Legal

Data Protection and Your Rights

What you can ask us to do with your personal data, how to ask, and what happens next. Nothing on this page takes a right away.

Last updated 29 September 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the operator’s address, several retention periods, confirmation of which provider agreements are actually signed, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

35 outstanding items— show

serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at
commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does
VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is
second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly
how the current-month refund promise applies to an annual plan — a twelfth, the unused remainder, or not at all. Decide before an annual plan is sold
the refund window on a founding lifetime purchase — 30 days from payment is the reading this draft assumes, and it needs confirming rather than inheriting subscription wording
languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into
the seller for a paid contract — for a Paddle purchase, the Paddle entity named at checkout and on the invoice, with its postal address and email
Review of all ten documents, the Impressum and the implementation-fund rules by a lawyer in Germany — after the operator's address and registration position are settled, because that is half of what counsel checks.
Whether a data protection officer has to be appointed despite the headcount, which turns on whether location-linked consultation and survey responses amount to processing that requires a data protection impact assessment.
The roles in each institutional feature — whether a municipality is a controller, our controller, or a joint controller for consultations, residency registers and street reports — and the agreement that follows from each answer.
Which provider arrangements are actually signed, in which regions, and under which transfer mechanism. The provider table states what the code configures, which is not the same as a countersigned contract.
Whether the service is an online platform under the Digital Services Act rather than only a hosting service, and which of the platform duties the micro and small enterprise exemption removes.
Whether direct access to the production database is logged, and whether a backup restore has ever actually been run.
which accounting records fall in the 10, 8 and 6-year tiers of §147 AO — the periods differ by document class and run from the end of the calendar year, and the old ten-years-for-everything line was over-retention
when an invitation that is never accepted expires — it is an access grant sitting open, and "until somebody revokes it" is not a period
a period per category for correspondence — handling, then a justified follow-up or claims window. "Until somebody asks us to remove it" is not a retention period, it is the absence of one
how long verification evidence is kept after the thing it verified is decided — the decision has to outlast it, the document usually does not
when a waiting-list subscription expires if the list is never used — it survives account deletion, because it was left without needing an account
how long the identifiers that survive a webhook payload are kept — they are what stops a duplicate, and they are still linkable to a transaction
whether attribution should expire before the account does — it answers a question about a signup that stops being asked long before the account closes
the purpose and lawful ground for keeping a country code on the signup record. It is written whether or not attribution was accepted, which the privacy policy used to deny, and currency presentation does not need it stored
the retention configured on the analytics project, and whether an erasure here propagates to it
how long the evidence of a rights request is kept after it is met — a justified period, rather than "kept"
a schedule per civic feature, and the controller each one belongs to. A municipality running a consultation sets its own period; where we set it, it has to be written down
each provider's own log retention, and the maximum age of a backup before it expires
a justified maximum for the staff audit log, and the rule that reviews it. The 180-day expiry of the identifying half is enforced; the row itself has no end
a justified maximum for the record of a support session — somebody here opening your account to help — on the same footing as the staff audit log above
where the Photon instance we call actually runs, and who operates it
where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions
the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory
the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume
a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets
whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent
a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing

1. The short version

Write to hello@streetshape.org and say which account it is about and what you want us to do. No form, no legal wording, no reason required.

We may ask for proportionate verification where we would otherwise risk handing somebody else’s data over, or deleting it. That is the only reason we will ask.

2. Who your request goes to

Daniel Halabi is the controller for your account, your plans, billing, security and the running of the platform. That is most of it, and it all comes to the address above.

Where a municipality or another institution decides the purpose of something — a consultation it is running, a residency register it maintains, a street-report process it receives into — that body is the controller for it and the request belongs with them. We will tell you which one and how to reach them, and help with what is ours to do. You do not lose a right because the data sits in a service provider’s systems.

This page used to say there was no municipal inbox and so no institutional controller to write to. Consultations, surveys, residency verification, street reports and the public API have shipped since, and the sentence did not survive them.

