Who we are and scope
ZENIT GROUP S.A.S. operates ThermalGlobe and is the primary controller of documented first-party personal data. Privacy requests: info@zenitgroup.com.co.
This policy covers thermalglobe.com and documented subdomains, not third-party authorities, sources, map providers, or linked sites operating under their own policies.
Data processed at initial launch
- Limited IP, timestamp, URL, user-agent, security, and error data needed to deliver and protect the service.
- Information voluntarily sent by email.
- Raw browser location only after a user clicks the location control; it is used temporarily to centre the map and is not stored by ThermalGlobe servers.
- Place-search text processed in the browser using a versioned local index; no ThermalGlobe server search history.
- Cookie-free Cloudflare Web Analytics receives aggregated page-view, referrer, device, country, and performance measurements through Cloudflare. ThermalGlobe does not add a user identifier or build a cross-site profile.
- No account profile, cross-domain Zenit profile, advertising identifier, session replay, or behavioral advertising analytics at beta launch.
Purposes and legal bases
Service delivery, requested functions, security, aggregated audience and performance measurement, diagnostics, rights handling, and legal compliance rely on the legal basis applicable to the user and jurisdiction. Precise device location requires an explicit browser permission and user action. Advertising or analytics that use cookies, personal identifiers, cross-site tracking, or behavioral profiles would require a separately reviewed consent and choice configuration where applicable.
Providers and transfers
Cloudflare delivers and protects the static site, Worker, and public R2 data. Cloudflare also provides cookie-free Web Analytics: the browser loads the beacon from static.cloudflareinsights.com and submits measurements to the same site under /cdn-cgi/rum. OpenFreeMap/OpenMapTiles/OpenStreetMap and NASA GIBS receive normal requests needed to render map tiles. NASA FIRMS receives scheduled server-side requests from the Worker, not user identity by design.
The operator is in Colombia and providers may process data in other countries. Controller/processor roles, DPAs, transmission/transfer classifications, and required safeguards must be verified before this draft becomes effective.
Retention targets
- Operator-controlled routine application logs: target 7 days.
- Operator-controlled security or incident logs: maximum 30 days unless a documented investigation or legal duty requires longer.
- Cloudflare Web Analytics measurements: retained under Cloudflare's current service policy; ThermalGlobe does not receive a visitor-level history or persistent identifier.
- Email rights and complaints: retained under a documented case schedule.
- Local functional preferences: until reset or expiry, if later implemented.
- Exact location and search text: not stored server-side by design.
Security and rights
Measures include TLS, least privilege, Cloudflare secrets, environment separation, bounded parsing, content hashes, security headers, minimized logs, dependency scanning, and rollback runbooks. No system can be guaranteed completely secure.
Depending on location, users may have rights to access, correct, update, delete, restrict, object, withdraw consent, receive information, obtain portability, opt out, appeal, or complain. Email info@zenitgroup.com.co; proportionate verification will be requested and identity documents are not requested by default.
Children, decisions, and changes
ThermalGlobe is a general-audience information service and is not directed to children. It does not knowingly profile children or make legal or similarly significant decisions about users. Map clustering and filtering are data presentation.
Effective date and provider-specific retention will be set only after the launch review register is complete.