Legal

Service Providers and Subprocessors

Who is involved in running StreetShape, what reaches each of them, and — just as important — what we have not yet confirmed about any of it.

Last updated 29 September 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the operator’s address, several retention periods, confirmation of which provider agreements are actually signed, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

35 outstanding items— show

serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at
commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does
VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is
second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly
how the current-month refund promise applies to an annual plan — a twelfth, the unused remainder, or not at all. Decide before an annual plan is sold
the refund window on a founding lifetime purchase — 30 days from payment is the reading this draft assumes, and it needs confirming rather than inheriting subscription wording
languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into
the seller for a paid contract — for a Paddle purchase, the Paddle entity named at checkout and on the invoice, with its postal address and email
Review of all ten documents, the Impressum and the implementation-fund rules by a lawyer in Germany — after the operator's address and registration position are settled, because that is half of what counsel checks.
Whether a data protection officer has to be appointed despite the headcount, which turns on whether location-linked consultation and survey responses amount to processing that requires a data protection impact assessment.
The roles in each institutional feature — whether a municipality is a controller, our controller, or a joint controller for consultations, residency registers and street reports — and the agreement that follows from each answer.
Which provider arrangements are actually signed, in which regions, and under which transfer mechanism. The provider table states what the code configures, which is not the same as a countersigned contract.
Whether the service is an online platform under the Digital Services Act rather than only a hosting service, and which of the platform duties the micro and small enterprise exemption removes.
Whether direct access to the production database is logged, and whether a backup restore has ever actually been run.
which accounting records fall in the 10, 8 and 6-year tiers of §147 AO — the periods differ by document class and run from the end of the calendar year, and the old ten-years-for-everything line was over-retention
when an invitation that is never accepted expires — it is an access grant sitting open, and "until somebody revokes it" is not a period
a period per category for correspondence — handling, then a justified follow-up or claims window. "Until somebody asks us to remove it" is not a retention period, it is the absence of one
how long verification evidence is kept after the thing it verified is decided — the decision has to outlast it, the document usually does not
when a waiting-list subscription expires if the list is never used — it survives account deletion, because it was left without needing an account
how long the identifiers that survive a webhook payload are kept — they are what stops a duplicate, and they are still linkable to a transaction
whether attribution should expire before the account does — it answers a question about a signup that stops being asked long before the account closes
the purpose and lawful ground for keeping a country code on the signup record. It is written whether or not attribution was accepted, which the privacy policy used to deny, and currency presentation does not need it stored
the retention configured on the analytics project, and whether an erasure here propagates to it
how long the evidence of a rights request is kept after it is met — a justified period, rather than "kept"
a schedule per civic feature, and the controller each one belongs to. A municipality running a consultation sets its own period; where we set it, it has to be written down
each provider's own log retention, and the maximum age of a backup before it expires
a justified maximum for the staff audit log, and the rule that reviews it. The 180-day expiry of the identifying half is enforced; the row itself has no end
a justified maximum for the record of a support session — somebody here opening your account to help — on the same footing as the staff audit log above
where the Photon instance we call actually runs, and who operates it
where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions
the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory
the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume
a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets
whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent
a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing

1. What this list means

Three different relationships appear below, and the difference decides whose notice governs and who answers a request about you.

A processor acts on a controller’s documented instructions, under terms that say so.
A subprocessor is a processor engaged by a processor — which is what we are, for an institution’s data.
An independent controller decides its own purposes. Its privacy notice governs its processing, not ours.

One company can be more than one of these at once, for different activities. Nothing is described as a subprocessor merely because it receives a request.

