Privacy Policy

§1. Data controller

The controller of personal data is Seweryn Rogut (the “Controller”). Contact on data matters: [email protected].

§2. What data we process

• Account data: e-mail address, first name (optional), hashed password, role, organisation membership.
• Project content: files uploaded to the Service (point clouds, 360° panoramas, orthomosaics, descriptions, thumbnails).
• Technical data: IP address, browser type (user agent), sign-in events, security logs.
• Waitlist: e-mail and optionally the name, company and message given in the sign-up form.

§3. Purposes and legal bases

• Providing the service (creating and maintaining the account, hosting projects) — Art. 6(1)(b) GDPR (performance of a contract).
• Security, abuse prevention, logs — Art. 6(1)(f) (legitimate interest).
• Handling waitlist sign-ups and getting back in touch — Art. 6(1)(a) / (f).
• Legal obligations (e.g. accounting, if applicable) — Art. 6(1)(c).

§4. Personal data in uploaded materials

360° panoramas and scans may contain images of people, licence plates or other personal data. For this content, the controller is the user (organisation) who uploads it, and the Service Controller acts as a processor (Art. 28 GDPR) — processing it solely to provide the hosting and sharing service.

The User represents that they have a legal basis for processing the data contained in the uploaded materials and is responsible for its lawfulness. The Service provides a panorama anonymisation tool: it automatically detects faces and licence plates, and the user reviews and approves the blurred regions before sharing. Detection is not infallible — responsibility for anonymising published materials remains with the user. Unblurred original panoramas are not shared with recipients unless the user enables downloading of original files (e.g. E57), which may contain them.

§5. Recipients and processors

Data may be processed by trusted providers acting on behalf of the Controller:

• Server infrastructure provider (hosting) — hosting of the application and data (EU).
• Transactional e-mail provider — e-mails (invitations, password reset) (EU/USA — standard contractual clauses).

Where data is transferred outside the EEA, standard contractual clauses or other GDPR-compliant mechanisms are used.

§6. Retention period

• Account data and projects — until the account/organisation is deleted (or on request).
• Security logs and sign-in events — usually up to 12 months.
• Waitlist entries — until they are handled or consent is withdrawn.

§7. Your rights

You have the right to:

• access your data and obtain a copy (Art. 15),
• rectification (Art. 16),
• erasure (“right to be forgotten”, Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time (Art. 7(3)).

To exercise your rights: [email protected]. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (PUODO), or with the supervisory authority in your EU country of residence.

§8. Cookies

The Service uses only strictly necessary cookies (sign-in session, public preview token). We do not use analytics, marketing or third-party tracking cookies. Session cookies have the HttpOnly and SameSite attributes.

§9. Security

Passwords are stored as hashes (bcrypt). We use encrypted connections (HTTPS), data isolation between organisations and access restrictions. No system is 100% secure, however — we recommend strong, unique passwords.

§10. Changes to this policy

This policy may be updated. We will inform you of material changes in the Service or by e-mail. Continued use of the Service after a change means you have read the new version.

§11. Contact

For matters relating to privacy and personal data: [email protected].