Privacy policy

The controller under Art. 4(7) GDPR is Constantin Koblmiller, Ramperstorffergasse 43, 1050 Wien, Austria. For anything about your data, write to hello@sitesup.eu. Full details are in the Impressum.

No account, no sign-up, no analytics, no advertising and no tracking cookies. The website is static. The studio talks to our own server (api.sitesup.eu, located in Vienna) and to the services listed below. The personal data involved is what those requests carry (IP address, browser details) and, for paid exports, the email address you give at checkout.

The site is served by Cloudflare Pages (Cloudflare, Inc., USA). Every request reaches Cloudflare with your IP address and browser details. Legal basis: our legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR). Cloudflare processes this data under a data processing agreement and the EU–US Data Privacy Framework.

The studio sends its requests to api.sitesup.eu, our own server in Vienna, Austria. It is reached through a Cloudflare Tunnel, so Cloudflare sees these requests too. The server handles:

• A guest access token with a random ID, issued when the studio first opens and valid for 30 days. There is no name or account behind it.
• Your IP address, to count free exports and guest tokens per day and to prevent abuse. It is stored only as a keyed hash, and guest-token records are deleted after one day.
• The export itself: the location and size of your area, the chosen sources and settings. Job records and files are deleted 24 hours after a free or unpaid export finishes, and 7 days after a paid one.
• Server logs with method, path and status of each request (download tokens are blanked).

Legal basis: performing the service you asked for (Art. 6(1)(b)) and our legitimate interest in security and abuse prevention (Art. 6(1)(f)). To fetch the source data, the server contacts the data publishers; only the area is sent, nothing about you.

The studio uses Cloudflare Turnstile (Cloudflare, Inc.) to keep scripts away from the free tier. It runs when the studio fetches its guest token and before each export or checkout. The widget is invisible, so this is where we tell you about it. It reads browser and device signals to tell people from bots; our server sends the result and your IP address to Cloudflare to verify it. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). See the Turnstile privacy policy.

Paid exports are sold through Link (Sold through Link, LLC, a Stripe company, USA), which is the merchant of record: it takes the payment on a checkout page hosted by Stripe, works out and collects VAT, and sends you the receipt and invoice. To work out the VAT, checkout asks for your name and billing address. We never see card details. Link and Stripe process your payment data under their own privacy policy and are independent controllers for it. We receive the payment status and the email address you entered; your name and billing address are visible to us in the Stripe dashboard, and we use them only for bookkeeping and support. Refunds of failed or cancelled paid exports also go through Stripe. Legal basis: performing the contract (Art. 6(1)(b)) and, for bookkeeping, a legal obligation (Art. 6(1)(c); we keep invoices and receipts for 7 years under Austrian tax law).

When a paid export finishes, we email its download link (or, if it failed, a note about the refund) to the checkout address through Amazon SES in the Frankfurt region (eu-central-1). One email per purchase, no marketing. The address is kept with the job record and deleted with it after 7 days. Replies and bounces arrive at our mailbox. Legal basis: performing the contract (Art. 6(1)(b)). Amazon Web Services EMEA SARL is our processor under a data processing agreement.

For a free export from a slow source, the studio offers to email the link too. Giving an address is optional; it is used only for that one email (or a note if the export failed), the same way and kept just as long as above. Legal basis: your request (Art. 6(1)(b)).

The search box sends what you type, plus the current map centre to rank nearby places first, from your browser to Mapbox Geocoding (Mapbox, Inc., USA). If Mapbox is unavailable, the search falls back to Photon (photon.komoot.io, komoot GmbH, Germany; OpenStreetMap data). These providers see your IP address and your search text. Legal basis: performing the service you asked for (Art. 6(1)(b)).

Map images, satellite imagery and labels load from your browser directly from Mapbox (api.mapbox.com). If Mapbox is not available, the studio falls back to VersaTiles (tiles.versatiles.org). These providers see your IP address and which map tiles you load. The map style, fonts and icons are served by SiteSup itself. Legal basis: performing the service you asked for (Art. 6(1)(b)).

SiteSup sets no cookies. The studio stores in localStorage the access token (sitesup_invite_token) and when it expires (sitesup_token_expires_at), so that a returning visitor keeps their free-export count and can follow a running export. While a payment is under way, it keeps the export you are paying for in sessionStorage (sitesup_checkout), removed when the tab closes. This storage is strictly necessary for the service you asked for (§ 165(3) TKG 2021). Website fonts are served by SiteSup, not loaded from Google.

If you write to us, we use your email address and message only to answer you and keep them as long as needed to deal with your request and any follow-up questions, and as long as the law requires. Legal basis: performing the contract or our legitimate interest in answering you (Art. 6(1)(b), (f)).

Cloudflare, Inc., Mapbox, Inc. and Sold through Link, LLC are US companies, and Amazon and Stripe have US parents. Where personal data goes to the USA, we rely on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) where the provider is certified, and otherwise on the EU standard contractual clauses (Art. 46 GDPR). Our own server and Amazon SES run in the EU.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). To use them, write to hello@sitesup.eu. Because there is no account, we can only find your data if you tell us the email address or access token it relates to.

You can complain to the Austrian data protection authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at).