Your data rights

What the GDPR entitles you to, and how to use each of it without writing a legal letter.

Last updated 29 August 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the company details, the governing law and the retention periods a human has to decide, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

31 outstanding items— show

legal entity name
country of incorporation
company registration number
VAT number
registered office address
EU representative, if the entity sits outside the EU
data protection officer, if one is required
supervisory authority
supervisory authority website
governing law and jurisdiction
ADR body to signpost, if the jurisdiction requires one
minimum age — GDPR Art. 8 allows 13 to 16 by member state
refund position, beyond the statutory withdrawal right
liability cap
voluntary refund window — the draft recommends 30 days
window for refunding a renewal somebody meant to cancel — the draft recommends 14 days
acknowledgement time for a vulnerability report — the draft recommends 2 working days
coordinated disclosure window — the draft recommends 90 days
notice period before a new sub-processor starts, for accounts with a DPA — the draft recommends 30 days
canonical domain — the code uses streetshape.app, the site publishes streetshape.io
Whether classroom use is supported — the education material invites it, which makes under-16 users foreseeable and decides the minimum age above.
The statutory retention period for accounting records in the country of incorporation.
Retention windows for municipality demo requests, the email log, and stored Paddle webhook payloads.
Whether Paddle's checkout captures the Art. 16(m) consent and acknowledgement the Terms rely on for digital content supplied immediately.
The region each processor runs in, and the transfer mechanism relied on for each.
Review of all nine documents by a lawyer in the jurisdiction of incorporation.
Whether a data processing agreement is actually executed with each provider on the sub-processor list, and whether a StreetShape DPA template exists for a municipality or university to sign.
Which imagery and elevation providers sit behind MapTiler's satellite and terrain styles, read from the styles themselves rather than written from memory.
Whether MapTiler's agreement permits printing and republishing satellite imagery, which is a different grant from viewing it on screen.
Whether the Digital Services Act treats StreetShape as a hosting service or an online platform — public proposal boards and consultations point at the second, which carries notice-and-action, statement-of-reasons and appeal duties.
Whether access to production data is logged, and whether a backup restore has ever actually been run.

1. The short version

You have rights over the personal data we hold about you. All of them are free to use, none needs a form, a lawyer or a particular form of words, and we answer within one month. Email hello@streetshape.io and say what you want.

The authoritative detail is in the privacy policy. This page is how to actually do it.

2. Who is responsible for your data

[legal entity name] is the controller of everything described here. That does not change depending on how you got your account.

If your municipality pays for your account

We are still the controller, and your municipality does not get your email address, your plans or your activity. What it has is a subscription and a count. Being a resident with an account means your account is associated with that municipality and that you draw inside its boundary — it does not give the municipality a window into your work.

Today nothing is sent to a municipality at all, because there is nowhere to send it: no submission inbox exists. When one is built, sending a plan to a municipality becomes a disclosure to a third party and this section has to change with it — not afterwards.

3. Each right, and how to use it

Your rights and how to exercise each one
Right	What to do
See what we have	Ask, and we will send you everything we hold about you in a readable format.
Correct something wrong	Your name and photo are editable in your account settings. Your email address is not, and neither is anything else — tell us and we will fix it.
Delete it	Delete your account yourself from your account settings — see deleting your account. Or ask us to.
Take it elsewhere	Ask for a copy of your plans and account data in a machine-readable format — see getting a copy of your data.
Object to what we do with it	Email us and say which processing. We will either stop or explain why we believe our grounds override — and you can complain if you disagree.
Have us pause	Ask us to restrict processing while a dispute about accuracy or grounds is sorted out.
Withdraw consent	Email us. There is no marketing list here to unsubscribe from — where you asked to be contacted, say so and we will remove you. Withdrawing does not affect anything already done.
Not be subject to automated decisions	We do not make any. Student applications are read by a person; plan limits are the terms of the plan you chose, not a decision about you.

4. Deleting your account

You can do this yourself, now, without asking us. It is in your account settings, under security, and it takes a typed confirmation because it cannot be undone.

Deleting your account deletes your plans. Export anything you want to keep first — we cannot get it back afterwards, and that is a design decision rather than a limitation.

