Data Protection / GDPR Compliance

Have questions?

Should you have any questions about this topic feel free to write to write to us at dataprotection @ opencagedata.com or via our contact form.

What data do we collect?

On our website:

Our website (as opposed to our geocoding API) is hosted by Heroku, a division of SalesForce, in Europe.

On our website we use Fathom Analytics to help us understand, in anonymized form, how the site is being used. Fathom does not track or store any personal data, and we have set our account such that all data the collect stay entirely in the EU. Please see the Fathom data policy. We're delighted by Fathom's privacy focus, and are happy to recommend the service to others. If you too would like to try out Fathom, here's an affiliate link for $10 off.

To display maps on our geocoding demo page we use map tiles from Thunderforest. Please see Thunderforest's privacy policy.

Unfortunately we occasionally see people trying to abuse our demo page or to signup many accounts as a way to exploit our free trial. In this case we may use hCaptcha (see privacy policy), tests as a way to verify that requests are from a human and thus prevent high volume abuse. Please read our blog post to learn more.

For speed we host some static content on jsDelivr's Content Delivery Network (CDN). Please see jsDelivr's privacy policy.

When registering for our geocoding free trial tier, you need to provide us with an email address. We then confirm that the address works by emailing you a confirmation link. We need an email address so we can contact you regarding any changes to our service or, for example, to this privacy policy. We send the email to you via the email delivery service Postmark, which is operated by Wildbit LLC. Wildbit's privacy policy.

We store the IP address you used when you register. We do this so we can detect when people try to abuse the service by registering for multiple accounts.

In addition, at the time of registration we ask for (but do not require) a few other bits of information like name, how you found out about our service, and which programming languages you use. We ask these questions so we can better help you get started with using our service. You answers are stored in a database within Heroku and accessible to our employees. You can see the information you provided us with on your account dashboard.

Our user database is encrypted and regularly backed up to rsync.net in Switzerland. Rsync has no ability to unencrypt this information.

Registering for our services requires acceptance of our publicly available terms and conditions.

Our status page is hosted by Instatus.

When launching new services we may ask if you wish to join an early access list. We collect emails for such lists using forms hosted by Reform.

Via our API:

Our geocoding API servers are leased from hosting service Hetzner, and physically at multiple locations in the EU (in Germany and Finland, specifically). All of Hetzner's datacenters are certified in accordance with DIN ISO/IEC 27001, an internationally recognized standard for information security. Please see the Hetzner statement on security and privacy (pdf).

When you send us a geocoding API request we send you a response and then log the query. We later analyze the logs to see how we can improve our service. All logs are deleted after six months.

While you should only ever be sending us geographic data and NOT personal data, if you use the optional no_record parameter when calling the geocoding API, we will not store your query in our logs. In this case we have no record of what the query was. We encourage you to use this parameter.

Customer/Financial transaction information:

If you become a paying customer (as opposed to just using our free trial) you will need to provide us and our payment partners (Stripe for the billing, Quaderno for the invoicing) with valid billing information. We will be able to see your name, billing address, email address, and VAT number (if you have provided one). We are not able to see your credit card number, only Stripe has access to that. Once you are no longer a customer you can, with a single click in your account dashboard, delete your billing information.

As you would expect of any business, we of course share transaction data with our accountants and with the relevant tax authorities when we pay VAT and file our annual tax return.

In addition, we use the business analytics service Baremetrics for internal business analysis. They also have details of customer purchasing history.

• Stripe's privacy policy
• Quaderno's GDPR compliance
• Baremetrics's GDPR policy

Data Processing Agreement

Becoming a customer of our service implies acceptance of our Data Processing Agreement, unless otherwise explicitly agreed with us in writing.

Data deletion

Any user (paid or free trial) can request to have their account deleted at any time, this can be done inside your account dashboard or by contacting us.

Geocoding free trial accounts that have not been active (defined as having made at least one API request or logged into their account dashboard) for three months are deleted automatically.

For paying customers we of course have to keep records of all completed transactions for tax purposes.

Last updated

This document was edited on:

Reporting issues

We make every effort to keep your data secure. If you find a vulnerability please report it to security @ opencagedata.com, we will follow up with you promptly. You can find our public key on our security.txt. Thank you.

We welcome vulnerability reports via our security bounty program.

Stay informed

Meaningful changes to this document will be announced on our Mastodon account and our blog.