Privacy Policy
Your data at NavLayers
Short version: the editor runs on your device and your maps are not uploaded. We keep what an account needs (your email, a hashed password, your plan and how many clips you used), Stripe handles payments, and there is no tracking, no advertising and no analytics.
Effective [effective_date: set it in config.php]
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
[owner: set it in config.php]
[address: set it in config.php]
Email: [email: set it in config.php]
2. The editor and your maps
The editor runs entirely in your browser. Your projects, the map and the videos you export are made on your device and are not sent to us. To keep your work between visits, the editor stores your current project, your choice of light or dark mode and whether you have seen the guide in your browser's local storage. This stays on your device; you can clear it at any time in your browser's settings. Storing it is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG).
The map data, place names and fonts are loaded from our own server. We do not load anything from other companies' servers (no Google Fonts, no content delivery networks, no analytics and no advertising).
3. Visiting the website (server log files)
When you open a page, your browser sends technical data to our server: IP address, date and time, the page requested, the referring page, and your browser and operating system. The server needs this to deliver the pages and keeps it in log files to keep the service secure and find faults. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Log files are deleted by our host after a short period, usually within 30 days, unless a security incident has to be investigated.
Our host is Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, which processes this data on our behalf under a data processing agreement (Art. 28 GDPR).
4. Your account
To export clips you need an account. We store your email address, your password (only as a salted hash, never in readable form), your plan, your extra clips, the date you joined, and for each export: when it happened, the format, the size and the frame rate. We need this to provide your plan and count your clips. Legal basis: Art. 6(1)(b) GDPR (performing our contract with you). We keep it until you delete your account, which you can do at any time on your account page; it is then deleted at once.
Sign-in cookie. When you sign in, we set one cookie (nl_auth) with a random code that keeps you signed in for up to 30 days. It is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). We set no other cookies.
Security. To protect sign-in and the forms from abuse, we count requests per IP address for a short time (at most a day).
5. Payments (Stripe)
Pro and extra clips are paid through Stripe. When you pay, you enter your payment details directly on Stripe's checkout page; we never see your card or account numbers. Stripe tells us that a payment or subscription succeeded and gives us a customer and subscription number, which we store with your account. Recipient: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe may also process data in the United States; Stripe, LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Stripe also processes data under its own responsibility, for example to prevent fraud and meet legal duties: stripe.com/privacy.
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal duties). Invoices and payment records are kept for as long as tax and commercial law require (in Germany up to 10 years, § 147 AO, § 257 HGB).
6. Contact form and email
When you write to us, by email or through the contact form, we use your name, email address and message to answer you. Legal basis: Art. 6(1)(b) GDPR where it concerns a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering you). We delete messages when the matter is settled, unless we must keep them by law.
We also send you emails the service needs, such as password reset links and confirmations. We do not send newsletters or advertising.
7. Cancellations
If you cancel through Cancel contracts here, we store your name, email address, the details you entered and the time we received it, and send you a confirmation. Legal basis: Art. 6(1)(b) and (c) GDPR (§ 312k BGB). We keep this record for three years after the end of the year of the cancellation, as proof (§§ 195, 199 BGB).
8. Who receives data
Only the service providers named above (hosting and email: Hostinger; payments: Stripe), and authorities where the law requires it. We do not sell personal data.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to [email: set it in config.php]. You can also complain to a data protection supervisory authority, in particular the one where you live or work, or where we are based.
10. No automated decisions
We do not make decisions about you based solely on automated processing, and we do not build profiles.
11. Changes
We update this policy when the service or the law changes. The current version is always on this page.