CivAPI Privacy Policy

Last Updated: March 27, 2025

1. Who We Are

CivAPI ("we," "us," or "our") is a cloud-based data platform operated by Ceratonia Siliqua LLC, registered in Bulgaria. We provide real-time humanitarian and development data analytics to organizations worldwide.

2. Scope

This policy applies to:

• Users of our API, dashboards, and tools.
• Visitors to our website (civapi.com).
• Partners who share data with us.

3. Data We Collect

A. From Users

• Account Data: Name, email, organization (for API access).
• Usage Data: IP addresses, API call logs, browser type.
• Payment Data (if applicable): Billing details (processed via secure third parties like Stripe).

B. Humanitarian/Development Data

• Satellite imagery (0.5m resolution).
• Anonymized displacement/migration patterns.
• Infrastructure damage assessments.
• Publicly shared reports from NGOs/governments.

Note: We minimize personal data and anonymize/pseudonymize where possible.

4. How We Use Data

Purpose	Legal Basis
Provide API/services	Contractual necessity (Article 6(1)(b))
Improve crisis predictions	Legitimate interest (Article 6(1)(f))
Comply with legal obligations	Legal requirement (Article 6(1)(c))
Share aggregated insights (e.g., migration trends)	Public interest (Article 6(1)(e))

5. Data Sharing

• Partners (NGOs, governments) with signed Data Processing Agreements (DPAs).
• Cloud providers (e.g., AWS/GCP) under GDPR-compliant contracts.
• Legal authorities if required (e.g., subpoenas).
• No sale of data to third parties.

6. International Transfers

Data stored in EU-based servers (Bulgaria). For transfers outside the EU (e.g., to partner NGOs in the U.S.), we use:

• Standard Contractual Clauses (SCCs).
• EU-U.S. Data Privacy Framework certified partners.

7. Security Measures

• Technical: Encryption (in transit/at rest), API authentication, regular audits.
• Organizational: Staff training, access controls, breach response plans.

8. Data Retention

User accounts: Until deletion request.
Crisis/development data: Anonymized and retained for public interest (e.g., historical analysis).
Logs: 12 months (unless legally required longer).

9. Cookies

We use essential cookies (no advertising/tracking). Manage via browser settings.

10. Changes to This Policy

Updates posted on our website. Material changes notified via email.

11. Contact Us

Data Protection Officer (DPO): dpo@civapi.com

Bulgarian Supervisory Authority: Commission for Personal Data Protection (www.cpdp.bg)