Last updated: 17 October 2026
At POINOVA we process your personal data in accordance with the GDPR (EU 2016/679) and the Spanish Data Protection Act (LOPDGDD). Here we explain what data we process, for what purpose and on what legal basis, who we share it with and what rights you have. It is a 100% self-service product, so this policy applies equally to all users.
Data you give us: identification (name, company, tax ID), contact details (email, phone, billing address), payment data (handled by our payment provider; we do not store your full card details), your content in the tool (saved areas, exports, settings) and your communications with support.
Data we collect automatically: technical data (anonymised IP, browser, operating system, language) and product-usage data to operate and improve it, plus the cookies described in the cookie policy. Exception: if too many requests are made from an IP address in a short time, or too much data is downloaded from it in a day, or if we block it for abuse, we keep that IP address in full to protect the service (see the table below).
Third-party data: if we enable sign-in with Google, Microsoft or LinkedIn in the future, we will receive your name and email from the provider according to the permissions you approve.
| Purpose | Legal basis | Retention |
|---|---|---|
| Provide the contracted service | Performance of the contract | Active account; deleted when you close it |
| Manage payment and invoicing | Legal obligation | 6 years, without name or email (Commercial Code) |
| Support and customer care | Performance of the contract | Active account, up to 1 year |
| Improve the product with aggregated analytics on our servers | Legitimate interest | Active account, up to 180 days |
| Account security (sign-in log, with the IP shortened) | Legitimate interest | Active account, up to 13 months |
| Protect the service against abuse (block list and abuse log, with the full IP) | Legitimate interest | Block list: until we lift the block. Abuse log: up to 2 years |
| Analytics via optional cookies | Consent | Per cookie; revocable |
| POINOVA commercial communications | Consent (or legitimate interest for customers) | Until you unsubscribe |
When you close your account, we delete or anonymise your personal data: closing the account is how you exercise your right to erasure, and there is no need to ask us by email. The only thing kept is the accounting entry for the payment, which carries neither your name nor your email address; the invoice is issued and kept by LemonSqueezy, acting as merchant of record. Cancelling your subscription is not the same as closing your account: if you only cancel, you return to the free plan and your content stays where it was. We only keep the most recent backups: older ones are deleted as new ones are made.
We will never use your data to train artificial-intelligence models, sell it to third parties or make automated decisions with legal or significant effects. POINOVA does not process special categories of data (health, beliefs, origin, biometrics, etc.); when we rely on legitimate interest we use the minimum data and you can object at any time.
Apart from the public address and map-relief services explained below, we only share your data with the providers strictly needed to run the service, each one under a data-processing agreement (DPA): hosting in the European Union, a payment processor and an email provider. Some operate outside the EEA, in which case we apply the European Commission's standard contractual clauses and verify their EU-US Data Privacy Framework certification (you can request a copy). You can ask for the up-to-date list of providers at contact@poinova.com. We do not sell your data and, apart from these cases, we only disclose it when required by law (tax authorities, courts or data-protection authorities).
The addresses you import. To place a file of addresses without coordinates on the map, we first use the service for each address's country. For France, Belgium and the United Kingdom (the latter by postcode) that service runs on our own server, with each country's official address data, and the address does not leave it. For Spain, our server sends it to CartoCiudad (IGN/CNIG). Addresses the country's service cannot place, and those in other countries, are sent to Nominatim, from the OpenStreetMap Foundation (United Kingdom). If our own service for a country is unavailable because of a fault or maintenance, we temporarily use that country's official public service (the Géoplateforme of the French IGN in France, or BeST Address from FPS BOSA in Belgium) or Nominatim. In every case only the address is sent (street and number, postcode, town and country, or the part each service needs): we do not send the name of each point, the other columns of your file or anything about your account, and rows that already have coordinates are not sent. So that the same address does not have to be looked up again, we keep its position on our server for at most six months, without the name of the point or anything about your account. What you type in the address search boxes and in the "Default city" box of the import window also goes to Nominatim, through our server. These are public services, not providers we have hired.
The map relief. The relief shading you see on the maps is downloaded by your browser directly from Terrain Tiles, a public dataset hosted on Amazon Web Services (United States). Amazon therefore receives your device's IP address and which area of the map you are viewing, but nothing about your account or your data. It is not a provider we have hired either.
You can at any time exercise your rights of access, rectification, erasure, restriction, portability and objection, as well as withdraw consent and request not to be subject to automated decisions, by writing to contact@poinova.com with the subject "GDPR rights". We will reply within 30 days at most. We will only ask for proportionate identity verification if we have reasonable doubts about who is making the request.
If you believe we are not respecting your rights, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) and, in Catalonia, with the Catalan Data Protection Authority (apdcat.gencat.cat).
We apply technical and organisational measures: encryption in transit, daily backups (encrypted when they leave the server), two-factor authentication (2FA) available for all accounts, restricted staff access and regular security reviews. If a breach occurs with risk to your rights, we will notify the AEPD within 72 hours and you without undue delay when the risk is high.
