Privacy Policy

Applicable regulation

This notice is provided under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR). Processing follows the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation and security.

Who is the controller

The controller decides why and how personal data is processed for TerrenoCheck.

Data categories and sources

• data supplied by the buyer: email, chosen language, any optional purpose note, checkout acknowledgements and support messages;
• parcel data: coordinates, address text, selected point and boundary, cadastral reference and readings returned by territorial sources;
• order data: Stripe status, amount, currency, checkout and job identifiers, report and delivery link, but not the full card number or CVC;
• technical data: truncated IP address, user agent, browser language, timestamps, link access, error logs and cookie choices needed for security, diagnosis and operation.

Territorial data comes from the buyer’s selection and the public sources named in the report. Stripe supplies confirmation or non-completion of payment and the references needed to reconcile the order.

Required and optional data

Under GDPR Article 13(2)(e), placing an order requires your email address, the data identifying the parcel and the payment data requested by Stripe. Without these data, payment cannot be completed or the report prepared and delivered. TerrenoCheck receives payment confirmation from Stripe, not the full card number or CVC. The note and purpose of purchase are optional. Analytics cookies are also optional: you can refuse them and still buy a report.

Purposes and legal bases

• contract performance: identify the selected parcel, handle payment and order state, produce, check, deliver and support the report;
• legal obligations: retain the required payment and accounting records;
• legitimate interests: protect accounts and links, prevent abuse and fraud, diagnose errors and demonstrate correct delivery, and learn whether paid ads on ChatGPT lead to orders;
• consent: activate optional cookies, analytics or advertising only, with a choice that can be withdrawn through Cookie choices.

Terms and immediate-performance acknowledgements are kept as evidence of the contract, not as general consent to process personal data. Refusing optional cookies does not prevent a purchase.

Data recipients

Stripe handles payment and fraud prevention; AWS SES delivers messages; Hetzner Online GmbH (Germany) hosts the server that stores the application and reports; Mapbox supplies the storefront maps and the address search: when the map is drawn, your browser loads its images from Mapbox, which therefore receives your IP address, while for a search it receives from our server only the text you typed or the coordinates of the point you picked; for the report Mapbox receives the coordinates of the parcel and nearby places, for maps, travel times and terrain heights, again without your IP address.

The AI recipients that help write the report narrative are OpenAI and, if OpenAI does not answer, xAI or Google. They receive parcel data and report content, without the customer’s first name, surname, email address, phone number or payment details.

A visitor who arrives from an ad on ChatGPT opens the site with a click identifier in the page address. If that visit ends in a purchase, our server tells OpenAI that the click led to an order: the click identifier, the order code, the amount and the order page. We send no name, email address, IP address or parcel data. Orders that came from anywhere else are not reported. Only if you accept advertising cookies, OpenAI’s pixel also loads: it records the pages viewed and, after payment, the same order under the same code, and it stores the cookies listed on the Cookies page.

Google receives measurement data only after optional-cookie consent. The site's typefaces are served from terrenocheck.it; no request goes to Google for the text you are reading. Data may also be disclosed where a legal duty or competent authority requires it. TerrenoCheck does not sell personal data.

Before delivery an automated quality check reads the finished report: it is carried out by OpenAI and, if OpenAI does not answer, by Anthropic. They receive only the report PDF, the internal order number and the parcel data (cadastral reference, address entered, coordinates, language and chosen purpose): this is pseudonymised data, linked to you only through our order records. They never receive your email address, first name, surname, phone number, free-text customer note or payment details; the PDF does not contain your contact details. The only purpose is to check the report's quality before delivery. This processing takes place in the United States. The legal basis is performance of the contract (Article 6(1)(b) GDPR).

Each recipient receives only the data needed for its task. You may ask the controller for the current list of recipients, their activities and the data disclosed to each.

Transfers outside the EEA

OpenAI and, if OpenAI does not answer, xAI or Google process parcel data and report content in the United States to write the analysis. When the automated check before delivery is active, OpenAI and, if OpenAI does not answer, Anthropic also process parcel data and the finished report in the United States to check its quality. We do not send AI recipients the customer’s first name, surname, email address, phone number or payment details; the check also receives no free-text customer note. The legal basis for writing and checking the report is performance of the contract (Article 6(1)(b) GDPR). You may ask the controller for the current list of recipients and the data disclosed to each.

• Stripe, payments: Stripe LLC relies on the EU–US Data Privacy Framework for covered transfers to the United States. Its Data Transfers Addendum includes standard contractual clauses for other transfers to which they apply.
• Mapbox, maps and address search: Mapbox Inc. certifies compliance with the EU–US Data Privacy Framework for the generally available products and services we use.
• Google Analytics, measurement after optional-cookie consent: Google identifies the EU–US Data Privacy Framework for transfers to the United States and standard contractual clauses for other transfers to which they apply. This entry concerns website measurement only.
• AWS SES, email delivery: AWS data protection terms include standard contractual clauses for applicable transfers outside the EEA.
• OpenAI, measurement of ads on ChatGPT: receives in the United States only the click identifier, the order code, the amount and the order page described above, for purchases that came from one of its ads; with advertising-cookie consent, also the data its pixel collects in the browser, including the IP address.

Retention

The link and files remain available for 90 days from payment; then the files are deleted. Download and keep the PDF. The email address and operational delivery metadata are also deleted at the end of this period. Payment and accounting records remain for the period required by applicable law. Technical logs are kept only as long as security, diagnosis and dispute handling require.

To distinguish visits without saving an identifier in the browser, the server calculates a non-reversible code from the truncated IP address, user agent and browser language. The code joins page views made on the same day and changes each day at midnight UTC.

An early erasure request does not override a legal duty or the need to establish, exercise or defend a legal claim. When the purpose expires, data is erased or anonymised.

Cookies and browser storage

The site does not save a visit identifier in the browser. Language and cookie choices use necessary browser storage. Optional tags stay blocked unless you allow them. Refusing does not prevent reading the site or purchasing; change the choice from Cookie choices in the footer.

Automated and AI-assisted processing

The report uses automated processing and AI-assisted text about the parcel readings. The provider that writes it (OpenAI, or xAI or Google if OpenAI does not answer) may receive coordinates, the cadastral reference, source findings and an optional purpose note; it does not receive email or card details. TerrenoCheck does not make an automated decision about the buyer’s personal data that produces legal or similarly significant effects under GDPR Article 22. The report remains an information screen and does not replace a qualified professional.

Rights and how to exercise them

Where the GDPR provides, you may obtain confirmation and access, request rectification or erasure, restrict processing, receive supplied data in portable form and object to processing based on legitimate interests. You may withdraw consent to optional services at any time; withdrawal does not make earlier processing unlawful. The EDPB summarises data-subject rights.

To exercise them, email support@kandyb-studio.eu with the order email and, where available, the order code. Only information needed to verify identity will be requested. You may complain to the data-protection authority where you live or work; the controller’s Polish authority is UODO.