Privacy

Who runs Biohotspot

NTLP, the UWA Centre for Natural and Technical Language Processing, builds and runs Biohotspot, with Oceanwise Australia and AI4WA (see who built Biohotspot). In this page, “we” means the people who run the site.

What you can do without signing in

The home page, the guide, the data catalogue, the research library, this page and public projects open without an account. Your browser still talks to Cloudflare and Mapbox (see services we use).

What we collect and why

• Your email address. It is your account: we use it to sign you in, to send you the emails described below, and to match you to the projects shared with you.
• Signing in. For now you sign in with your email address alone; we do not check that the address is yours. Anyone who types your address can open your projects, so do not keep anything secret in Biohotspot yet. We can switch the emailed sign-in code back on, and then only the owner of an address can open its projects.
• Sign-in codes. When codes are switched on, you ask for a six-digit code, which we email to you. We store the code only as a keyed hash, with the address it was sent to, when it was made, when it was used, how many wrong tries there were, and the network address the request reached our server from. A code expires after 10 minutes and burns after 5 wrong tries. One address can be sent 5 codes an hour, and one network address can ask for 20 an hour.
• A password. The first time you sign in we make a password for your account and email it to you in the welcome email. We store it hashed. It is for Biohotspot’s own login page, which AI agents use when you connect them; on the website you only need your email.
• Projects. The name, the area you draw, the description, the data check for the area, and the email addresses and roles of the people you share it with.
• Uploads. Files you add to a project, or the files at links you give us, which our server downloads. We keep the original file, read its features into our database, and keep what you tell us about it: title, source, year, licence and which columns mean what. Your account is recorded as the uploader.
• Saved scenarios. The area, the settings, the results and the simulations you keep, and each Marxan run made for the scenario.
• Map activity. Every area assessment and Marxan run made through the site is recorded, whether you save it or not: the area and settings sent, the result, the time it took, your account and the project open at the time. Administrators use this to see what is being run.
• The map assistant. The assistant needs a sign-in. For each answer we record your last question, the answer, the map actions it took, the model used and the number of tokens, with your account and the open project, so administrators can see whole sessions.
• Reports and invitations you email. When you email a report, we send the recipients’ addresses, your message and the PDF to our email service; we do not store them, and our server log notes your email address and the number of recipients. When you share a project with someone, we store their email address on the project (even if they have no account yet) and email them a link, with your address as the sender’s.
• API keys. If you make a key for scripts or AI agents, we store its name, its first characters, a hash of the key (never the key itself), when it was made, when it was last used and, if you revoke it, when.
• Server logs. Our server writes your email address to its log when it sends you a code or the welcome email, and when you email a report. Failed invitations are logged with the invited address.
• Your location. Only if you press the button that shows where you are, and your browser asks you first. It centres the map in your browser and is not sent to us.

Who can see your projects and data

• Your team. A project’s team is its owner and the people it is shared with by email, as editors (who can change it and add data) or viewers. You are matched to a team by the email address you sign in with. Team members see one another’s email addresses and every upload in the project.
• Public projects. Only the owner can make a project public. Anyone can then open it, signed in or not. Visitors see the owner as the part of their email address before the @, not the whole address, and they do not see the team list.
• Uploads in a public project. Visitors see an upload only when it is in use and has an open licence. Uploads marked Restricted or Not sure are shown to the team only. Heritage data and Indigenous land and sea data are shown to the team only, whatever the licence, following the CARE principles. Next to an upload that a visitor can see, the uploader is shown as the part of their email address before the @.
• Map tiles of uploads. The map draws an upload from an address that contains a long random key. Those tile requests need no sign-in; the key is given only to people who may see the upload.
• Saved scenarios. You see your own scenarios, and the team sees the scenarios saved in its project. Only the person who saved a scenario can change or delete it.
• Administrators. The people who run the site can see accounts, projects, uploads, scenarios, sign-in code records, map activity and assistant chats in the site’s admin.

Where it is stored

Accounts, projects, scenarios, the features of your uploads, map activity and assistant chats are in a PostgreSQL database on our own server. The original files of your uploads are kept in our own object storage (MinIO) on the same local network, and gridded uploads also keep a map copy on the server’s disk. The server reaches the internet through a Cloudflare Tunnel.

How long we keep it

• Until you delete it. Your account, projects (with their team lists), uploads, scenarios (with their Marxan runs) and API keys stay until you delete them (see below) or ask us to.
• One year. The records of assessments, Marxan runs and assistant chats (the map activity and map assistant records above) and the sign-in code records are deleted once they are a year old. The clean-up runs once a day, so a record goes within a day of turning one year old.
• Login sessions. A session on Biohotspot’s own login page or admin lasts two weeks. Once it has expired, the daily clean-up deletes its record.
• AI agent connections. When you connect an AI agent through Biohotspot’s own login page, it is given tokens tied to your account. The daily clean-up deletes the expired ones: refresh tokens that have been replaced, revoked or left without an access token, access and ID tokens that have expired (they last 10 hours) and no longer belong to a connection, and connection codes once they expire (after one minute). A connection that has not been used for a year stops working, and the clean-up then deletes its tokens. A connection in use keeps its current tokens.
• Server logs. Each part of the site keeps at most five log files of 10 MB; when they are full, the oldest lines are deleted. A part’s log also starts afresh when that part is replaced in an update. Logs are not kept by date, so how far back they reach depends on how busy the site is.
• In your browser. A sign-in lasts up to 90 days; each access token lasts 60 minutes.

Your choices and deleting your data

• Uploads: the project’s owner or an editor can delete one. That removes its features from the database, its map copy and its stored file.
• Projects: the owner can delete a project. That removes the project, its team list, its scenarios and its upload records. It does not yet remove the uploads’ stored files and features, so delete the uploads first, or ask us to.
• Scenarios: you can delete the scenarios you saved.
• Teams: the owner can take someone off a project, and you can leave a project shared with you.
• API keys: you can revoke a key. It stops working at once; the record described above stays.
• Your account: there is no delete button yet. Email us and we will delete it. Deleting an account removes its projects (as above), its scenarios and its API keys. The records of assessments, Marxan runs and assistant chats stay, without the link to your account, and the sign-in code records sent to your address stay too, until each is a year old. Invitations to other people’s projects that carry your address stay until their owners remove them.
• Signing out clears what this browser remembered for Biohotspot.

Cookies and browser storage

The site sets no cookies of its own while you use the map. Your sign-in, the open project, the map view, the tour and tips you have seen and the chat model you chose are kept in your browser’s local and session storage, under names starting with mr_; the light or dark choice is kept under bh_theme. Biohotspot’s own login page and its admin set a session cookie and a security (CSRF) cookie when you use them.

Contact

To ask what we hold about you, or to have it deleted, email [email protected].