Privacy Policy

Last updated: 25 October 2026

This policy explains what personal information urban:EXPORT (urban-export.ildar.space) collects, why, and the rights you have. The service is provided by Individual Entrepreneur Ildar Ildarkhanov (“we”), based in Georgia, who is the controller of your personal data; contact: [email protected]. One account is shared with our related tools on ildar.space (Planimetric, urban:SCAN, urban:STREET).

What we collect

• Without an account: a daily counter of free downloads, keyed by a one-way hash of your IP address and browser; it cannot be used to identify you. Anonymous totals (how many models were built or files downloaded per day) without any device or user identifier.
• With an account: your email address, credit balance, the IDs (coordinates and size) of areas you paid for, purchase IDs and amounts, promo codes you used, the date and version of the terms you accepted, and a sign-in session cookie (90 days).
• In your browser only: language, map position and similar preferences, and a cache of downloaded map data. They never leave your device.

We do not collect sensitive personal information, payment card details (Paddle handles them), or your location beyond the map area you choose.

Why we use it

• To provide the service and your account, credits and downloads (performance of a contract).
• To process payments and keep records required by tax law (legal obligation).
• To limit free use fairly, prevent abuse and keep the service secure (legitimate interests).
• To send sign-in links you request. We do not send marketing emails.
• The age and terms confirmation you give at sign-in is recorded as your consent.

Who processes data

• Cloudflare — hosting and database.
• Paddle — payments, as Merchant of Record; Paddle collects your payment details under its own privacy policy. We never see your card details.
• Resend — delivery of sign-in emails.
• Servers your browser requests directly while building a model: OpenStreetMap Overpass mirrors, Nominatim, OpenFreeMap (street map), national aerial imagery services (for example PDOK, IGN, swisstopo, German state survey offices, USGS), EOX (Sentinel-2), Mapterhorn, Overture Maps, and official 3D building services (PDOK in the Netherlands, swisstopo, Geobasis NRW, Project PLATEAU in Japan); font and script CDNs (Google Fonts, jsDelivr, cdnjs). Tree canopy heights (Meta / WRI) are loaded through our own server, which forwards only the requested data range. They see your IP address as with any website request.

How long we keep it

• Sign-in links: 20 minutes. Sessions: 90 days or until you sign out.
• Account data: until you ask us to delete it.
• Purchase records: as long as tax and accounting law requires, even after account deletion.
• Hashed free-download counters and anonymous totals: kept for statistics; they do not identify you.

Cookies

We use only strictly necessary cookies: ue_s keeps you signed in. There are no advertising, analytics or tracking cookies, so no cookie consent is needed. Preferences are kept in your browser’s local storage.

Children

The service is not directed to children. You must be 16 or older to create an account, and you confirm this when you sign in. We do not knowingly collect personal information from anyone under 16; if we learn that we have, we delete it. Parents or guardians can contact us at [email protected].

International transfers

We are based in Georgia. Our providers store and process data in the European Union, the United States and other countries. Where the law of your country requires it, transfers rely on an adequacy decision, the standard contractual clauses (with the UK addendum for UK data) in our providers’ data processing terms, or on the transfer being necessary to provide the service you asked for.

Your rights around the world

Wherever you live, you can find out what personal data we hold about you and get a copy in a portable format, correct it, delete it, object to or restrict its processing and withdraw your consent at any time — free of charge. We answer within 30 days (45 days where California law applies) and will not treat you differently for exercising your rights. If we decline a request, we explain why; you can appeal by replying to our answer and can always complain to a data protection authority. Depending on where you live:

• Georgia — Law on Personal Data Protection; authority: the Personal Data Protection Service of Georgia.
• European Union, EEA, United Kingdom, Switzerland — GDPR, UK GDPR and the Swiss FADP; you may complain to the supervisory authority where you live or work.
• United States — California (CCPA/CPRA) and the privacy laws of other states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others). In the past 12 months we collected identifiers (email address; a one-way hash of IP address and browser), commercial information (credits and purchases) and activity on our site (sessions, download counters), from you and, for payments, from Paddle, for the purposes above. We do not sell or share personal information, do not use it for targeted advertising or profiling, do not collect sensitive personal information and have no actual knowledge of selling or sharing data of consumers under 16; we honour Global Privacy Control signals. An authorised agent may act for you with your written permission.
• Brazil (LGPD), Canada (PIPEDA), Australia and New Zealand (Privacy Acts), Japan (APPI), South Korea (PIPA), India (DPDP Act), Singapore (PDPA), Türkiye (KVKK) and other countries — the rights your local law gives you, exercised the same way, with the right to complain to your local data protection authority.

Delete your account yourself with “Delete account” in your account on any of our sites — it removes the shared account everywhere, cancels active subscriptions immediately and erases saved streets and projects — or write to [email protected] from the email address of the account; we verify requests by that address and answer within 30 days (45 days for California residents). We will not treat you differently for exercising your rights.

Automated decisions

We do not make decisions with legal or similarly significant effects about you by automated means and do not profile you.

Security and data breaches

Data travels over HTTPS and access to the database is restricted. If a breach affects your personal data, we notify the competent authority and you where the law requires it (authorities within 72 hours under GDPR and the law of Georgia).

Changes

We may update this policy; the date above shows the latest version. If the changes are significant, we will ask for your consent again when you next sign in.

Service is provided by Individual Entrepreneur Ildar Ildarkhanov. Contact: [email protected]