Effective date: October 28, 2026
This policy explains what Cardinal Maps and Design LLC (“we”), 8 The Green, STE A, Dover, DE 19901, matt@forrest.nyc, collects when you visit forrest.nyc, moderngis.xyz or spatiallab.community, subscribe to the newsletter, or buy our products, and what we do with it. We are the data controller for this information.
1. What we collect
| Category | Examples | Source |
|---|---|---|
| Account and purchase data | Name, email, billing country, plan, purchase history, course progress | You, Circle, Stripe |
| Payment data | Card details are collected and stored by Stripe; we see only the last four digits, card type and billing country | Stripe |
| Newsletter data | Email, name, which emails you open and links you click, tags describing your interests, answers you give in surveys or quizzes | You, Kit, RightMessage, Tally |
| Community content | Posts, comments, profile, messages you send in Spatial Lab, attendance and recordings of live sessions | You, Circle |
| Testimonials | Name, photo, role, employer and the words you submit, when you choose to give one | You, Senja |
| Website usage | IP address, device and browser, pages viewed, referring site, approximate location, cookie identifiers | Cookies and similar technologies (section 3) |
| Candidate information | If you opt into a job referral, your résumé and the details you choose to share | You |
We do not knowingly collect information from anyone under 18. If you believe a minor has given us personal information, email us and we will delete it.
2. How we use it
To deliver what you bought and run the community; to send the newsletter and product emails you signed up for; to personalize what you see (section 3); to measure and advertise our own products; to process payments and prevent fraud; to answer support requests; to comply with law; and, with your permission, to publish your testimonial.
3. Cookies, tracking and personalization
We use the tools below. Where the law requires consent (for example in the EU and UK, and for some California residents), they run only after you accept in the cookie banner, and you can change your choice at any time.
| Tool | What it does | Provider policy |
|---|---|---|
| Google Analytics 4 and Google Tag Manager | Measures how the site is used | |
| Google Ads and Google AdSense | Measures our ads; AdSense shows third-party ads on some pages and may use cookies to personalize them | |
| Meta Pixel | Measures and targets our ads on Facebook and Instagram | Meta |
| Reddit Ads pixel | Measures our ads on Reddit | |
| RightMessage | If you are a newsletter subscriber who arrives from one of our emails or has identified yourself before, RightMessage recognizes you by a hashed identifier and adjusts headlines, offers and forms to your stated interests and role. It also asks survey questions on our pages. | RightMessage |
| Kit (ConvertKit) | Sends our emails and records opens, clicks and tags | Kit |
| Circle | Hosts Spatial Lab and course access | Circle |
| Stripe | Payments, tax calculation and fraud prevention | Stripe |
| PartnerStack | Tracks referrals from our affiliate partners so they can be credited | PartnerStack |
| ParityDeals | Detects your country to offer regional pricing | ParityDeals |
| Senja | Collects and displays testimonials | Senja |
| Tally | Forms and surveys | Tally |
| Zapier | Moves data between the tools above | Zapier |
| YouTube (embedded videos) | Video playback; Google may set cookies when a video loads |
You can also block cookies in your browser. We honor Global Privacy Control signals as an opt-out of the sale or sharing of personal information where that right applies. We do not sell personal information for money. Sharing data with advertising platforms such as Meta and Google may count as “sharing” or a “sale” under some state laws; you can opt out through the cookie banner or by emailing us.
4. Who we share it with
The service providers in section 3, acting on our instructions; payment and tax authorities where required; a buyer of the business if we sell it (we would tell you); and law enforcement when legally required. Testimonials are published only with your consent. Candidate information is shared only with the specific employer you agree to, and only after you opt in.
5. International transfers
We are in the United States, and our providers store data there and in other countries. If you are in the EU, UK or Switzerland, transfers rely on our providers’ Standard Contractual Clauses or Data Privacy Framework certifications.
6. How long we keep it
Account and purchase records for as long as you have an account and then as required for tax and accounting (generally 7 years). Newsletter data until you unsubscribe, plus a suppression record so we do not re-add you. Analytics data per the provider’s default retention (Google Analytics: 14 months). Community content until you delete it or your account is deleted.
7. Your rights
Everyone: unsubscribe from marketing using the link in any email, and ask us what we hold about you, to correct it, or to delete it, by emailing matt@forrest.nyc.
EU, UK and Swiss residents: you have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. Our legal bases are contract (delivering what you bought), consent (marketing cookies, newsletter, testimonials) and legitimate interests (running and securing the Services, measuring our own marketing). You may complain to your local data protection authority.
California and other US state residents: you may request access to or deletion of your information, correction, and to opt out of sale or sharing and targeted advertising, without discrimination. We respond within 45 days. An authorized agent may act for you with written permission. We do not use or disclose sensitive personal information beyond what is needed to provide the Services.
We verify requests by confirming you control the email on the account.
8. Do Not Track
We honor Global Privacy Control. We do not currently respond to browser Do Not Track signals, which have no agreed standard.
9. Security
We use reputable providers with encryption in transit and at rest, limit access to people who need it, and use two-factor authentication on our accounts. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as the law requires.
10. Changes
We will post changes here with a new effective date and, for material changes, email subscribers.
11. Contact
Cardinal Maps and Design LLC, 8 The Green, STE A, Dover, DE 19901. matt@forrest.nyc