Kaligeos Privacy Notice
Version 1.0 · Effective: October 7, 2026
This notice explains what personal data Kaligeos processes when you:
- create an account;
- activate Kaligeos Desktop on a computer;
- use the Community edition allowances;
- visit kaligeos.com.
A Spanish version is also available. If the two differ, the Spanish version prevails.
1. Controller and contact
Jorge Lobos Ortiz, individual, Chile. Email for privacy, requests and support: [email protected]
2. What Kaligeos does not receive
Kaligeos Desktop keeps your projects, geological and geochemical data, templates, diagrams and figures on your computer. The online service does not receive that content, the names or paths of your files, or the geometry of your custom diagrams.
We do not sell personal data, show advertising or build commercial profiles.
3. Where the data comes from
The data comes from what you give us (for example, your email address) and from your use of the service: your computer when it is activated, your exports and your connections. We do not collect data about you from public sources or third parties.
4. What we process, why, and on what legal basis
Legal references are to Chile’s Law 19,628 as amended by Law 21,719.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, verification status, creation and activity dates | Create and maintain your account, verify your email and recover access | Necessary to provide the service you request (art. 13 c) |
| Password verifier (scrypt). We never store your password in readable form. | Authenticate you | Provision of the service (art. 13 c) |
| Sessions: cryptographically transformed identifiers and dates. In the browser, a session cookie and session storage. | Keep you signed in and let you sign out | Provision of the service (art. 13 c) |
| Devices: computer name (by default, its Windows name), activation and usage dates | Show you your devices and apply the two-active-device limit | Provision of the service (art. 13 c) |
| Technical device signals, transformed on your computer and again on the server: system identifier, motherboard, processor, system disk and Windows installation. We never store readable serial numbers. | Recognize the same computer and prevent the free Community benefit from being claimed repeatedly | Legitimate interest (art. 13 d): preventing a limited free benefit from being obtained more than once on the same computer |
| Allowance usage: a transformed identifier for each vector export, its status and dates. For Custom Builder, a transformed identifier and date. | Count the 50 vector exports and Builder slots without charging twice for the same export | Provision of the service (art. 13 c) |
| IP address, stored only as a transformed key with a counter and a time window | Limit excessive requests and protect the service | Legitimate interest (art. 13 d): security and availability of the service |
| Security and audit events (type, outcome and device match score) and email delivery events | Security, support and delivery diagnostics | Legitimate interest (art. 13 d): service security and support |
| Record that you read this notice: version, language, text fingerprint and date | Show what information you received when you registered | Legal obligation to inform and to be able to prove it (arts. 13 b and 14 ter) |
| Whatever you send when you write to support | Answer your question or request | Provision of the service (art. 13 c) or legal obligation to handle your rights (art. 13 b) |
| Visits to kaligeos.com: aggregate statistics from Cloudflare Web Analytics, which uses no cookies | Learn which pages are used | Legitimate interest (art. 13 d): maintaining and improving the site |
We do not process sensitive data. Where the basis is legitimate interest, you can object (section 7).
Authorization while the current text of the law applies. Until the Law 21,719 reform takes effect, art. 4 of Law 19,628 requires your express written authorization. By ticking the box at registration you authorize the processing described in this notice, and the version you read is recorded. You can withdraw that authorization at any time by deleting your account (section 7), without retroactive effect.
Automated decisions about your computer
When a computer is activated, the server compares its signals with computers already registered. Each signal has a weight: system identifier 40, motherboard 30, processor 15, system disk 10 and Windows installation 5.
| Score | Result |
|---|---|
| 70 or more | Treated as the same computer. Changing RAM, the graphics card or the disk, or reinstalling Windows, normally does not change the result. |
| 40 to 69 | Uncertain. The Community benefit is not granted automatically to another account. |
| Below 40 | Treated as a different computer. |
If you are in that uncertain range (for example, because you bought a used computer, share one or replaced the motherboard), you can ask for a human review by writing to [email protected]. No system message accuses you of fraud.
Maps inside the app
- OpenStreetMap: if you choose this base map, Kaligeos Desktop requests map images directly from OpenStreetMap Foundation servers. Those servers receive your IP address and the map area you are viewing.
