Privacy policy

In short

GISFire has two sides, and they do not collect the same things. The public map asks for no account and offers no comments and no file upload: unless you open the optional "Your feedback" form to write to us, which loads Google reCAPTCHA (described below), you send us nothing that identifies you, and it sets no cookie. GISFire Pro, the paid service opened on 16 September 2026, does require an account, an email address, a subscription and settings forms. Buying data one purchase at a time, for its part, is done without an account, with an email address and a payment.

Six things are therefore described here, without being played down: a cookieless audience measurement, the server logs, the outside services your browser contacts itself in order to draw the map, the data held in a GISFire Pro account for those who open one, and that of a one-off data purchase for those who make one, and that of the "Your feedback" form for those who open it.

Who is responsible

The processing is carried out by the joint publishers of the site, SARO and Gistin.

Identity and contact details of the data controller

SARO, a sole trader based in Toulouse, France, SIRET 924 821 366 00011, and Gistin, in Abu Dhabi. The detail is in the Legal notice.

Contact

contact@saro.app

The GISFire Pro account

GISFire Pro is a paid subscription, opened on 16 September 2026. It requires an account. Together with the one-off data purchase described below, it is one of the two places on the site where you send us data that identifies you. Opening an account is never necessary in order to read the public map.

What we record: the account holder's email address, the name of the organisation, the language of messages, the telephone number if you ask for SMS alerts, the email addresses of the people you invite onto the account, the zones you watch and their alert settings, the webhook address you supply, your sketches, the customer and subscription identifiers held by our payment provider, and the identifier of your organisation at Clerk.

Signing in is handled by Clerk (Clerk Inc., United States): password, code sent by email, or a Google account if you prefer, Google being an optional identity provider that then applies its own policy. Clerk receives your email address, your name, your IP address, your browser, the name of your organisation and the email addresses of the members you invite. This data is transferred to the United States under the European Commission's standard contractual clauses. No card data goes through our servers: the payment page is served by Stripe, and we receive only its outcome. Legal basis: performance of the subscription contract, and our accounting obligations where invoices are concerned.

If you invite colleagues onto your account, you are entrusting us with their email address: tell them so. They exercise their rights exactly as you do, by writing to the address below, without having to go through the account holder.

The sign-in cookies

__session and __client_uat, set by Clerk on this site, only on the subscription, sign-in, Pro area and My account pages. They last for the session, seven days at most, and do nothing but keep you signed in: they measure nothing and follow nobody. Signing out deletes them and ends the session.

How long account data is kept

For as long as the subscription lasts. A sign-in session lasts seven days at most. Closing an account is requested at the address given below: it deletes the account and, by cascade in our database, its zones, its alerts, its sketches, its invited members, its API keys and its sessions. Nothing of it remains in our database. Invoices, held by our payment provider, follow the statutory accounting retention period.

One-off data purchase

GISFire's data archives, those of a fire or of an area over a period, are sold one purchase at a time, with no account and no subscription. What we record: your email address, the language, the area and period chosen, the datasets and formats, the price, and the link to the invoice. Your card and billing address are entered at Stripe, and we do not see them. Legal basis: performance of the sales contract, and our accounting obligations where invoices are concerned.

How long purchases are kept

The downloadable file is deleted after thirty days. The order record (email, area, period, price, invoice link) is deleted from our database thirty days after the link expires. The invoice and the payment are kept by Stripe for the statutory accounting retention period, ten years.

Recipients

Stripe for the payment, the invoice and the VAT calculation, and Resend for sending the email that carries the download link. No other third party receives the data of an order.

The buyer's rights

No account is needed: to exercise your rights of access, rectification, erasure, restriction and objection over an order, write to contact@saro.app, from the email address used for the purchase. Erasing the order does not erase the invoice, which the law requires us to keep.

The "Your feedback" form

The "Your feedback" form, opened from the map panel or from the page footer, is optional and asks for no account. It collects your message, an email address if you want a reply, and the page you are writing from (its path only, with the language). This data is used for one thing: reading your message and, if you left an address, answering you. It is not used for advertising or profiling. Your IP address is not in the message; it is counted in the server's memory, never written to disk, to limit sending to five messages an hour.

