DasoMaps Privacy Policy

1. Introduction

DasoMaps ("we", "our" or "the app") respects your privacy and is committed to protecting your personal data. This policy tells you how we handle your personal data when you use our mobile application, what your privacy rights are and how the law protects you.

DasoMaps is a mapping and mountain / forest-management app with offline capability, which combines local processing on your device with a backend of our own for the functions that need to share data between users (water points, community routes, news, feedback).

This policy applies to both variants of the app published on Google Play: DasoMaps (full GIS) and dmaps (simplified hiking).

2. Data collection and processing

2.1. Data we do NOT collect

We do not collect, store or transmit to our servers:

• Civil identity (real name, surnames, national ID number, etc.) — unless you yourself decide to type your name as a "nick" in Feedback/User, see 2.5
• Personal contact details (email, phone number, postal address)
• Financial or payment data
• Web browsing history outside the app
• Biometric data
• Contact lists, or messages/communications on the device

2.2. Data processed locally on your device

2.2.1. GPS location data

• What: latitude and longitude coordinates and date-time supplied by your device
• When: when showing your position on the map, when querying information about your location (context menu), when capturing geometries with GPS and when recording tracks
• Storage: locally, in GPX/KML/GeoJSON format and in the local database (Room)
• Control: you can export or delete this information at any time

2.2.2. Data you enter yourself

• Geometry names, annotations, answers to custom forms — stored in the local database (Room)

2.2.3. App settings

• Map preferences, colours, line thicknesses, active forms — in local SharedPreferences; can be reset from the settings

2.2.4. GIS files you import

• MBTiles, GeoTIFF, GeoPackage, KML, GPX, GeoJSON — in the device's storage, removable at any time

2.3. Data sent to our backend

DasoMaps uses a backend of its own (api.dasomaps.com, hosted on Google Cloud Run, EU region) for the functions that need to share information between users or with our server. These are all the flows in which data is transmitted:

User identifier. Each installation generates a unique identifier (UUID) that is not linked to your civil identity or to your Google account. It is used to: send feedback, receive personalised news, and know which water points or routes you yourself have contributed (so that you can edit or delete them). You may voluntarily add a nick to identify yourself in feedback; you are never asked for your real name, email or phone number.

Water points. If you switch on the water points layer, your device downloads the database for the area. If you contribute information about a point (drinkability, whether it has water, whether it is dry), add a new point, or upload a photo, that contribution is sent to our server identified with your UUID (not with your name) and is incorporated into the public water points database after a consolidation process. Photos you upload to a water point are public — visible to any user of the app.

Community routes (daso-routes). If you share a recorded track with the community, the route file (GPS path, with no personal data other than what you yourself write in the name/description) is uploaded to our server, processed through a third-party artificial intelligence service to generate an automatic summary and tags (see 2.4), and published so that other users can download it. It is an explicit action on your part, never automatic — recording a track does not share it by itself.

The Kora assistant and voice commands. Recognition of voice commands ("Blas") is done on your own device, offline. If you ask the conversational assistant Kora an open question (available only to contributing users), the text of your question is sent to our backend and to a third-party AI provider (see 2.4) to generate the answer; your real-time location and other personal data are not sent along with the question.

Feedback. Comments you send from Tools → Feedback are stored together with your UUID and, if you wrote one, your nick.

Usage log. The app records technical usage events (installation, start-up, main actions) together with the approximate location at that moment (UTM and lat/lon coordinates) and the province/country detected, for usage statistics and technical support purposes. This log is reset monthly on the server. It is data associated with your installation UUID, not with your civil identity.

Downloading layers and base maps. When you download base map tiles or layers from the DasoLayers catalogue, your device connects to the corresponding servers (see section 4); we do not record which specific layers you download.

2.4. Artificial intelligence providers

For the automatic enrichment of community routes (summary, tags, difficulty) and for the Kora conversational assistant, we use third-party services specialising in AI (currently Anthropic and/or equivalent providers). These providers process only the content necessary for the function (the track or the question as text), under their own data protection commitments, and may process the information on servers outside the European Union. We do not pass on to them your identity or your real-time location.