POINOVA is aimed at professionals over 18 and does not knowingly collect data from minors. In the event of a user's death, their relatives, heirs or designated persons can exercise the rights of access, rectification, erasure and restriction (LOPDGDD art. 96) by writing to contact@poinova.com with documentation proving the relationship.
Given its activity and size, POINOVA is not required to appoint a formal Data Protection Officer (art. 37 GDPR), but it handles privacy matters internally through contact@poinova.com. If it becomes necessary in the future, we will appoint a DPO and announce it on this page.
We may update this policy due to changes in the law, the service or our providers. We will announce substantial changes 30 days in advance and the current version will always be available on this page.
A cookie is a small file a website stores on your device when you visit it. We use the minimum necessary ones and, only with your consent, some to understand how the site is used. Similar technologies (LocalStorage, pixels) are also covered by this policy.
These need no consent: without them the service does not work.
| Name | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
| __Host-poinova_token | Cookie | Keeps you signed in | 1 day | POINOVA |
| poinova_device | Cookie | Remembers that you have already signed in from this browser, so nobody can lock you out of your account by trying wrong passwords | 180 days | POINOVA |
| NEXT_LOCALE | Cookie | Remembers the interface language | 12 months | POINOVA |
| pn-cookie-consent | Local storage | Remembers your choice on the banner | Until you clear it | POINOVA |
| pn-lang | Local storage | Language chosen with the site translator | Until you clear it | POINOVA |
Our analytics runs on our own server and stores no identifier. We only stop measuring if you say no.
| Name | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
| Umami | No cookie | Aggregated visit counts on our own server | Nothing stored on your device | POINOVA |
| umami.disabled | Local storage | Set only if you refuse, to keep measuring off | Until you clear it | POINOVA |
| poinova_attr | Local storage | Which link brought you here the first time, so we know where sign-ups come from | Until you clear it | POINOVA |
Kept on your device so the tool remembers how you like it. Never sent anywhere else.
| Name | Type | Purpose | Duration | Set by |
|---|---|---|---|---|
| poinova_city, poinova_currency, poinova.mapTheme, poinova_metrics, poinova_sidebar_mode | Local storage | Your choices inside the tool: city, currency, map style, units | Until you clear it | POINOVA |
We set no third-party cookies. Payment happens on LemonSqueezy’s own website, under their policy, and we embed no video or external widget. If that ever changes we will ask you first.
No advertising cookies, no ad tracking, no Google Analytics, no Meta Pixel. We do not use Cloudflare, and we do not set a CSRF cookie: both appeared in an earlier version of this table by mistake.
On your first visit we show a banner with three equally prominent options at the first level: Accept all, Reject all (same size and contrast as Accept) and Customise by category. Rejecting is as easy as accepting (one click), as required by the AEPD cookie guidance. We never use cookie walls or pre-ticked boxes. You can reopen the settings at any time from the "Cookie settings" link in the footer, or by deleting the cookies from your browser.
In compliance with the LSSI (Law 34/2002), the owner of this website is the data controller, reachable at contact@poinova.com.
Access to and use of this website and of the POINOVA service imply acceptance of the terms in force at any given time; the service is provided as described in each plan and the user agrees to make lawful use of it. The POINOVA brand, logo, texts, design and software belong to their owner or are used under licence, and may not be reproduced without authorisation; the data shown comes from official, duly cited sources. The site is hosted on servers located in the European Union.
These terms govern the use of POINOVA. By creating an account or using the service you accept them. POINOVA is a 100% self-service product contracted online, so these terms apply equally to everyone.
POINOVA provides geomarketing analysis (zones, demographics, competitors, catchment) as described in each plan (Free, Pro, Advanced, Enterprise). You can start for free and upgrade at any time; paid plans are billed through our payment provider and prices are public.
If you are a consumer (B2C) you have 14 days to withdraw from a paid subscription. If you ask to start using a paid plan immediately, you consent to begin before that period ends, which may reduce the refundable amount for the part already used. Businesses (B2B) are excluded from this statutory right.
Paid plans renew automatically at the end of each period (monthly or yearly) until you cancel.
You can cancel at any time from your account; the plan stays active until the end of the paid period and does not renew afterwards. You can also delete your account and your data from the account area.
You agree to make lawful use of POINOVA and not to scrape, resell or redistribute the data or reports beyond your own business use, nor to attempt to break the service or its security.
The POINOVA brand, software, design and texts belong to their owner or are used under licence; the official data shown comes from cited public sources. Your own imported data remains yours.
POINOVA is a decision-support tool: the NovaScore and figures (reachable population, estimated demand, etc.) are deterministic estimates from official data, not guarantees. The final decision and its risk are yours, and POINOVA is not liable for business decisions made on the basis of the results. To the extent permitted by law, our liability is limited to what you paid for the service in the previous 12 months.
We may update the service and these terms and will announce substantial changes in advance. These terms are governed by Spanish law. Questions: contact@poinova.com.
Some POINOVA results (the NovaScore and figures such as reachable population or estimated demand) are calculated with a model; they are not direct measurements.