To keep robots out, the form uses Google reCAPTCHA (Google, United States). Its script is loaded only when you open the window, never with the page: as long as you do not open it, your browser does not contact Google. Once loaded, Google receives your IP address and information about your browser, may set or read cookies of its own, and applies its own privacy policy. If you would rather avoid Google, write directly to the address shown in the window.

Retention of messages

No database: the message is not stored on the site. The email we receive is kept in the publisher's mailbox for as long as it takes to answer you.

Recipients

The publisher, by email. Resend (an American company) delivers it; Google reCAPTCHA takes part in the anti-robot check, only when the form is opened.

Audience measurement

Every page loads a measurement script served by stats.saro.app. It is an Umami instance we host ourselves, on the same server as the site: the measurements go to no third party.

In its default configuration, Umami sets no cookie and writes nothing on your device. Your IP address is not kept: the server derives a session fingerprint from it with a salt that changes every day, which makes it impossible to recognise you from one day to the next.

What is recorded: the page viewed, the page you came from, the country, the language, the type of device and the browser. Nothing else, and nothing that leads back to a person.

Legal basis: our legitimate interest in knowing how much the site is used. With no cookie and no writing on your device, this measurement does not require your prior consent; it did, on the other hand, have to be stated here, and that is what it is doing.

Retention period for audience measurements

25 months, the ceiling the CNIL applies to audience measurement trackers. A daily purge runs on the instance and deletes measurements beyond that period.

What your browser keeps on your side

The site places a few markers in your browser's local storage. None of them is sent to the server; they only serve to remember a choice or to avoid showing you the same thing twice.

• gisfire.splash.vu and gisfire.splash.session: the opening screen has already been seen.
• gisfire-tutoriel-vu: the map tutorial has already been followed.
• gisfire.visites: a plain visit counter, used so that a tip is not suggested on the very first visit.
• gisfire.notice.<notice>: this notice has already been shown or dismissed.
• gisfire.langue.proposee: the offer to switch language has already been made.
• gisfire:dernieres-donnees: the date of the last satellite data seen, which the offline page shows when the network is down.
• gisfire.zone: the zone you chose or drew on the map, so that it is there on your next visit.
• gisfire-pro-* and gisfire.pro.direct.*: your preferences in the Pro area (display mode, introduction and modules already seen, date of the last report, live alerts already read, sound), and, in session storage, pro-visite-signalee. Some of these keys carry your account number in their name.

The browser also registers a service worker, a small program of the site that keeps a local copy of the application files and of the last pages viewed, so that the site opens without a network.

Clearing this site's storage in your browser erases these markers and removes the service worker, with no consequence other than seeing the opening screen again and making your choices again.

Server logs

The server that delivers the site keeps an access log: IP address, date and time, address requested, response code, declared browser and originating page. It is needed to keep the service running, to understand a failure and to spot abuse.

Retention period for access logs

366 days at most. Log rotation deletes the server access logs past that period.

What your browser fetches elsewhere

Drawing the map means downloading tiles and imagery from outside services. Your browser contacts them directly: those services therefore see your IP address, and we have no hold over what they do with it. Their own policies apply.

• CARTO (basemaps.cartocdn.com), a United States company: the base map. This call entails a transfer of your IP address outside the European Union.
• OpenFreeMap (tiles.openfreemap.org): the fallback base map, called only if the previous one does not answer.
• EOX (tiles.maps.eox.at), Austria: the Sentinel-2 satellite imagery.
• IGN (data.geopf.fr), the French national mapping agency: the orthophotos shown at close zoom over France.
• Mapterhorn (tiles.mapterhorn.com), an open project whose tiles are served by Cloudflare, a United States company: the elevation tiles of the map's 3D relief. This call may entail a transfer of your IP address outside the European Union.
• Amazon Web Services (s3.amazonaws.com), a United States company: the Terrarium relief tiles of the 3D scene on the home page. This call entails a transfer of your IP address outside the European Union.
• Open-Meteo (open-meteo.com), Germany: place search, wind and air quality. What you type in the search goes through our server, which sends it to Open-Meteo a quarter of a second after your last keystroke, without your IP address; incomplete entries are sent too.
• Stripe (checkout.stripe.com), an American company, and only if you pay for a Pro subscription or a data purchase: the payment page is theirs, you enter your card details on their side, and we never see them.
• Ko-fi, and only if you click the tip link: it takes you off this site, onto a page that has its own trackers and whose payments are handled by Stripe.