2. The register

The companies involved in running StreetShape, what reaches each one and on what footing
Provider	What they do	What reaches them	Where, and what is unconfirmed
Clerk	Accounts, sign-in and session security Acts on our instructions	Email address, name and avatar if you have one, your password or the social account you signed in with, sessions and two-factor settings	United States (Google Cloud and Cloudflare) Still to confirm: Which Clerk entity is on the contract, that a data processing agreement is signed, the regions the instance actually runs in, and the transfer mechanism relied on. This row used to assert the EU–US Data Privacy Framework with standard contractual clauses behind it; a framework certification has to be current and has to cover the transfer, which is a thing to look up rather than a thing to state
Supabase	The database, and storage for plan thumbnails Acts on our instructions	Everything the service stores: your account record, your plans and their versions, preferences, subscription and usage records	European Union — Frankfurt, Germany (aws eu-central-1) Still to confirm: The region the production project is actually provisioned in, where support access comes from, where backups are held, and the signed agreement. An EU project region does not by itself establish that every access stays in the EEA
Paddle	Payment, as merchant of record Decides its own purposes — its notice governs, not ours	Name, billing address, country, tax status, payment method and invoices. We never receive card details	United Kingdom (Paddle.com Market Limited), which the EU recognizes as adequate, with onward processing in the EEA, the United States, Canada and Ireland Still to confirm: Which Paddle entity sells to the customer, since that entity is the seller named at checkout, on the invoice and in the withdrawal notice on the refund page
MapTiler	Basemap tiles and satellite imagery Footing not established — see the note in the last column	Tile requests made by your browser: the coordinates and zoom you are looking at, your IP address and user agent	Switzerland (MapTiler AG, Zug), which the EU recognizes as adequate. Their policy says some of their own suppliers sit outside the EU and Switzerland without naming the safeguard, which is stated here rather than smoothed over Still to confirm: Whether MapTiler acts on our instructions for tile delivery or decides its own purposes. Your browser requests tiles directly, so the request is between you and them, and treating that as processing on our documented instructions is an assumption rather than a reading of a contract
Mapbox	The editor's map, for accounts on a plan that includes it Footing not established — see the note in the last column	Only while you have the editor open on such a plan: the map requests your browser makes — the coordinates and zoom you are looking at, your IP address and user agent — and the usage events Mapbox's map library sends to count a map load	United States (Mapbox, Inc.) Still to confirm: The contracting entity, whether Mapbox acts on our instructions for map delivery or decides its own purposes (the browser requests tiles directly, as it does from MapTiler), the transfer mechanism relied on for the United States, and what the usage events carry. None of it has been read against a signed agreement yet
Komoot (Photon)	Address search Footing not established — see the note in the last column	The text you type into the location search. The request is made by our server, so your IP address is not sent	[where the Photon instance we call actually runs, and who operates it] Still to confirm: Who operates the instance, on what terms a public endpoint may be used at our volume, and what the operator does with the queries. A per-process rate limit in our own code is not the same as staying inside a provider's limits
OpenStreetMap Foundation (Nominatim)	Address search, when Photon is unavailable Footing not established — see the note in the last column	The same search text, on the same terms	[where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions] Still to confirm: The public instance's usage policy and whether a fallback at our volume is within it. This is the row most likely to be answered by moving to an instance we run
Resend	Transactional email — collaboration invites and service notices Acts on our instructions	The recipient's email address and the contents of the message	United States Still to confirm: The contracted entity, the signed agreement and the transfer mechanism. An EU sending region does not move the metadata, as the note above sets out
PostHog	Product analytics — which steps people reach, and where they stop Acts on our instructions	A short list of named events (a page view, opening the editor, drawing a road, saving a plan, a purchase) with your account id attached if you are signed in. Only if you accepted the cookie banner, and only from our servers — your browser never contacts PostHog, so it never receives your IP address or your user agent	EU, by configuration Still to confirm: Whether the integration is enabled in production, the project's configured region and event retention, who can read the project, and the signed agreement. Also whether a deletion here propagates to PostHog, which the account-erasure routine does not currently establish
Vercel	Running the site Acts on our instructions	Ordinary web-server logs: IP address, user agent, requested URL	European Union — Frankfurt (fra1) for the application itself. Vercel Inc. is in the United States and may access logs from there Still to confirm: The transfer mechanism for that access, how long the platform's own request logs are kept, and the delivery infrastructure in front of the application, which is wider than the region the functions run in

This table is generated from lib/legal/processing.ts, which is the same source the privacy policy and the data-rights page render. Three pages, one list, no chance of them disagreeing.

3. What is not settled

Read the last column before relying on this page

Every “still to confirm” note is a real gap. The contracted entity, the signed data processing agreement, the region a project is actually provisioned in, whether a Data Privacy Framework certification is current and covers the transfer — none of that can be read out of a repository, and this page was written from one.

The previous version stated several of those as settled facts. They have been turned back into questions rather than left standing, because a procurement officer reading this page is entitled to assume that what it asserts was checked.

4. Paddle is different

Paddle is not our processor. It is the merchant of record: it sells to you, and for the payment it decides its own purposes.

That is why its own privacy notice governs what it does with your billing information, why the entity named at checkout and on your invoice is the seller, and why the statutory withdrawal notice in the refund policy is addressed to it rather than to us. We never receive or store card details.

5. The two geocoders

Photon and, as a fallback, Nominatim answer address searches. Your browser does not contact either: our server forwards the text, so your IP address is not sent. The query itself can be personal information, because an address usually is.

Both are public endpoints, and they used to be listed here as subprocessors. They are not: nobody signed anything, and calling a public service does not create an Art. 28 relationship with whoever runs it. What each row now carries instead is the question — who operates the instance, on what terms it may be used at our volume, and what they do with the queries.

Searches are cached by our server for ten minutes, and responses may be cached by your browser for five. The privacy policy says the same thing, having previously said search text was never stored anywhere.

6. What is not on this list

No advertising or marketing-automation platform.
No third-party analytics script running in your browser.
No customer-data platform, and no data broker.
No model-training provider receiving your plans.

Municipalities, collaborators you invite and the public are not infrastructure providers, and they are not on this list. Who can see what you publish or submit is in the privacy policy.

A provider introduced by turning on an integration has to be added here before the processing starts. A development-only map fallback must not quietly become an undisclosed production recipient.

7. Contracts and changes

Where a processor relationship applies, we use written data processing terms restricting processing to documented instructions, and covering confidentiality, security, assistance, deletion and further subprocessors. Where we process an institution’s data, the signed agreement with that institution names the authorized subprocessors and the safeguards.

If you have a data processing agreement with us, we give you at least 30 days notice before a new or replacement subprocessor starts, unless that agreement expressly sets out a different procedure. You may object on reasonable data-protection grounds, and we will consider the objection and look for a resolution under the agreement before the processing goes ahead.

A change to an independent controller is assessed on what it actually does and what transparency or consent that requires. This public page is not itself a complete institutional agreement — write to hello@streetshape.org for the contractual documents and to be put on the change list.