Privacy Policy
ES3D holds geological data, which is often commercially sensitive and frequently not yet public. We have designed it to collect as little as possible about people, and to keep what you upload for your use only.
Who we are
ES3D is operated by Exploration Sites Corp., based in Victoria, British Columbia, Canada. We are the organisation responsible for the personal information described here.
What we collect, and why
| What | Why | Kept |
|---|---|---|
| Your email address | To sign you in. ES3D uses one-time email links — there are no passwords, so we never hold one. | Until you close your account |
| Your project data — drillholes, assays, surveys, geology, spatial layers, saved projects | To provide the Service to you. Nothing else. | Until you delete it, or 90 days after closing your account |
| Device capability — whether your browser supports WebGPU or WebGL2, and a coarse performance tier | To know how many people cannot render 3D and need the fallback | Aggregate; contains nothing identifying |
| Shared-story engagement — an anonymous share identifier, which scene was reached, seconds spent, whether that scene's narration played to the end, and where you leave the section cut (as a proportion of the model's own size); on a published presentation, also its public address | So the company presenting can see which parts of their story held attention, and which parts a viewer stopped to examine — as totals in a report they can share with others | Aggregate; no name, email, IP or account is attached, and beyond a published presentation's public address nothing recorded describes what it contains |
| Contact details you submit — name, email, message on a “get in touch” form in a shared presentation | Only when you tick the consent box. Passed to the company whose presentation you were viewing. | Until that company deletes it |
| Your plan — trial or plan, its status and end date, and, if you pay, the customer and subscription numbers Stripe gives us (never your card) | To run your free trial and your subscription | While you have an account, then as tax law requires for invoices |
| Agreement records — which version of our terms you accepted and when | So we can both tell what was agreed | For as long as needed as a record |
What we do not do
- We do not sell or rent personal information. Ever.
- We do not use your geological data to train machine-learning models, or to develop other products.
- We do not run advertising networks, third-party analytics, or cross-site tracking.
- We do not build profiles of individuals.
Turning telemetry off
If your browser sends a Do Not Track or Global Privacy Control signal, we record no telemetry at all — the code checks before it does anything else, including in a presentation embedded on a company's website. You do not need to ask us.
Who else touches the data
We use a small number of service providers, each only for what it is listed for:
| Provider | What for | Where |
|---|---|---|
| Supabase | Account sign-in and project storage | Cloud infrastructure |
| Vercel | Website hosting and delivery | Cloud infrastructure |
| Resend | Sending sign-in emails | Cloud infrastructure |
| Stripe | Taking payment for paid plans. Your card details go to Stripe, never to us | Cloud infrastructure |
| EMQX (public MQTT broker) | Keeping a live shared session in step across devices | Cloud infrastructure |
The live-session relay is worth being specific about: it carries only which scene is showing and whether playback is running, on a randomly generated channel. Your geological data, your project and your presentation content never pass through it.
These providers may process data outside Canada, including in the United States, where different laws apply and where courts and authorities may in some circumstances compel access.
How it is protected
Project data is stored encrypted at rest and reachable only by your own account — enforced at the database, not just in the app. Sign-in uses one-time email links, so there is no password to leak. We keep access to production systems limited to those who need it.
No system is perfectly secure. If a breach affects your personal information, we will tell you and the appropriate regulator as the law requires.
Stored in your browser
ES3D keeps some settings in your browser's local storage — display preferences, your sign-in session, and a record that you accepted our terms. These are not advertising cookies and are not shared with anyone. Clearing your browser storage removes them.
Your rights
Under Canadian privacy law (PIPEDA) and comparable laws elsewhere, you may:
- ask what personal information we hold about you, and get a copy;
- ask us to correct anything inaccurate;
- ask us to delete your account and data;
- withdraw consent to anything you previously agreed to;
- export your projects at any time, from within the app.
Write to us and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Children
ES3D is a professional tool and is not directed at children. We do not knowingly collect information from anyone under 16.
Changes
If we change this policy in a way that matters, we will give notice and ask you to review it at your next sign-in. The version and date at the top always tell you which policy is current.
Contact
Questions, requests or complaints about privacy: use the contact details on exploration.rocks.