What our server fetches for you

The other sources are queried by our server, then served from our own domain. They receive the server's address, never yours:

• NASA FIRMS: the active fire detections.
• NASA GIBS: the smoke plume imagery.
• Copernicus CAMS, through ECMWF's Atmosphere Data Store: wildfire carbon emissions (GFAS) and forecast smoke aerosols. Our server signs in with the site's own account; no visitor data is sent there.
• NOAA, through the noaa-gfs-bdp-pds public bucket on Amazon Web Services: the 10 m wind of the whole world, observed and forecast (GFS model).
• Open-Meteo: air quality, and the wind over Europe when the worldwide wind is missing.
• adsb.lol: the positions of the water bombers.
• AWS Earth Search (Element 84): the Sentinel-2 image catalogue.
• Google News: monitoring of press articles that mention a fire.
• Anthropic: reading those press articles to extract the town and the burnt area. No visitor data is passed to it.

The processors behind GISFire

Four providers touch account and order data, each for one thing only. A fifth, Google, takes part in two cases only: if you choose it to sign in, or if you open the "Your feedback" form (reCAPTCHA):

• Stripe, an American company (Stripe Payments Europe for the European Union): the subscription, the payment, the invoices and the VAT calculation by Stripe Tax. They receive your email, your name, your billing address and your card, which we never receive; we keep only the customer and subscription identifiers, and the invoice link.
• Clerk Inc., United States: sign-in and sessions. They receive your email, your name, your IP address, your browser, the name of the organisation and the emails of invited members. The transfer is covered by standard contractual clauses.
• Resend, an American company: the delivery of our emails, that is to say the subscription confirmation, the alerts, the situation reports, the download link of a data purchase and the messages of the "Your feedback" form. They receive the destination address and the content of the message.
• Brevo: the delivery of SMS alerts, if you ask for them. They receive the telephone number and the one hundred and sixty characters of the message.
• Google, in two cases only: if you choose to sign in with your Google account (an optional identity provider), and if you open the "Your feedback" form (reCAPTCHA, the anti-robot check, loaded when the window opens). It applies its own privacy policy.

Browser notifications, if you turn them on, travel through your browser's own push service (Google or Mozilla, as the case may be). Their content is encrypted end to end with a key your browser produced: that service relays a packet it cannot read.

If you configure a webhook, alerts are sent in addition to the address you supply. What becomes of that stream is a matter for you, not for us.

What we do not do

No advertising, no ad network, no resale, no profiling. No Google Analytics and no Google Tag Manager, no social network button, no tracking pixel. No tracking cookie is set: the only cookies on the site are the two Clerk sign-in cookies, described above, and a cookie strictly necessary to a service you asked for does not require your consent. The public map and the home page set none at all. The "Your feedback" form loads Google reCAPTCHA only when it is opened: see above.

Your rights

You have a right of access, rectification, erasure, restriction and objection over the data concerning you.

One caveat, in fairness: the audience measurement keeps nothing that would let us find you again, and the server logs are indexed by IP address alone. On those two processings, an access request can therefore only succeed if you give us the IP address and the period concerned. The data in a GISFire Pro account, by contrast, is held under your name: a request about it succeeds without any caveat.

To exercise these rights, write to contact@saro.app.

You may also lodge a complaint with the French data protection authority, the CNIL.

Changes

This page follows the code: it is corrected as soon as a source, a third-party service or a measurement changes. The update date shown at the top is the one that counts.