Privacy & data
Last updated 2026-09-24 · Data controller: Orbitly (admin@orbitly.tech)
SoilPoint is a public API that returns USDA soil data for a coordinate. This page lists what we record when you call it or use the “try it” box on the homepage.
What we record per request
- Coarse query region: the latitude/longitude you ask about, rounded to ~110 m (3 decimals) plus the derived US state. We do not store your exact coordinates.
- Network organisation, not your IP: we look up your IP address in memory against an offline database to derive the network/organisation (ASN), its name, and country, then discard the IP. Your full IP address is never written to our database or our logs. The web server’s access log keeps only its first three parts (for example
203.0.113.0) for 14 days, to spot abuse. - Technical metadata: which endpoint, HTTP status, response timing, cache hit/miss, a coarse client type (e.g. “curl”, “browser”), and the referring site’s host. For calls to the MCP server we also record the method, the tool name, and the client name it reports (e.g. “claude-code”). We use it to run and debug the service.
- A first-party identifier: a random ID stored in a first-party cookie so we can tell repeat usage apart from new usage. It is not an advertising or cross-site identifier.
If you sign up for a key or put down a deposit
We store your email, its domain, whether that domain looks like a company rather than a free mail provider, the campaign tag in the link you arrived from (if any), and the random ID from the cookie above.
Storing that ID with your email means the requests recorded under it (the cookie lasts 7 days) can be linked to you: the coarse regions you looked up, your network organisation, and when. We use the link to see which kinds of use lead to signups and deposits. The deposit button and the Stripe thank-you page record the same ID. Stripe handles the payment itself; we never see card details.
Why (lawful basis)
For anonymous use of the public API and the “try it” box, we rely on legitimate interest (GDPR Art. 6(1)(f)) to operate, secure, and validate demand for the service. This is proportionate because we store no raw IP and no exact coordinates, use a first-party cookie rather than fingerprinting, and the data is coarse technical/operational telemetry. If you sign up, we use your email to issue and support the key you asked for (GDPR Art. 6(1)(b)), and we link your earlier anonymous requests to it under the same legitimate interest, to understand what brings people to sign up.
How long
Per-request records are retained for about 90 days and then may be deleted. Exact coordinates exist only transiently in memory and in a short-lived cache key; they are not part of the retained record.
Who processes it (sub-processors)
- Supabase: managed PostgreSQL where the coarse records are stored.
- IPinfo: supplies the offline IP→organisation database used for the in-memory lookup described above.
- Our hosting provider: runs the server that serves this API.
Your choices
For anonymous use we store no IP and no exact location. Once you sign up, your email and the requests linked to it are personal data. To have them exported or deleted, or if you believe any record relates to you, email admin@orbitly.tech and we will handle it. You can clear the first-party cookie any time in your browser.
Soil data & attribution
Soil data is sourced from USDA-NRCS SSURGO via Soil Data Access (public domain). It is provided as-is; it is not a substitute for on-site investigation and not for regulatory determinations; US coverage only. SoilPoint is not a USDA-endorsed product.
IP address data powered by IPinfo (used under the IPinfo Lite licence, CC BY-SA 4.0).