Privacy Policy (Datenschutzerklärung)

Controller (Verantwortlicher)

The controller under the General Data Protection Regulation (GDPR) is logostream UG (haftungsbeschränkt), Hollersacker 2, 36124 Eichenzell, Germany.

E-mail: sales@vectorstream.dev

What we process and why

This section covers each part of the website and the purpose and legal basis of the data processing in it.

Visiting the website and server logs

We host the website on Cloudflare Pages. The provider is Cloudflare, Inc., USA. Cloudflare provides the hosting, the content delivery network (CDN), the domain name system (DNS) and the protection against denial-of-service attacks.

When you open a page, Cloudflare's servers receive your IP address and the technical data that your browser sends with every request. Cloudflare writes this data to server logs.

We process this data to deliver the website to you and to keep it secure and available. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a website that works and is protected against attacks.

Cloudflare acts as a service provider on our behalf as far as Cloudflare's own terms and its Customer Data Processing Addendum provide.

Cloudflare, Inc. is based in the USA. In its documentation, Cloudflare states that it relies on its certification under the EU-U.S. Data Privacy Framework for transfers to the USA, and on the EU standard contractual clauses if that certification lapses.

Contact by e-mail

The website has no contact form. You reach us by e-mail at sales@vectorstream.dev. Cloudflare Email Routing receives your message and forwards it to our mailbox at an external e-mail provider chosen by us.

We process your e-mail address, the content of your message and any other data that you send us, to answer your request. The legal basis is Art. 6(1)(b) GDPR when your request concerns a contract or the preparation of one, for example a purchase, seats or your licence. In all other cases the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to answer the enquiries that we receive.

Playground and editor

The page /playground/ shows the editor in a frame. The editor is the application under /app/, which you can also open on its own. The map loads when the playground opens the editor.

The editor runs in your browser. It does not send your documents to a server. We receive no drawings, imports or exports from you. The editor stores your documents in your browser only, as the section on local storage below describes.

When the map loads, your browser requests map tiles from tile.openstreetmap.org. This service belongs to the OpenStreetMap Foundation, United Kingdom. Its privacy policy says that map tiles are provided by a global network of cache servers, and that the Foundation engaged a provider of a content distribution network (CDN).

Your browser sends your IP address and technical browser data to a server of this network. It also sends our website address as the referrer. Each tile request names a tile of the map, so it shows which map area and zoom level you view.

The privacy policy of the Foundation also says that some of its systems are operated and controlled by third parties and can be located in countries other than the United Kingdom. We cannot exclude that a server outside the United Kingdom handles your request. The European Commission has found that the United Kingdom ensures an adequate level of data protection. The Foundation and its CDN provider decide how they process the data of your request, and we have no influence on it.

These tiles are third-party content that the map needs. We load them based on Art. 6(1)(f) GDPR. Our legitimate interest is a working map in the editor. We do not rely on consent. The OpenStreetMap Foundation decides how it processes the data of the request. Its privacy policy is here: OpenStreetMap Foundation privacy policy

Apart from these map tiles, our pages and the editor load all fonts, scripts, images and styles from our own domain. The fonts are hosted by us and not loaded from a font service.

Purchases and Pro customers

We sell vectorstream Pro through Polar. Polar is operated by Polar Software Inc., USA. Polar acts as merchant of record and is the seller of record of your purchase. For the data of the purchase, such as payment and invoice data, Polar is a separate controller under its own privacy policy. Our website only links to Polar, for the checkout and for the customer portal. It does not load content from Polar.

We receive your contact data and the order data of your purchase from Polar (Art. 14 GDPR). We process this data to issue your licence key and your registry access token and to send them to you by e-mail. We also use it to answer your questions about your licence and your seats. The legal basis is Art. 6(1)(b) GDPR. Where commercial or tax law requires us to keep records, the legal basis for keeping them is Art. 6(1)(c) GDPR.

The registry for Pro customers is a private package registry. GitLab.com hosts it. When your package manager installs Pro, it sends requests to this registry. The registry provider receives the technical data of these requests, for example your IP address. Transfers to countries outside the EU and the EEA rely on the mechanisms provided for in Chapter V GDPR, such as an adequacy decision or standard contractual clauses, as described in the provider's documentation.

