Privacy Policy
Overview
This privacy policy informs you about the nature, scope, and purpose of the processing of personal data within this web application. We collect and process personal data only in accordance with the applicable data-protection laws, in particular the GDPR and the BDSG. Below you will learn which data we process for which purpose, to whom it is shared, and what rights you have as a data subject.
Responsible Party
Klajdo Fyraj Hexagonal Engineering Marschallstraße 26 40477 Düsseldorf Germany Email: info@hexagonal-engineering.de No data protection officer has been appointed, as the conditions of Art. 37 GDPR or § 38 BDSG are not met.
Processing activities
The following overview lists, for each processing activity, the data collected, the purpose, the legal basis, and the retention period.
User account
- Data
- Email address, hashed password, profile details
- Purpose
- Provision and management of your user account
- Legal basis
- Art. 6(1)(b) GDPR (contract performance)
- Retention period
- Deleted when the account is closed
Address lookups
- Data
- Queried address and its associated coordinates and grid cell
- Purpose
- Geocoding and delivery of the requested demographics results
- Legal basis
- Art. 6(1)(b) GDPR (contract performance)
- Retention period
- 30 days
Billing
- Data
- Payment and invoice data
- Purpose
- Processing and recording of payments
- Legal basis
- Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (tax retention obligations)
- Retention period
- 10 years under § 147 AO / § 257 HGB; the statutory retention obligation takes precedence over any request for erasure
API keys and usage
- Data
- API key, accessed endpoints, usage counters
- Purpose
- Authentication of programmatic access and usage metering
- Legal basis
- Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in abuse detection)
- Retention period
- Deleted with the user account
Server log files
- Data
- IP address, timestamp, requested resource, referrer
- Purpose
- Technical operation and detection of disruptions
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest in ensuring functionality and security)
- Retention period
- 7 days
Reach and usage measurement
- Data
- Event name, session id, IP address
- Purpose
- Product analytics to improve the application
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest in product improvement)
- Retention period
- Aggregated after 7 days at the latest; the IP address is truncated without delay
Contact and product updates
- Data
- Email address, message text
- Purpose
- Responding to enquiries and occasional product updates
- Legal basis
- Art. 6(1)(a) GDPR (consent)
- Retention period
- Until consent is withdrawn
Storage on your device (§ 25 TDDDG)
This application stores only strictly necessary data on your device: the Supabase session token, which is required for login, and the language preference under the key i18nextLng, which is a preference you have chosen and is therefore classified as strictly necessary. No analytics or advertising identifiers are stored. Consent under § 25 TDDDG is therefore not required.
Recipients and processors
We share personal data with the following service providers. All recipients are contractually bound as processors under Art. 28 GDPR.
Mapbox Inc.
- Purpose
- Geocoding — converting an address to coordinates (server-side)
- Data shared
- The address you look up
- Legal basis
- Art. 6(1)(b) GDPR (contract performance)
- Processing location
- USA
- Safeguards for third-country transfer
- EU-US Data Privacy Framework; supplemented by Standard Contractual Clauses (2021) per Mapbox DPA § 4.1 / Annex A
OpenStreetMap Foundation
- Purpose
- Map tiles — loaded directly by your browser
- Data shared
- IP address, requested tile coordinates
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest in map rendering)
- Processing location
- United Kingdom
- Safeguards for third-country transfer
- European Commission adequacy decision for the United Kingdom
PostHog
- Purpose
- Product analytics — reach and usage measurement
- Data shared
- Event name, session id, IP address
- Legal basis
- Art. 6(1)(f) GDPR (legitimate interest in product improvement)
- Processing location
- EU (eu.posthog.com)
Stripe Payments Europe Ltd.
- Purpose
- Payment processing
- Data shared
- Payment and invoice data, email address
- Legal basis
- Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (tax retention obligations)
- Processing location
- Ireland, with onward transfer to Stripe Inc. (USA)
- Safeguards for third-country transfer
- EU-US Data Privacy Framework; supplemented by Standard Contractual Clauses
Supabase
- Purpose
- Authentication and account management
- Data shared
- Email address, user identifier
- Legal basis
- Art. 6(1)(b) GDPR (contract performance)
- Processing location
- EU (eu-central-1, Frankfurt)
- Safeguards for third-country transfer
- Standard Contractual Clauses for support access by the US parent company
Web3Forms
- Purpose
- Forwarding of contact-form and newsletter submissions
- Data shared
- Email address, message text
- Legal basis
- Art. 6(1)(a) GDPR (consent)
- Processing location
- EU (Ireland)
Hetzner Online GmbH
- Purpose
- Operation of the application and database
- Data shared
- All aforementioned data and server log files
- Legal basis
- Art. 6(1)(b) GDPR
- Processing location
- Germany (Falkenstein) and Finland (Helsinki)
Your Rights
You have the right to information, correction, deletion, restriction of processing, data portability, and objection regarding the processing of your personal data. Right to object under Art. 21 GDPR: you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. You may withdraw your consent to the processing of your email address for product updates at any time. The lawfulness of processing carried out before the withdrawal remains unaffected. Right to lodge a complaint with a supervisory authority: you have the right to lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
Obligation to provide data and automated decisions
Providing your account and contact data is required in order to use the service. No automated individual decision-making within the meaning of Art. 22 GDPR, and no profiling, takes place.
Product Updates
If you enter your email address in the signup form in our footer, we store it for the sole purpose of sending you occasional product updates — new fields, data freshness changes, and roadmap notes. The submission is delivered to us through Web3Forms. We ask you to confirm your subscription before we send anything further, and every message includes a way to unsubscribe. We do not share the address with anyone else, and we delete it as soon as you unsubscribe or ask us to.
The German version of this privacy policy governs in case of conflict.