Isopleth privacy addendum

Effective date: October 28, 2026 · Last updated: October 28, 2026

This addendum explains how Luxitag LLC handles personal information for the Isopleth API and isopleth.dev. It adds to, and for the Isopleth API takes precedence over, the Check the Land privacy policy at checktheland.com/privacy.

What we collect

• Account details: your email address, the plan you are on, the date you accepted these terms, and the API keys you create (we store keys only as one-way hashes, plus a short prefix so you can tell them apart).
• Sign-in: one-time sign-in links and session tokens, stored only as one-way hashes, and a hashed form of the IP address used to request a link, kept briefly to stop abuse.
• API usage: for each request, the time, endpoint, key, status, lookups charged, timing and a request id. We also keep the coordinates or address you sent and the results in a short-lived cache to serve repeat requests quickly.
• Billing: Stripe processes payments and gives us a customer id, subscription status, invoice and payment references. We do not receive or store your full card number.
• Security check: the sign-up form uses Cloudflare Turnstile to tell people from bots. Cloudflare processes browser signals to do this.

How we use it

To run the Service: authenticate requests, meter lookups and enforce plan limits, send sign-in links and essential account or billing notices, prevent fraud and abuse, debug problems, and meet legal and tax duties. We don't sell your personal information, don't share it for cross-context advertising, and don't send marketing email without your consent. The locations you look up are used only to answer your requests; we don't build profiles from them or share them with data sources beyond what a lookup needs (for example, sending a coordinate or address to a public service to retrieve the value you asked for).

Who we share it with

Only service providers that help us run the Service, under their own privacy and security terms: Stripe (payments and billing), Resend (sign-in and account email), Cloudflare (website, DNS and bot protection) and DigitalOcean (hosting). We may also disclose information if the law requires it or to protect the Service and its users.

How long we keep it

• Sign-in links and sessions: deleted about 1 day after they expire or you sign out.
• Per-request logs: 90 days. Daily usage totals per account: up to 2 years, so you can see usage and we can resolve billing questions.
• Cached results: days to weeks, depending on the source.
• Account and billing records: while your account is open, then as long as tax and accounting law requires.

Your choices and rights

You can revoke keys and sign out on the account page, and cancel paid plans in the billing portal. To get a copy of your data, correct it or delete your account, email support@isopleth.dev from the account's address. Depending on where you live (for example California or another U.S. state with a privacy law) you may have further rights; we honor those requests and won't treat you differently for making them.

Security

We use TLS for all traffic, store keys and tokens only as hashes, limit access to production systems, and keep secrets out of code and logs. No system is perfectly secure; if we learn of a breach affecting your information, we will tell you as the law requires.

Children

The Service is for businesses and adults. We don't knowingly collect information from anyone under 18.

Contact

Email support@isopleth.dev.