Privacy Policy

1. Data Controller

Complex Earth ("we", "our", or "us") operates the Habitat IQ application. We are committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data We Collect

We collect and process the following categories of personal data:

• Account Information: Name, email address, and password (encrypted)
• Usage Data: Information about how you use our service, including search queries, project data, and species selections
• Technical Data: IP address, browser type, device information, and cookies
• Location Data: Geographic coordinates of areas you search (polygon data)
• API Usage: Logs of API calls for service improvement and billing purposes

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To provide you with our biodiversity analysis services
• Legitimate Interests: To improve our services, ensure security, and prevent fraud
• Consent: For analytics and optional features (you can withdraw consent at any time)
• Legal Obligations: To comply with applicable laws and regulations

4. How We Use Your Data

We use your personal data to:

• Provide and maintain our biodiversity analysis services
• Process your searches and generate species reports
• Communicate with you about your account and services
• Improve and personalize your experience
• Ensure the security and integrity of our platform
• Comply with legal obligations

5. Data Sharing

We may share your data with:

• Third-party APIs: GBIF, OpenAI (for species enrichment), Wikipedia, and IUCN for biodiversity data
• Service Providers: Hosting, analytics, and infrastructure providers who assist in operating our service
• Legal Authorities: When required by law or to protect our rights

We never sell your personal data to third parties.

6. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Until account deletion plus 30 days for recovery
• Project Data: Until you delete the project or your account
• Usage Logs: 90 days for operational purposes
• Legal Records: As required by applicable law

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit processing of your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain types of processing
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at: privacy@complexearth.com

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (HTTPS) and at rest
• Regular security assessments and updates
• Access controls and authentication measures
• Regular backups and disaster recovery procedures

9. International Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). When we do so, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Cookies

We use cookies and similar technologies to:

• Essential Cookies: Required for authentication and core functionality
• Analytics Cookies: To understand usage patterns (with your consent)
• Preference Cookies: To remember your settings and preferences

You can manage cookie preferences in your browser settings.

11. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us.

12. Contact & Complaints

Data Protection Officer:

Email: support@complexearth.com
Address: Complex Earth Limited, 80-83 Long Lane, London, England, EC1A 9ET

If you're not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority.