Privacy Policy

Version 1.1 · effective September 29, 2026

This policy explains what VSSGEO collects, why, who helps us process it, how long we keep it, and your choices. VSSGEO is run by Vista Site Selection, LLC (“Vista”, “we”), 52 East Gay Street, Columbus, Ohio 43215. Vista is the business responsible for this information. This policy covers VSSGEO only. Vista’s company website, vistasiteselection.com, has its own privacy policy.

1. What we collect

You give us

• Account details: username, email address and password. The password is stored only as a salted scrypt hash. If you use Sign in with Google, we receive your Google account ID, name, email address, whether Google has verified it, and your profile picture link. If you turn on two-step sign-in, we keep the key your authenticator app uses (encrypted) and one-way hashes of your recovery codes. We never store the codes your app shows.
• Profile: name, company and what you use VSSGEO for, if you add them. Also your email preferences.
• Your content:
  • questions and stories you tell Geo;
  • places and areas you search for or draw;
  • projects and sessions;
  • files you upload (up to 50 MB each), plus the text we extract from them so Geo can read them, and the map layers made from them;
  • shops you add;
  • property listings you submit;
  • feedback, ratings and messages you send us, including to [email protected].
• Billing: your plan, orders and receipts, your Stripe customer and subscription reference, and, if you cancel, the reason you give. Stripe collects your card details. We see only the card brand, the last four digits and the expiry date, to show them to you.

Collected as you use VSSGEO

• Activity in the app:
  • the actions you take: clicks, searches, map views, tools used, downloads, and questions and answers;
  • the sessions they belong to;
  • the credits and AI usage (such as token counts) each one took.
  This powers your history, your saved sessions, your usage and receipts, and support. When you copy text in VSSGEO, we note only that you copied and how many characters, never the text. If you speak a question, we receive only the text.
• Sign-in and security records: sign-in attempts and their outcomes (including each two-step sign-in step, never the codes themselves), a label for each device you sign in on, and your browser’s user-agent string. Your IP address is stored only as a keyed hash; we use it to spot abuse, such as mass sign-ups, not to find or follow you. Our network provider, Cloudflare, handles IP addresses to deliver and protect the service.
• Server records: each request to VSSGEO: the page or API used, the time, the result and the size.
• Emails we send you: a copy of each message, for your records and ours.

We don’t ask for your device’s location. VSSGEO shows you information about places; it does not track where you are.

2. How we use it

• To provide VSSGEO:
  • answer your questions, build your maps and reports, and save your sessions and projects;
  • keep track of your credits, plan and receipts.
• To take payments, prevent fraud and meet our tax and accounting duties.
• To send service emails: confirming your email address, password resets, receipts, billing notices, replies to your questions and account changes. Other emails follow your email preferences, and you can switch them off.
• To keep VSSGEO and its users safe. This means spotting abuse (such as accounts created to farm free credits), investigating problems and enforcing our Terms.
• To support you. Authorized Vista staff can see account and activity records when that’s needed to help you or to run VSSGEO. Staff can also create an account for you, email you a link to set your password or set a temporary one, turn an account off or back on, change who is Vista staff, and turn off two-step sign-in if you lose your phone. Staff never see your password or your two-step sign-in key, and every one of these actions is recorded with the staff member who took it.
• To improve VSSGEO: understanding which features help, what goes wrong, and what things cost to run. Where we use your information for this beyond running your own account, we de-identify it or combine it with others’ information.
• To comply with the law and respond to lawful requests.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We don’t use your content to train AI models that others use. We don’t make decisions about you that have legal or similarly significant effects based solely on automated processing.

3. Who processes it for us

We use these service providers. Each receives only what it needs for its part of the service and is bound to protect it.

VSSGEO runs on Vista-operated servers in the United States. Some parts of the data work run entirely on our own servers and send nothing outside: drive-time routing, our data catalog, and some AI steps.

Services your browser contacts directly

When you use the VSSGEO pages, your browser loads a few things straight from other providers. They receive your IP address and the request itself, under their own privacy policies:

• map tiles from OpenFreeMap;
• aerial imagery from the U.S. Geological Survey, if you turn it on;
• typefaces from Google Fonts;
• open-source code libraries from public code-hosting networks (unpkg, jsDelivr, cdnjs);
• place-name lookups from Photon, run by komoot: the point you click or the place you name;
• Google’s sign-in button, if you use it.

If you speak a question, your browser’s own speech recognition turns it into text. In some browsers (Chrome, for example) that service is run by the browser’s maker.

4. When else we share information

• Because you chose to: anyone with a view link you create can see the session it opens. People you invite to edit a session see it, along with your display name. When you invite someone by email, we send them one email about it. A property listing you publish is visible to other users.
• Your organization: if your organization has an agreement with Vista, it may manage its members’ accounts and see its account’s usage.
• Legal reasons: to comply with the law, a court order or other valid legal process; to enforce our terms; or to protect the rights, property or safety of Vista, our users or others.
• Business transfers: if Vista is involved in a merger, acquisition or sale of assets, this information may transfer. It would stay protected by this policy, or by one at least as protective.

5. How long we keep it

• While your account is open, we keep your information so your history, projects and files keep working.
• When you close your account, we cancel any plan and sign you out everywhere. Within 30 days we remove your name, email address, company, password, two-step sign-in key and recovery codes, sign-in links and the addresses on our copies of emails, and your username is replaced with an anonymous one.
• Records we keep after that: activity, questions and answers, sessions, billing records and security logs. They stay linked only to that anonymous account number, except that our sign-in security log keeps the username used at each sign-in. We keep them to maintain an accurate service record, handle billing disputes, prevent abuse and improve VSSGEO. Billing and tax records are kept as long as tax and accounting law requires.
• Your files and content: write to [email protected] if you want uploaded files, or other content, deleted rather than kept anonymously. We delete it unless we must keep it for a legal reason, and we tell you what we kept and why.
• Backups: we back up regularly. Backup copies can hold information for a period after it has been changed or removed elsewhere.

6. Your choices and rights

• See and download: “Download all my data” in your account settings gives you a file of your account, activity and content.
• Correct: edit your profile and email address at any time.
• Email: change your preferences in your account, or use the unsubscribe link. Service emails such as receipts and security notices still arrive while your account is open.
• Devices: see where you’re signed in and sign out any device (Account → Password & security).
• Two-step sign-in: turn it on or off, and make new recovery codes (Account → Password & security).
• Close your account: Account → Password & security → Close account.

Depending on where you live, the law may give you more rights over your personal information, such as the right to access, correct, delete or port it, and to appeal our decision on a request. Several U.S. states grant these, including California, Colorado, Connecticut, Oregon, Texas, Utah and Virginia. To use them, email [email protected] from the address on your account, or tell us how to verify you. You can use an authorized agent where the law allows. We answer within the time the law requires, usually 45 days. If we turn down a request, we explain why and how to appeal, and you can contact your state attorney general. We won’t treat you differently for using these rights.

We honor Global Privacy Control signals as a request to opt out of the sale or sharing of personal information. We don’t sell or share it for advertising anyway.

7. Cookies and browser storage

• VSSGEO uses one cookie to keep you signed in: v100. It lasts up to 30 days, and scripts can’t read it (it’s HttpOnly and sent only over HTTPS).
• If you use two-step sign-in, a second cookie, v100_2fa, holds your place for up to 5 minutes between your password and your code. It works the same way (HttpOnly, HTTPS only) and is removed once you’re signed in.
• Your browser also stores display preferences on your device, such as your theme, panel sizes and which tools you’ve used. These stay on your device and aren’t sent to us.
• We don’t use advertising, analytics or social-media cookies.

8. Security

• Traffic to VSSGEO is encrypted (HTTPS).
• Passwords are hashed with scrypt, IP addresses are kept only as keyed hashes, and sign-in links are single-use and expire.
• You can turn on two-step sign-in with an authenticator app. Its key is stored encrypted, recovery codes are stored only as one-way hashes, and each recovery code works once.
• Access to user data is limited to people who need it, and user files are stored owner-only on our servers.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.

9. Children

VSSGEO is a business service, not meant for anyone under 18. We don’t knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

10. Where information is processed

VSSGEO is run from the United States, and your information is processed in the U.S. Some service providers may also process it in other countries. Photon, the place-search service, is run from the European Union. If you use VSSGEO from outside the U.S., you understand that your information will be processed in the U.S.

11. Changes to this policy

If we change this policy, we post the new version here with a new date. If the change is material, we tell you by email or in VSSGEO before it takes effect.

12. Contact

Privacy questions and requests: [email protected]
Mail: Vista Site Selection, LLC, Attn: Privacy (VSSGEO), 52 East Gay Street, Columbus, Ohio 43215