Legal

Impressum

Who operates StreetShape, and how to reach us. Provider identification under §5 DDG.

Last updated 17 September 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the operator’s address, several retention periods, confirmation of which provider agreements are actually signed, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

35 outstanding items— show

serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at
commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does
VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is
second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly
how the current-month refund promise applies to an annual plan — a twelfth, the unused remainder, or not at all. Decide before an annual plan is sold
the refund window on a founding lifetime purchase — 30 days from payment is the reading this draft assumes, and it needs confirming rather than inheriting subscription wording
languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into
the seller for a paid contract — for a Paddle purchase, the Paddle entity named at checkout and on the invoice, with its postal address and email
Review of all ten documents, the Impressum and the implementation-fund rules by a lawyer in Germany — after the operator's address and registration position are settled, because that is half of what counsel checks.
Whether a data protection officer has to be appointed despite the headcount, which turns on whether location-linked consultation and survey responses amount to processing that requires a data protection impact assessment.
The roles in each institutional feature — whether a municipality is a controller, our controller, or a joint controller for consultations, residency registers and street reports — and the agreement that follows from each answer.
Which provider arrangements are actually signed, in which regions, and under which transfer mechanism. The provider table states what the code configures, which is not the same as a countersigned contract.
Whether the service is an online platform under the Digital Services Act rather than only a hosting service, and which of the platform duties the micro and small enterprise exemption removes.
Whether direct access to the production database is logged, and whether a backup restore has ever actually been run.
which accounting records fall in the 10, 8 and 6-year tiers of §147 AO — the periods differ by document class and run from the end of the calendar year, and the old ten-years-for-everything line was over-retention
when an invitation that is never accepted expires — it is an access grant sitting open, and "until somebody revokes it" is not a period
a period per category for correspondence — handling, then a justified follow-up or claims window. "Until somebody asks us to remove it" is not a retention period, it is the absence of one
how long verification evidence is kept after the thing it verified is decided — the decision has to outlast it, the document usually does not
when a waiting-list subscription expires if the list is never used — it survives account deletion, because it was left without needing an account
how long the identifiers that survive a webhook payload are kept — they are what stops a duplicate, and they are still linkable to a transaction
whether attribution should expire before the account does — it answers a question about a signup that stops being asked long before the account closes
the purpose and lawful ground for keeping a country code on the signup record. It is written whether or not attribution was accepted, which the privacy policy used to deny, and currency presentation does not need it stored
the retention configured on the analytics project, and whether an erasure here propagates to it
how long the evidence of a rights request is kept after it is met — a justified period, rather than "kept"
a schedule per civic feature, and the controller each one belongs to. A municipality running a consultation sets its own period; where we set it, it has to be written down
each provider's own log retention, and the maximum age of a backup before it expires
a justified maximum for the staff audit log, and the rule that reviews it. The 180-day expiry of the identifying half is enforced; the row itself has no end
a justified maximum for the record of a support session — somebody here opening your account to help — on the same footing as the staff audit log above
where the Photon instance we call actually runs, and who operates it
where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions
the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory
the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume
a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets
whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent
a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing

1. Provider

StreetShape is provided by Daniel Halabi, in Germany. StreetShape is a product name; the party you contract with is the person named here.

Address: [serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at]
Legal form: Sole trader (Einzelunternehmen)
Commercial register: [commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does]
VAT identification number (§27a UStG): [VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is]

A sole trader is entered in the commercial register only above a certain scale, and a VAT identification number is issued only where one has been assigned — so neither of those two lines is necessarily a number waiting to appear. Which of them applies here is marked as outstanding rather than answered, because guessing either way would be a statement about the business rather than a fact about it.

2. Contact

Write to hello@streetshape.org or use the contact form. Both reach the same inbox and a person answers it — there is no support desk to be routed around. Please say what your message is about, so that a privacy request, a billing question, a report of unlawful content and a security report are not all read as support.

Second direct channel: [second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly]

§5 asks for a way to reach us quickly and communicate directly, and whether an email address alone satisfies that has never been settled to everybody’s satisfaction. A second channel is the conservative reading, so the gap is marked rather than argued.

For a vulnerability report use the address and the terms on the security page, which is also what /.well-known/security.txt publishes. For anything about personal data, the privacy policy names the same address and the supervisory authority you can complain to instead.

3. Responsible for editorial content

Responsible for journalistic and editorial content under §18(2) MStV, where it applies: Daniel Halabi, at the address above.

This covers what we write — the blog, the changelog and the documentation. It does not cover what users publish: a proposal, a street report or a plan is its author’s, is identified as such, and how those are moderated and how to report one is in the acceptable use policy.

4. Digital Services Act contact point

For communications under the Digital Services Act — from people using the service and from competent authorities — write to hello@streetshape.org. This channel reaches a person and is not limited to an automated reply.

Languages it is answered in: [languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into]

The interface is translated into more languages than a person here can read a legal notice in, and Art. 11(3) asks about the second thing rather than the first. How to report unlawful content, and what happens to a report, is in the acceptable use policy.

5. Consumer dispute resolution

We are neither willing nor obliged to take part in dispute resolution before a consumer arbitration board, unless a separate agreement or a rule of law requires it in a particular case. Write to us first. Your statutory rights, and your right to bring proceedings before a competent court, are unaffected — the terms say which law applies and where proceedings may be brought.

This page used to give the ten-employee threshold in §36 VSBG as the reason, which reads the provision backwards: the threshold exempts a small business from the duty to inform about arbitration, and says nothing about obliging a larger one to take part in it. Not participating is a position, and it is stated as one.