Privacy Policy

Who is the controller

The data controller is the seller below. They decide why and how your personal data is processed for this service.

What personal data we process

• Your email address, used for checkout status, report delivery, receipts and support.
• The parcel location you submit: coordinates, address text, the point on the map and any cadastral (KAEK) reference.
• Payment metadata from Stripe, such as payment status, checkout session ID, amount, currency and the LandCheck job ID. We do not receive full card numbers or CVC codes.
• Technical logs needed to run the service, investigate errors, prevent abuse and keep it available.

Why we process it and our legal bases

• To perform our contract with you: creating the report, taking payment, sending the private link, the receipt and status emails, and handling support for that purchase.
• To meet a legal obligation: keeping payment and accounting records required by tax and accounting law.
• For our legitimate interests: fraud and abuse prevention, security logging, debugging and service reliability.
• As part of the contract and our record-keeping, we log the confirmations you actively give at checkout: acceptance of these terms and the privacy notice, and the digital-content acknowledgement. This is evidence that the contract was formed and that you asked us to start straight away, not a separate consent to data processing.

Who we share it with

We use a small set of processors to run the service: Stripe for payments, Postmark for delivery and receipt emails, Hetzner for EU hosting, Mapbox for the map tiles you see, and OpenAI for the AI-assisted narrative in the report (see “Automated and AI-assisted processing”). If you allow optional analytics and advertising cookies, Google also processes website measurement data. We do not sell your personal data.

International transfers

We keep data in the EU where we can, including hosting with Hetzner in Germany. Some providers may process limited data in the United States: Stripe for payments, Postmark for email, Mapbox for map tiles, OpenAI for the report narrative and, only after optional cookie consent, Google for measurement. Those transfers rely on the safeguards the GDPR allows. The providers use the EU-US Data Privacy Framework where applicable and the European Commission's standard contractual clauses as an additional safeguard.

We keep a register of these sub-processors, their role, location and transfer safeguard, and update it before adding a new one. You can request the current register using the contact below.

How long we keep it

Reports and the email address tied to them are automatically deleted after 90 days. Payment and accounting records may be kept longer where the law requires it.

Cookies and local storage

LandCheck stores essential choices in your browser, including language and cookie preferences. If analytics or advertising measurement is configured, Google tags remain blocked until you choose “Allow optional cookies”. You can refuse without losing access to the site or checkout, and you can change the choice from “Cookie choices” in the footer. Stripe Checkout uses its own necessary payment and fraud-prevention technology.

Automated and AI-assisted processing

Your report is produced by automated processing, including an AI-assisted English narrative of the public map and dataset layers for the location you submit. We use OpenAI's API for this. It receives the parcel location and cadastral (KAEK) reference, the report's own findings, and anything you type in the optional purpose note, but never your email address, name or payment details. OpenAI acts as our processor under its data-processing agreement, does not use API data to train its models, and this analysis is informational only: it does not make a decision that produces legal effects about you. Please do not include personal details about yourself or others in the optional note.

Your rights

You can ask for access, rectification, erasure, portability, restriction, or object to processing, and you can withdraw any consent at any time. To view or delete the data tied to a specific report, use the "See or delete my data" link on your private report page. You can also email us using the contact below with enough detail to identify your purchase.

You have the right to complain to a data protection supervisory authority in your country of residence. In Poland this is the President of the Personal Data Protection Office (UODO); in Greece it is the Hellenic Data Protection Authority (HDPA).

Contact

Email us at support@kandyb-studio.eu.