3. Each right, and what it means here

Your rights under the GDPR and what each one does
Right	What you can ask for
Access	A copy of the personal data we hold about you, and the information about how it is processed.
Correction	Anything inaccurate corrected, and anything incomplete completed.
Erasure	Data deleted where one of the Art. 17 grounds applies. We will explain anything we have to keep, and restrict it to the reason we are keeping it.
Restriction	Processing paused while something is disputed or checked.
Portability	The data you gave us, in a structured, commonly used, machine-readable form — and sent directly to another provider where that is technically feasible.
Objection	An objection to processing based on a legitimate interest, on grounds relating to your situation — and to direct marketing at any time, with no grounds needed.
Withdrawing consent	Consent taken back at any time. It stops future processing; it does not make what was already done unlawful.
Automated decisions	Where a decision is taken solely by automated means and has a legal or similarly significant effect, the safeguards in Art. 22 — including a person to look at it.

Each of these has conditions and exceptions. Where one limits what we can do for you, we will say which one and why, rather than declining without a reason.

4. How long we take, and what it costs

We answer without undue delay and normally within one month. Where complexity or the number of requests permits it, we may extend by up to two further months — and we will tell you that, and why, within the first month.

Requests are free. The law permits a fee or a refusal for a request that is manifestly unfounded or excessive, and if we ever relied on that we would have to justify it to you.

5. Getting a copy of your data

Your dashboard already gives you your plans and the exports built into the product. An image or a PDF is not a complete copy of your personal data, though, so ask us at hello@streetshape.org for the full one.

What comes back is an archive of structured data and the associated files. It is kept for seven days and the download link is signed and lasts fifteen minutes — a permanent link to a complete copy of your account is a bigger risk than the request it answers. Ask us for a fresh link if that one expires.

6. Deleting your account

There is a delete control in your account settings, and you can ask us by email instead. Save anything you want to keep first.

What deletion does not reach

Invoices and accounting records, which are kept for the period the law requires.
A submission that a consultation or an organization is separately and lawfully holding.
Backups, until they expire on their own schedule.
The minimal record that a request was made and met, which is what makes it checkable that we did it.

The retention table sets out each of those, including the rows where a period is still an open question. Deletion reaches our live systems at once; the rest is a process, and the policy describes it as one.

If you are deleting an account while a subscription is running, tell us, so the deletion does not leave a renewal behind it. Revoking a share link stops future access through that link; it does not recall a copy somebody already downloaded.

7. Who else holds it

The same list as the privacy policy, because there is only one list.

