Privacy statement

What happens to your address

When you enter an address, it goes to our server once. The server looks the address up at PDOK and the matching parcel at the Kadaster, and puts the parcel number and the address into the link of your design. Our server does not keep your address: there is no database and no account.

From then on that link is the only thing that opens your design, and it carries your address in readable form. Anyone who has the link can read your address out of it and view your parcel. Your drawing itself lives only in your browser and is not in the link.

Every time you open the design, your browser requests that link from our server. Our hosting provider Cloudflare keeps a log line for 1 percent of all requests, with the page address in it, so sometimes the link with your address. Cloudflare keeps those log lines for 3 days on the free plan and 7 days on a paid plan.

The legal basis for this lookup is that it is necessary to deliver the service you asked for, Article 6(1)(b) GDPR. Whether that is the right basis for a free service without accounts is a question we are putting to a lawyer.

What we measure, and under which consent

If you allow analytics, we measure two kinds of thing. First, six events we built in ourselves: that you open the home page, that you enter an address, that your parcel loaded, that loading failed, that you change something in your design, and that you export. Each of those carries a few technical attributes, such as how many buildings are in view, why loading failed, or which export format you chose.

Second, PostHog itself records which pages you view and when you leave a page. It does not record clicks or form submissions: that is switched off. So the text of the button you click, and the structure of the page, do not travel with it.

Your address, your postcode and the link to your design never travel with it. That link contains your address, so it is made unrecognisable before an event leaves your browser. The same happens to the page title, because in the design tool the title is your address.

Processing happens at PostHog in the EU. PostHog does not store your IP address with the event. It does derive an approximate location from it before discarding it, and stores that with every event: your city, the digits of your postal code and a coordinate with an uncertainty radius. That is a setting in our PostHog project. For crash reports we receive without your consent, this is not done with your IP address.

If you have given no consent and we are sending only a crash report, PostHog derives a code from your IP address, your browser characteristics, the site name and a secret daily value, so that separate reports from the same day belong together. The daily value changes every day and is deleted afterwards, so today's code is a different one tomorrow. That code is not stored on your device and we cannot attach a name or email address to it ourselves. Whether this approach requires consent under Dutch cookie rules is a question we are putting to a lawyer before launch.

What a session recording shows

If you allow session recordings, we record your screen as video: your mouse movements, your clicks, the design drawing itself, and whatever the app writes to the browser console. That includes your parcel outline, and the shape of your house and garden.

In the drawing and in the bar at the top, your address is masked. Your parcel outline is not, because that is the drawing. This is why it is a separate choice: a recording shows far more than a count.

We watch recordings back to find where the tool goes wrong. Session recordings only work together with analytics: switch analytics off and recordings stop too.

The legal basis for each purpose

For analytics and session recordings the basis is your consent, Article 6(1)(a) GDPR. Withhold it and neither happens, and you can withdraw it at any time.

For the crash reports we receive even without consent, the basis is our legitimate interest, Article 6(1)(f): without those reports we cannot find and repair a fault. The balancing test that goes with it is written down and will be put to a lawyer before launch.

Your drawing sits on your own device and we receive nothing from it, so we do not process that data. Your address we do receive, once, for the lookup described above. Your drawing may be written to your device without asking because it is the service you asked for: it is the drawing you are working on at that moment.

What happens if you refuse

If you choose “Necessary only”, we do not measure your visit. No PostHog cookie is set, you get no number we could recognise you by, and no recording is made. Your browser does fetch two script files from PostHog (eu-assets.i.posthog.com) on every visit, before you choose anything: the settings of our PostHog project, and the component that can report a crash. PostHog sees your IP address and your browser characteristics (the User-Agent line) when that happens, as any server does of a browser fetching from it; no event is sent at that moment and nothing is written to your device. Without the second file we cannot receive a crash report, not even from someone who refuses analytics; the first fetches the settings that decide what may and may not be measured. That is why we count them as necessary to make the site work.

One thing does continue: if the app crashes, we receive that crash report. It contains the error itself, the place in the code where it went wrong, the page you were on, and technical characteristics of your browser: the type and version of your browser and operating system, your screen size, your language and your time zone. The link to your design and the page title both contain your address; both are made unrecognisable before the report is sent. No cookie travels with it, but PostHog does derive the daily code described under ‘What we measure’. If something goes wrong on our server, we send a crash report from there too; it contains the page (made unrecognisable) and nothing about your browser or your IP address. We do this because otherwise we cannot find and repair a fault, and we rely on our legitimate interest in keeping the app working.

If you would rather send no crash reports either, email privacy@tuinontwerp.app. There is no separate switch for this in the app at the moment. You can stop the reports from your browser yourself by blocking traffic to eu.i.posthog.com; that does not stop the reports sent from our server.

How long it is kept

PostHog keeps session recordings for 30 days. Events and crash reports are kept for 1 year, with the approximate location attached to them. Cloudflare's log lines are described above under ‘What happens to your address’.

These are the retention periods of the free plan we use today. If we move to a different plan, we update this text.

What sits on your own device

Your designs sit in your own browser, not with us. They hold your address and your parcel outline. There is no copy on our servers and we cannot reach it.

What exactly is stored, how long it stays, and how to clear it is in the cookie policy.

The waiting list

The home page has a sign-up form for the waiting list. That form is an embedded page from Tally, a Belgian company. It loads on every visit to the home page, whether or not you fill it in, and Tally sees your IP address when it does. Inside that frame Tally also loads its own measurement scripts: at our last check the form page set a Mixpanel cookie and connected to Sentry in the United States. That sits outside our cookie notice; it is an open point before launch.

If you fill in the form, we receive through Tally your email address, your first name if you enter it, and three hidden fields describing where your visit came from: the campaign source, the referring site and the page you arrived on. We use that to email you when the app is available, and afterwards to send you a short questionnaire about your garden plans.

The legal basis is your consent: you submit the form yourself. You can leave the list at any time by emailing privacy@tuinontwerp.app; we then remove your details from it. How long we keep the list if you do not opt out has not been set yet; it will be added before launch.

Your rights and complaints

You have the right of access, rectification, erasure, restriction, portability and objection. Something particular applies here: we hold no account for you and no copy of your design, so there is nothing at our end tied to your name or email address. The events we measure hang off a random number in your own browser, not off your name or your email address. Clear the PostHog cookie and we can no longer connect them to you.

If you would still like to make a request, or withdraw your consent, email privacy@tuinontwerp.app. The quickest way to withdraw consent is the Cookie settings control at the bottom of every page.

If you disagree with how we handle your data, you can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (opens in a new tab).

What this statement does not cover yet

This statement is not complete yet. Before public launch it will gain the registered company details of the data controller, and the sections on accounts and paid features once those exist.

The app has no accounts, no sign-in and no payments today.

The parties that process data on our behalf are listed on the subprocessors page.