Privacy policy
Last updated 20 October 2026
This policy explains what personal data bionexus.pro collects, why, where it's kept and the choices you have. We collect as little as we can, we don't sell or share it for advertising, and you can delete everything yourself at any time.
Who we are
bionexus.pro is run by Brian Murray in Ireland, who is the data controller for the personal data described here. Contact: bees@duck.com.
What we collect
| Data | Why | How long |
|---|---|---|
| Your email address, and your name if you sign in with Google | To create and secure your account and sign you in | Until you delete your account |
| Your saved searches, including any areas you draw | So you can return to them | Until you delete them or your account |
| Activity: the type of each search (species name, compared species, or the taxon filter and size of an area), downloads and saves, with the time | To apply fair-use limits, keep the service running well and understand which features are used | 12 months, or until you delete your account |
| If you support bionexus.pro: your email address, the amount, the date and whether it's one-off or monthly. Card details go to Stripe and never reach us. | To record and account for payments, and so monthly supporters can manage or cancel them | 6 years, as Irish law requires for financial records |
| Short-lived request counters linked to your account or IP address | To stop any one user overloading the service or the data providers | Up to 24 hours |
| Technical logs (IP address, browser, pages requested) kept by our hosting provider | Security and fixing faults | As set by the provider, typically a few days |
We don't collect your location. Searches you run on the map are about places and species, not about you. If you view a shared map embedded on another website, we count the view and note which website it was on, but we don't identify you.
Our legal basis
- Providing the service you signed up for (contract): your account, saved searches and sign-in.
- Legal obligation: keeping records of support payments for accounting and tax.
- Legitimate interests: security, fair-use limits, fixing faults and understanding how the service is used, in ways you would reasonably expect.
Cookies and local storage
We use only cookies that are strictly necessary to keep you signed in. Your map preferences (such as the base map or whether clustering is on) are stored in your own browser's local storage and never sent to us. We don't use advertising or analytics cookies, so there's no cookie banner.
Who processes data for us
- Supabase: our database and sign-in system. Your data is stored in its Ireland (EU) data centre.
- Vercel: hosts the website and runs our server code in its Dublin region.
- Stripe: takes support payments on its own secure pages. Stripe holds your card details; we only receive your email address, the amount and the date.
- Google: only if you choose “Continue with Google” to sign in.
- Email delivery: account emails (confirmation and password reset) are sent through our email provider.
When you use the map, your browser also contacts the map-tile providers (CARTO and Esri) and the iNaturalist and GBIF databases directly, and these see your IP address as with any website. NBN Atlas searches go through our server, so NBN Atlas doesn't see your IP address. None of them receive your account details from us. Where a provider is based outside the EU, transfers are covered by the European Commission's standard contractual clauses or an adequacy decision.
Your rights
Under the GDPR you can:
- See and download your data: on your account page, “Download my data” gives you everything we hold about you.
- Delete everything: on your account page, “Delete my account” removes your account, saved searches and activity straight away. Records of any support payments are kept for accounting (see above) but are no longer linked to an account.
- Correct, restrict or object: email us and we'll respond within one month.
- Complain: to Ireland's Data Protection Commission at dataprotection.ie.
Backups held by our database provider may keep deleted data for a short time (up to 7 days) before it is overwritten.
Children
bionexus.pro isn't aimed at children under 16, and we don't knowingly create accounts for them.
Changes
If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell account holders by email.