1. Who We Are
Public Lands Log is operated by Terrain360 LLC ("we," "us," "our"), a company based in Richmond, Virginia. We provide visitor tracking and analytics tools for national parks, forests, heritage areas, and other public lands.
Contact: privacy@publiclandslog.org
2. What Data We Collect
We collect different types of data depending on how you interact with our platform:
Account holders (staff, administrators):
- Name, email address, and password (hashed)
- Organization and role information
- Login activity (timestamps, method used)
Visitor data (collected on behalf of partner organizations):
- Names, home state/ZIP code, and party size from paper guest book scans
- Names, origins, and party size from electronic kiosk sign-ins and QR check-ins
- Aggregate foot-traffic counts from trail counter imports
Automatically collected:
- IP address (for rate limiting and security; not stored long-term)
- Session cookies (authentication only; no tracking cookies)
We do not use advertising cookies, third-party trackers, or analytics pixels. We do not sell or share personal data with advertisers.
3. How We Use Data
- Visitor data: Aggregated into counts, origin maps, and reports for the partner organization that collected it. Used for grant applications, economic impact studies, and resource planning.
- Account data: To authenticate you, manage your organization membership, and communicate about the service.
- Security data: IP addresses and request logs are used for rate limiting, abuse prevention, and security monitoring. Logs are retained for 30 days and then automatically deleted.
4. How We Process Paper Guest Book Data
When a paper guest book page is uploaded, we use AI (Anthropic Claude) to extract visitor information. The AI processes the handwritten text and returns structured data (names, origins, dates). The original scanned images are stored in AWS S3 and accessible only to authorized staff of the partner organization.
5. Data Sharing
We share data only in these circumstances:
- With the partner organization: The organization that collected the visitor data has full access to their own data through the dashboard.
- Service providers: We use Supabase (database hosting), AWS (file storage and hosting), Anthropic (AI processing), Resend (email delivery), Mapbox (map rendering), and Google (geocoding). Each processes data only as needed to provide their service.
- Public maps: If an organization enables a public map, only aggregated state-level visitor counts are shown. No individual names, addresses, or personally identifiable information is displayed on public maps.
- Legal requirements: We may disclose data if required by law, court order, or government regulation.
6. Data Retention
- Visitor entries: Retained as long as the partner organization's account is active. Organizations may request deletion at any time.
- Account data: Retained while your account is active. Upon deletion, personal data is removed within 30 days.
- Security logs: Automatically purged after 30 days.
- Scanned images: Retained in S3 for as long as the partner organization's account is active.
7. Data Security
We protect data with:
- TLS 1.3 encryption for all data in transit
- HSTS enforcement (browsers always connect securely)
- HTTP-only, Secure, SameSite=Strict session cookies
- Content Security Policy headers restricting script/resource sources
- Role-based access control with center-level scoping
- Rate limiting on all authentication and public endpoints
- Geo-blocking of high-risk regions
- SSH key-only server access with firewall and intrusion detection
8. Your Rights
Account holders may:
- Access and update your profile information through the dashboard
- Request a copy of your personal data by emailing privacy@publiclandslog.org
- Request deletion of your account and associated personal data
Visitors whose data appears in guest books: If you believe your personal information has been recorded through a partner organization's guest book and you would like it removed, contact us at privacy@publiclandslog.org with the approximate date and location of your visit. We will work with the partner organization to locate and remove your entry.
9. Children's Privacy
Public Lands Log accounts are intended for use by organizational staff (18+). We do not knowingly collect personal information from children under 13. Visitor entries from paper guest books may incidentally include names of minors written by accompanying adults; these are processed solely for visitor counting purposes.
10. Breach Notification
In the event of a data breach affecting personal information, we will:
- Notify affected partner organizations within 72 hours of discovery
- Notify affected individual account holders via email
- Report to relevant authorities as required by applicable law
- Document the breach, its impact, and remediation steps taken
11. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to account holders. The "Last Updated" date at the top reflects the most recent revision.
12. Contact
For privacy questions, data requests, or concerns:
Terrain360 LLC
privacy@publiclandslog.org
Richmond, Virginia