The companies involved in running StreetShape, what reaches each one and on what footing
Provider	What they do	What reaches them	Where, and what is unconfirmed
Clerk	Accounts, sign-in and session security Acts on our instructions	Email address, name and avatar if you have one, your password or the social account you signed in with, sessions and two-factor settings	United States (Google Cloud and Cloudflare) Still to confirm: Which Clerk entity is on the contract, that a data processing agreement is signed, the regions the instance actually runs in, and the transfer mechanism relied on. This row used to assert the EU–US Data Privacy Framework with standard contractual clauses behind it; a framework certification has to be current and has to cover the transfer, which is a thing to look up rather than a thing to state
Supabase	The database, and storage for plan thumbnails Acts on our instructions	Everything the service stores: your account record, your plans and their versions, preferences, subscription and usage records	European Union — Frankfurt, Germany (aws eu-central-1) Still to confirm: The region the production project is actually provisioned in, where support access comes from, where backups are held, and the signed agreement. An EU project region does not by itself establish that every access stays in the EEA
Paddle	Payment, as merchant of record Decides its own purposes — its notice governs, not ours	Name, billing address, country, tax status, payment method and invoices. We never receive card details	United Kingdom (Paddle.com Market Limited), which the EU recognizes as adequate, with onward processing in the EEA, the United States, Canada and Ireland Still to confirm: Which Paddle entity sells to the customer, since that entity is the seller named at checkout, on the invoice and in the withdrawal notice on the refund page
MapTiler	Basemap tiles and satellite imagery Footing not established — see the note in the last column	Tile requests made by your browser: the coordinates and zoom you are looking at, your IP address and user agent	Switzerland (MapTiler AG, Zug), which the EU recognizes as adequate. Their policy says some of their own suppliers sit outside the EU and Switzerland without naming the safeguard, which is stated here rather than smoothed over Still to confirm: Whether MapTiler acts on our instructions for tile delivery or decides its own purposes. Your browser requests tiles directly, so the request is between you and them, and treating that as processing on our documented instructions is an assumption rather than a reading of a contract
Mapbox	The editor's map, for accounts on a plan that includes it Footing not established — see the note in the last column	Only while you have the editor open on such a plan: the map requests your browser makes — the coordinates and zoom you are looking at, your IP address and user agent — and the usage events Mapbox's map library sends to count a map load	United States (Mapbox, Inc.) Still to confirm: The contracting entity, whether Mapbox acts on our instructions for map delivery or decides its own purposes (the browser requests tiles directly, as it does from MapTiler), the transfer mechanism relied on for the United States, and what the usage events carry. None of it has been read against a signed agreement yet
Komoot (Photon)	Address search Footing not established — see the note in the last column	The text you type into the location search. The request is made by our server, so your IP address is not sent	[where the Photon instance we call actually runs, and who operates it] Still to confirm: Who operates the instance, on what terms a public endpoint may be used at our volume, and what the operator does with the queries. A per-process rate limit in our own code is not the same as staying inside a provider's limits
OpenStreetMap Foundation (Nominatim)	Address search, when Photon is unavailable Footing not established — see the note in the last column	The same search text, on the same terms	[where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions] Still to confirm: The public instance's usage policy and whether a fallback at our volume is within it. This is the row most likely to be answered by moving to an instance we run
Resend	Transactional email — collaboration invites and service notices Acts on our instructions	The recipient's email address and the contents of the message	United States Still to confirm: The contracted entity, the signed agreement and the transfer mechanism. An EU sending region does not move the metadata, as the note above sets out
PostHog	Product analytics — which steps people reach, and where they stop Acts on our instructions	A short list of named events (a page view, opening the editor, drawing a road, saving a plan, a purchase) with your account id attached if you are signed in. Only if you accepted the cookie banner, and only from our servers — your browser never contacts PostHog, so it never receives your IP address or your user agent	EU, by configuration Still to confirm: Whether the integration is enabled in production, the project's configured region and event retention, who can read the project, and the signed agreement. Also whether a deletion here propagates to PostHog, which the account-erasure routine does not currently establish
Vercel	Running the site Acts on our instructions	Ordinary web-server logs: IP address, user agent, requested URL	European Union — Frankfurt (fra1) for the application itself. Vercel Inc. is in the United States and may access logs from there Still to confirm: The transfer mechanism for that access, how long the platform's own request logs are kept, and the delivery infrastructure in front of the application, which is wider than the region the functions run in

8. Transfers, retention and security

Where data goes, how long it stays and what protects it are in the privacy policy and on the security page. They are written once and referenced here rather than summarized into a second version that can drift from the first.

9. Complaining

You can complain to a supervisory authority — in the EU member state where you habitually live, where you work, or where you think the infringement happened. You do not have to come to us first, and doing so does not use up the right.

For a private-sector operator established in Bavaria, that is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) (https://www.lda.bayern.de). Which authority it actually is follows where the operator is established, so this line depends on the address that is still outstanding at the top of this page.

10. What we will not do

Sell personal data, or hand it to advertising networks.
Train machine-learning models on your plans.
Make you use a form, create a ticket or give a reason before we will act on a request.
Ask for identity documents where a proportionate check would do.

11. One thing this page is not about

Data protection is not professional certification

StreetShape is a concept-design and communication tool. Complying with data-protection law says nothing about whether a design in it is accurate, buildable or safe — the limits in the terms apply whatever this page says.

This section is the only reason the route is still called/gdpr-disclaimer. It is a note about the product, not a disclaimer of anybody’s rights, and the rest of the page never was one.

Daniel Halabi, [serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at] · hello@streetshape.org