPR, steps taken at your request before a contract).
Your Rights (GDPR)
Under the GDPR, you have the right to:
- Right of access: Obtain a copy of your personal data
- Right to rectification: Correct inaccurate data
- Right to erasure: Request deletion of your data
- Right to restrict processing: Limit data processing
- Right to data portability: Receive your data in a portable format
- Right to object: Object to processing based on legitimate interest
You can download the personal data we hold about you at any time from the Account section of your dashboard (GDPR Art. 20); the file is JSON and image links stay valid for 24 hours. For any other right, write to yvann.barbot@terra-lab.ai. We answer within one month, extendable by two months for complex requests (GDPR Art. 12(3)).
You also have the right to lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, www.cnil.fr.
Updates
We may update this policy. We email registered users about material changes.
Last updated: