Privacy Policy
Effective date: 2026-05-20 · Last updated: 2026-05-20
Scenic View Canada (“we”, “us”, “BaseLink”) operates the BaseLink GNSS positioning service, the BL Survey and BL Monitor mobile apps, and the BL100 and BL200 hardware receivers. This policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and the rights you have over it.
It applies to the BaseLink web portal at base.scenicviewcanada.com, the BL Survey Android app, the BL Monitor Android app, the BL100 and BL200 hardware, and any related services.
1. Who we are
Operator: Scenic View Canada
Service: BaseLink GNSS
Contact: admin@scenicviewcanada.com
We are the data controller for the personal information described below.
2. Information we collect
2.1 Account information
When you create a BaseLink account we collect:
- Full name, email address, and phone number (optional)
- A salted hash of your password — we never store your plaintext password
- Your subscription plan (Basic / Pro), trial status, and billing status
2.2 Payment information
We do not store credit card numbers, CVV codes, or full bank details on our servers. Subscriptions are billed through Stripe, Inc., a PCI-DSS-certified payment processor. Stripe stores your card information directly and gives us a customer reference plus the last four digits of the card on file. See Stripe’s privacy policy for how they handle your payment data.
2.3 Location and survey data
The BL Survey app collects precise GNSS location data from your paired BL100 receiver and, as a fallback, from your phone’s built-in GPS. This includes:
- Real-time position used to render the map and your current location
- Survey points you explicitly collect (latitude, longitude, elevation, accuracy, timestamp, layer, optional notes)
- Raw GNSS observations you record on the BL100’s SD card
Survey data is stored locally on your device. It is uploaded to our servers only when you explicitly submit it for PPP-AR cloud processing or use the “NTRIP Tower” feature that relays corrections through our caster.
2.4 Bluetooth pairing data
To connect to your BL100, the BL Survey app stores the device’s MAC address and serial number on your phone. This data never leaves your device.
2.5 NTRIP correction usage
When your rover or BL100 connects to our NTRIP caster to receive real-time corrections, we log: connection timestamp, your username, source IP, mountpoint, the GGA position you report to the caster (for VRS-style services this is mandatory by the NTRIP protocol), bytes transferred, and disconnect timestamp. This is used for service-quality monitoring, billing reconciliation, and abuse detection.
2.6 BL200 base-station telemetry (operators only)
If you operate a BL200 base station, the device periodically reports operational telemetry to our servers: serial number, firmware version, battery voltage, WiFi signal strength, GNSS satellite count, RTCM throughput, and the configured base position. This is necessary to keep the device functioning, deliver firmware updates, and monitor the health of the network. The configured base position is also displayed on the public BaseLink map so nearby rovers can discover your station.
2.7 Web portal usage
When you use the BaseLink web portal we collect standard server logs: source IP address, timestamp, requested URL, response code, and user-agent string. We use server-side session cookies (HTTP-only, SameSite=Lax, 30-day expiry) to keep you signed in. We do not use third-party analytics, advertising trackers, or cross-site tracking cookies.
2.8 Support communications
If you email support, we keep the email, your responses, and any attachments to provide assistance and improve the service.
3. How we use your information
- To provide GNSS positioning, NTRIP corrections, and PPP-AR processing services you have subscribed to
- To deliver firmware updates to your BL100 and BL200 hardware
- To verify your identity, manage your account, and apply your subscription
- To send transactional emails: account verification, billing receipts, subscription status, station downtime alerts (if you have opted in)
- To detect and prevent abuse of the service (e.g. credential stuffing, NTRIP credential sharing beyond the subscription limit)
- To comply with legal obligations (e.g. record-keeping for tax)
We do not use your data for behavioural advertising, profiling, or any purpose unrelated to operating the service.
4. Legal bases for processing (GDPR / PIPEDA)
- Contract — we process account, payment, and service-usage data because it is necessary to perform our subscription agreement with you.
- Legitimate interest — server logs and abuse-detection records are processed for the legitimate interest of keeping the service secure and operational. You can object to this processing under GDPR Article 21.
- Legal obligation — billing records are retained as required by tax law.
- Consent — downtime-alert emails and any future marketing emails are opt-in.
5. Who we share your information with
We do not sell, rent, or trade your personal information. We share it only with the following service providers, each acting under a contract that limits them to processing data on our behalf:
- Vultr — our hosting provider (Canadian and US data centres). Stores account, telemetry, and survey-upload data.
- Stripe, Inc. — payment processing. Receives billing identifiers only; never receives survey or location data.
- Hostinger — email delivery for transactional messages.
We may also disclose information if compelled by a valid Canadian legal process (court order, subpoena) or to protect the rights, property, or safety of users or the public.
6. Where your data is stored
Account, telemetry, and survey data are stored on servers physically located in Canada. Stripe processes payment data in the United States and other regions as documented in their privacy policy. If you are accessing the service from outside Canada, your information will be transferred to and processed in Canada, which may have different data-protection laws than your country of residence.
7. How long we keep your data
- Account information — for the lifetime of your account, plus 30 days after closure
- Subscription / billing records — 7 years (Canada Revenue Agency requirement)
- NTRIP connection logs — 90 days, then aggregated and anonymised
- Server access logs — 90 days
- RTCM raw data logs (base stations) — 30 days (rolling)
- PPP observation uploads — deleted after processing completes (typically within 24 hours)
- BL200 base-station position — until the station is decommissioned by its operator
- Support emails — 2 years
8. How we secure your data
- All network traffic to our servers uses TLS 1.2 or 1.3 with Let’s Encrypt certificates
- Passwords are hashed with bcrypt (or equivalent) before storage; the plaintext is never written to disk or logs
- Per-device bearer tokens authenticate hardware over HTTPS; serial number alone is not sufficient
- Server credentials are stored in restricted-permission configuration files (root-only on the VPS)
- Administrative SSH access uses key authentication with host-key pinning; no password login is permitted
- Rate limiting on authentication endpoints protects against brute-force credential attacks
- On-device sensitive data (your account password, NTRIP credentials) is stored using Android EncryptedSharedPreferences
No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you and the appropriate regulator (Office of the Privacy Commissioner of Canada) without undue delay.
9. Your rights
Depending on where you live, you have some or all of the following rights:
- Access — obtain a copy of the personal information we hold about you
- Correction — correct inaccurate or incomplete data
- Deletion — request that we delete your account and associated personal data (subject to retention requirements above)
- Portability (GDPR) — export your account and survey data in a machine-readable format
- Objection / restriction (GDPR) — object to processing based on legitimate interest
- Withdraw consent — unsubscribe from optional emails at any time
- Complain — lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your local supervisory authority
To exercise any of these rights, email admin@scenicviewcanada.com. We will respond within 30 days.
10. Children
BaseLink is a professional survey tool not directed at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will delete it.
11. Cookies and tracking
We use a single, first-party, HTTP-only session cookie to keep you signed in to the web portal. We do not use third-party advertising cookies, analytics trackers, social media pixels, or any other cross-site tracking technology.
12. Changes to this policy
We may revise this policy from time to time. When we make material changes we will update the “Last updated” date at the top of this page and, if you have an account, send you an email notification at least 14 days before the changes take effect.
13. Contact
Questions, requests, or complaints about this policy or our handling of your personal data:
Scenic View Canada — BaseLink Privacy
admin@scenicviewcanada.com