- Mapbox: if you configure your own key, map images are requested from Mapbox with that key.
- Latitude/longitude grid: does not connect to any service.
Kaligeos does not receive that data; each service handles it under its own policies.
5. Service providers and international transfers
These providers process data on the controller’s behalf:
- Cloudflare, Inc. (United States): website, DNS, downloads, sending and forwarding email, and site statistics. To send verification and recovery emails it processes your address, the temporary link and delivery metadata.
- Railway Corporation (United States): hosts the account service, database, technical logs and encrypted backups. The selected servers are in Europe (Amsterdam), but the provider may process data in the United States.
- Google LLC (United States): email sent to [email protected] is forwarded to the controller’s Gmail mailbox.
Your data is therefore processed outside Chile, including in the United States. At the date of this notice there is no official Chilean list of countries with an adequate level of protection.
Cloudflare and Railway are bound by the data processing agreements they offer their customers, which include contractual protection clauses (art. 27). The Gmail mailbox is the controller’s personal account and is governed by Google’s general terms. If you prefer not to use that channel, say so in your first message and we will keep correspondence to the minimum necessary.
6. How long we keep data
| Data | Retention |
|---|---|
| Account, Community license, devices and allowances | While the account exists |
| Accounts whose email was never verified | Deleted 30 days after creation |
| Sessions and device authorization codes | 7 days after expiry |
| Verification and recovery links | 90 days after expiry |
| Audit and email delivery events | 90 days |
| Transformed IP keys for rate limiting | 2 days at most |
| Record that you read this notice | While the account exists |
| Support correspondence | 90 days after the case is closed |
| Technical device signals after the account is deleted | 90 days, kept apart from your email and impossible to link to it. They are used only to stop the free benefit being claimed again straight away. |
| Encrypted backups | Daily copies for 7 days; Sunday copies for 28. The two most recent complete copies are always kept. |
Each retention period is applied by the first automatic daily cleanup after it ends.
A backup may contain data you have already deleted. If a backup ever has to be restored, all deletions are applied again before the service reopens. For this, a minimal deletion log (opaque identifiers and dates, with no email or device data) is kept. It is retained until it can be pruned safely and is used for no other purpose.
7. Your rights and how to exercise them
You have the right to:
- access: know what data about you we process;
- rectification: correct it;
- erasure: delete it, including your account;
- objection: object to processing based on legitimate interest;
- portability: receive your data in a structured format;
- temporary blocking: have us suspend processing while a request is resolved.
How to ask: write to [email protected] from your account email, or tell us which one it is. To protect your account we will confirm that you control that email. We will never ask for your password or your recovery links. These requests are free of charge.
Deadlines:
- We will acknowledge your request and reply within 2 business days.
- If the request requires changes (for example, deleting your account), we will complete them within 30 calendar days of receiving it. That period may be extended once by another 30 days; if so, we will tell you why.
- Temporary blocking requests are resolved within 2 business days.
If you are not satisfied:
- While the current text of Law 19,628 applies, you may go to the civil court (juzgado de letras en lo civil) of the controller’s domicile (art. 16).
- Once the Law 21,719 reform takes effect, you may complain to Chile’s Agencia de Protección de Datos Personales within 30 business days of our reply, or directly if we did not reply in time.
At kaligeos.com/account you can also change your password, sign out and deactivate devices yourself.
Deleting your account removes your email, password verifier, sessions, devices, license and allowances. It does not delete projects saved on your computer.
8. Security
We apply these measures:
- encrypted connections (HTTPS);
- passwords stored only as scrypt verifiers;
- cryptographically transformed device and session identifiers;
- encrypted backups;
- least-privilege permissions for each automated process;
- daily cleanup of expired data;
- technical logs designed not to record passwords, links or content.
No system is completely invulnerable. If an incident affects your data, we will notify you where required.
9. Minors
Kaligeos is a professional and academic tool. It is not directed at children under 14, and you must not create an account unless you are at least 14.
10. Changes to this notice
If what we process or how we process it changes, we will publish a new version with its date. Previous versions are kept, and your registration records which version you read.