What goes: your account record, every plan and every saved version, your preferences, your thumbnails, your entitlements and usage counts, your student application, and any collaboration access you held. It happens as a consequence of your account row being removed, so nothing can be missed.

What stays, and why, is set out in the privacy policy: billing records the law makes us keep, an address you left on a waiting list or a demo request that was never tied to your account, a log that an email was sent, and backups until they expire on their own cycle. Ask us and we will remove the first two of those where the law lets us.

5. Getting a copy of your data

Ask at hello@streetshape.io and we will send you your account details, your plans and their version history, your billing history and any correspondence you have had with us.

Some of it you already have. Your plans are in your dashboard, and any of them can be exported as an image from the editor. Your billing history is on the billing panel of your account.

To be straight about the mechanism: the editor exports pictures, not data. A machine-readable copy of the plans themselves is prepared by hand when you ask for one. That is an acceptable way to serve a portability request at our size, and a self-service export would be better — the data is already structured for it. What we will not do is describe a button that does not exist.

6. Complaining

Come to us first if you can — hello@streetshape.io. If we get it wrong, or you would rather not, you can complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. You do not need to have complained to us first.

Our supervisory authority is [supervisory authority] ([supervisory authority website]).

7. Who else processes your data

The complete list. It is repeated from the privacy policy on purpose — this is the page people land on when they search for who we use.

The companies that process personal data on our behalf
Provider	What they do	What reaches them	Where
Clerk	Accounts, sign-in and session security	Email address, name and avatar if you have one, your password or the social account you signed in with, sessions and two-factor settings	[Clerk region]
Supabase	The database, and storage for plan thumbnails	Everything the service stores: your account record, your plans and their versions, preferences, subscription and usage records	[Supabase project region]
Paddle	Payment, as merchant of record — as an independent controller, not our processor	Name, billing address, country, tax status, payment method and invoices. We never receive card details	[Paddle region]
MapTiler	Basemap tiles and satellite imagery	Tile requests made by your browser: the coordinates and zoom you are looking at, your IP address and user agent	[MapTiler region]
Komoot (Photon)	Address search	The text you type into the location search. The request is made by our server, so your IP address is not sent	EU
OpenStreetMap Foundation (Nominatim)	Address search, when Photon is unavailable	The same search text, on the same terms	EU
Resend	Transactional email — collaboration invites	The recipient's email address and the contents of the message	[Resend region]
[hosting provider]	Running the site	Ordinary web-server logs: IP address, user agent, requested URL	[hosting region]

/subprocessors is the citable version — the URL a data processing agreement points at, with the change-notice terms alongside it.

8. Transfers, retention and security

Transfers. Where a provider is outside the European Economic Area we rely on Standard Contractual Clauses, or on an adequacy decision where one applies. The region for each is in the table above.

Retention. Kept while your account exists, except where the law requires longer — the full table is in the privacy policy.

Security. Three things that are true rather than reassuring: identity is delegated to a specialist provider, so there is no password here to lose; access to your data is enforced by policies inside the database rather than by the application code that renders a page; and plan limits are enforced by database triggers rather than in the browser. “Checked in TypeScript” and “enforced” are not the same statement, and where it matters we do the second one. The longer account, including what we do not yet have, is on the security page.

If something goes wrong. If a breach affects your personal data we will notify the supervisory authority within 72 hours, and tell you directly where the regulation requires it.

9. What we will not do

We will not charge you for any of this.
We will not require a particular form of words. “Delete my account” is a valid erasure request.
We will not ask why. You do not have to have a reason.
We will not make it harder than it needs to be. If any of this is difficult, that is a bug and we want to hear about it.

10. Disclaimer

Separate from your data rights, and the other thing worth knowing before an institution adopts StreetShape:

StreetShape is not engineering software

It is a tool for drawing and communicating street-design concepts. It does not check a design against any standard, code or regulation, does not model traffic, capacity, safety or drainage, and cannot tell you whether something can be built or would be safe if it were.

A plan drawn here is not a construction document, an engineering drawing, a survey or professional advice. Do not build from it. Have anything you intend to act on assessed by a qualified professional.

Map data and imagery come from third parties and can be wrong, incomplete or out of date; none of it is a survey. The binding version of all of this is what StreetShape is, and what it is not in the terms and conditions.