Urbanism,
in real time.

This privacy policy describes how GeoScale collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR).

Data controller

Controller: GEOSCALE — SAS with share capital of €1,000, RCS Évry 101 340 313, 9 rue Charles Fourier, 91000 Évry-Courcouronnes, France

Contact: contact@geoscale.fr

Data collected

Purposes and legal bases

User account management (legal basis: performance of the contract)
Creation, authentication and management of your GeoScale account.

Urban analysis (legal basis: performance of the contract)
Provision of PLU, feasibility and geographic data analysis services.

Security and fraud prevention (legal basis: legitimate interest)
Protection of the service against abusive uses.

Administrative geolocation (legal basis: legitimate interest)
Approximate geolocation for security and usage statistics.

Retention periods

Active account data: Account lifetime + 3 years after closure

Chat history: 1 year after the last conversation

Connection logs: 1 year

Parcel and analysis data: Account lifetime

Subprocessors and data transfers

xAI (United States)
Grok language model inference for the analysis agents. Transfers outside the EU are covered by the EU Commission's Standard Contractual Clauses.

Mistral AI (France)
OCR and processing of PLU documents. Data hosted in France.

Stripe Payments Europe (Ireland)
Credit-card payment processing. Card numbers never transit our servers. Stripe is PCI-DSS Level 1 certified.

ip-api.com
Approximate IP-based geolocation for security and aggregate audience statistics.

PrivateAlps.net (Switzerland)
Application servers and database hosting. Sovereign European infrastructure; transfers outside the EU are covered by appropriate safeguards.

Your rights

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: delete your data under certain conditions
• Right to portability: retrieve your data in a structured format
• Right to object: object to the processing of your data
• Right to restriction: restrict the processing of your data

To exercise these rights, contact us at contact@geoscale.fr

You also have the right to lodge a complaint with the CNIL (French data protection authority).

Cookies

GeoScale uses only strictly-necessary cookies. No advertising cookies, no third-party trackers, no marketing-platform sharing.

• token (guest visitor): HTTP-only JWT (30-day lifetime) automatically issued on first visit to enforce free-tier quotas and prevent abuse. Strictly necessary.
• token (logged-in user): HTTP-only authentication JWT after sign-in. Strictly necessary.
• csrf-token: Anti-CSRF token (24h), protection against cross-site request forgery. Strictly necessary.
• NEXT_LOCALE: Stores your language preference (FR/EN). Strictly necessary.

We also operate an internal audience-measurement system to track aggregate service usage (page views, sessions, feature usage). This measurement is anonymized (IP addresses truncated of their last octet) and confined to our infrastructure — no data is shared with any third party. It falls under the "audience measurement" exemption set out by France's CNIL (August 2020 recommendations) and does not require prior consent.

No advertising cookies, no profiling cookies, no third-party tracking pixels.

Pursuant to Article 5(3) of the ePrivacy Directive and CNIL guidance, these technical cookies are exempt from prior consent.

Data security

GeoScale implements appropriate technical and organizational measures to ensure the security of your personal data:

• Password encryption (bcrypt)
• JWT authentication with HTTP-only cookies
• Secure HTTPS connections
• Data access restriction (principle of least privilege)
• Regular backups

Changes

This privacy policy may be modified. The latest version will always be available on this page. In case of substantial changes, you will be notified by email.

Last update: May 2026