Links to other websites

Our pages contain links to other websites, for example to Polar, to GitHub and to the sources named on the comparison pages. Opening our page sends no data to these sites. If you follow a link, the other site receives your request, and its own privacy policy applies.

Cookies, local storage and tracking

We do not set cookies. We use no analytics, no advertising and no tracking services. Our content security policy lets the pages load content from our own domain only, apart from the map tiles of the editor.

The website and the editor use the storage of your browser (local storage, session storage and IndexedDB) for the following. This data stays in your browser. We cannot read it, and the browser does not send it to us.

• Website: when you click "Pause animations" in the footer, the website stores your choice in local storage. Switching the animations on again removes it.
• Editor: when you open the editor, it stores your language, your map library and the document you opened last in local storage. It also stores whether the JSON panel is open.
• Editor: after an import or after applying JSON, the editor keeps one message for the next page load in session storage of the tab, and removes it when it shows it.
• Editor: the editor saves your documents in IndexedDB while you work. This includes the example document that you see when you first open the editor, and one previous version of each document.

Under § 25 TDDDG, storing information on your device or reading it needs your consent, unless it is strictly necessary to provide a service that you ask for. The website and the editor store your settings (animations, language, map library, last document) and your documents only to provide the functions that you use. They do not use this storage for tracking. Therefore we do not ask for consent for it.

You can delete this storage at any time in the settings of your browser. Deleting the site data of this page also deletes your documents. Export a GeoJSON file first if you want to keep a copy.

Service providers and recipients

These parties receive personal data in the cases described above:

• Cloudflare, Inc., USA: hosting, CDN, DNS, protection against attacks, server logs including the IP address, and e-mail forwarding (Cloudflare Email Routing).
• An external e-mail provider chosen by us: the mailbox that receives the e-mails sent to our address.
• OpenStreetMap Foundation, United Kingdom: map tiles in the editor, delivered through a CDN.
• Polar Software Inc., USA (Polar): seller of record and separate controller for the purchase data.
• GitLab.com: hosting of the private package registry for Pro customers.

Retention

• Server logs: we run no server logs of our own. Cloudflare keeps technical logs according to its own terms.
• E-mails: we keep them as long as we need them to answer your request, and as long as statutory retention obligations require.
• Customer data: we keep it as long as we need it to deliver and support your licence, and as long as statutory retention obligations of commercial and tax law require.
• Data in your browser: it stays there until you delete it.
• Map tile requests: the OpenStreetMap Foundation decides how long it keeps them.

Your rights (Betroffenenrechte)

You have these rights under the GDPR:

• Access to your personal data (Art. 15).
• Rectification of incorrect data (Art. 16).
• Erasure (Art. 17).
• Restriction of processing (Art. 18).
• Data portability (Art. 20).

To use these rights, write to us at the address in the section Contact. You also have the right to complain to a supervisory authority. The authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit in Wiesbaden: datenschutz.hessen.de

Right to object (Widerspruchsrecht)

You can object at any time. On grounds relating to your particular situation, you have the right to object to the processing of your personal data that is based on Art. 6(1)(f) GDPR (Art. 21 GDPR). This applies to all processing in this policy that rests on our legitimate interests. After your objection we stop the processing, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, write to us: sales@vectorstream.dev

Providing data and automated decisions

No law and no contract requires you to give us personal data to visit the website. Your browser must send the technical data of a connection, or the website cannot be delivered. To get an answer from us or a licence, we need the data named above. Without it we cannot answer or deliver.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Security

The website is served over HTTPS, and the browser is told to use HTTPS only. The content security policy and other security headers of our pages limit which hosts a page may load content from. The editor runs in your browser, so your documents do not pass through our systems.

Changes

We change this policy when the website, the editor or our service providers change. The date at the top of this page shows when the current version was written.

Contact

logostream UG (haftungsbeschränkt), Hollersacker 2, 36124 Eichenzell, Germany

E-mail: sales@vectorstream.dev

The imprint holds the full provider details: Imprint (Impressum)