2.5. DasoLayers and public catalogues

When you download layers from the DasoLayers catalogue (LiDAR, orthophotos, thematic layers), your device connects to our Google Drive service account. We do not record which layers you download.

3. How we use the data

3.1. Legal basis (GDPR)

• Performance of a contract: providing the functionality you choose to use
• Consent: optional functions such as sharing a route, contributing a water point, using the Kora/Blas assistant
• Legitimate interest: aggregated usage statistics, technical support and improvement of the service

3.2. Purposes

1. Core map, geometry, track and layer functionality
2. Community functionality: collaborative water points, shared routes, assistant
3. Technical support and improvement of the application
4. Showing relevant news and notices within the app

3.3. What we do not do (currently)

• ❌ We do not sell your data to third parties
• ❌ We do not show advertising and the app includes no advertising SDKs
• ❌ We do not use your data for marketing purposes
• ❌ We do not track your activity outside the application

Note on the business model: DasoMaps is currently free and ad-free. We reserve the right to introduce advertising, in-app purchases or paid features in the future; if that happens, we will update this policy and notify you within the app before it takes effect, and any additional data processing that this entails (e.g. an advertising SDK) will require your consent where the law so requires.

4. Sharing data with third parties

We do not share your personal data with third parties for their own purposes, with the following technical exceptions that are necessary for the app to work:

Each provider has its own privacy policy; Google's is at policies.google.com/privacy.

5. Storage and security

5.1. Where your data is stored

• On your device: /data/data/<package>/ and /sdcard/Android/media/<package>/
• On our backend: Google Cloud Run (region europe-west1, EU) and Google Cloud Storage, for the data described in 2.3 (water points, daso-routes, feedback, user identifier, usage logs)

5.2. Security measures

• ✅ Encrypted communication (HTTPS) between the app and our backend
• ✅ Backend access protected by an API key; administrator mode uses a separate password verified by hash
• ✅ Local database encrypted (SQLite/Room) and isolated by Android sandboxing
• ✅ Access to location only when you authorise it
• ✅ We neither ask for nor use real names, emails or user passwords

5.3. Retention

• Location data and local geometries: until you export or delete them yourself
• Settings: until you uninstall the app
• Water points and shared routes: for as long as the functionality is active; you can delete your own contributions/routes at any time from the app
• Usage logs: reset monthly on the server
• Water point photos: for as long as the point exists in the public database

6. Your rights (GDPR)

• Access: see your captured data within the app
• Rectification/erasure: edit or delete geometries, tracks, layers, your water point or your daso-route from the app itself; delete your identifier and nick from User > Delete
• Portability: export in GPX, KML or GeoJSON
• Objection: you may choose not to enable GPS, not to share routes, not to contribute water points and not to use the Kora assistant — the app remains functional without them
• Withdrawal of consent: revoke access to Google Drive from your Google account, if you enabled that integration

To exercise any of these rights over data that is already on our backend (for example, a water contribution or a route you shared), contact us at hola@dasomaps.com.

7. Children's privacy

DasoMaps is not specifically directed at children under 13 and does not knowingly request data from children of that age. If you have reason to believe that a child has provided us with data, contact us and we will delete it.

8. Changes to this policy

We may update this policy. Changes will be published at this same URL and, if they are substantial, will be notified by a prominent notice within the app.

9. International transfers

Most of our processing takes place on Google Cloud infrastructure in the European Union. The AI providers described in 2.4, and Google as a whole for Google Drive, may process data outside the EU, under transfer mechanisms recognised by the GDPR (such as standard contractual clauses or adequacy frameworks equivalent to the EU-US Data Privacy Framework).

10. Cookies and tracking

DasoMaps does not use cookies, web beacons, advertising identifiers or third-party analytics or tracking SDKs.

11. Contact

Data controller: Jose Bengoa
Email: hola@dasomaps.com

12. Supervisory authority

If you reside in the European Union, you may lodge a complaint with your data protection authority. In Spain: the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) — www.aepd.es — Tel. 901 100 099 / 912 663 517.

13. Executive summary