Privacy notice
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) · effective from 3 November 2026
This is an English translation for convenience. The Czech version is legally binding.
1. Controller
The controller is David Broza, a natural person living in the Netherlands, who runs Podklad as a non-commercial test project. Contact for anything about personal data: david@podklad.com. We have no data protection officer (not required).
2. What data, why and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account, sign-in by e-mail link or passkey, credits | e-mail, registration and verification date, credit balance and grants, language, passkey public key, signed-in devices (browser type) | contract, Art. 6(1)(b) | while the account exists; sessions 30 days, sign-in link 30 minutes, registration link 24 hours |
| Reports, town hall watches, sharing and invitations | address and parcel numbers you enter, notes, listing links, alert e-mail, e-mails of people you share with | contract, Art. 6(1)(b); for invitees' e-mails legitimate interest in delivering the invitation, (f) | until you delete the report or account |
| Feedback, credit requests, interest form | e-mail, message, what you fill in | legitimate interest in replying and improving the service, (f) | max. 24 months after the last contact |
| News by e-mail (only with the box ticked) | e-mail, time and source of consent | consent, (a), and § 7 of Czech Act No. 480/2004 | until consent is withdrawn |
| Security and abuse prevention | IP address (only for Turnstile verification and, one-way hashed, for rate limiting), technical logs | legitimate interest in security, (f) | hash for hours to days, technical logs short term |
| Visit statistics | page visited, referrer domain and UTM, country, device type — no IP, e-mail or cookies | legitimate interest in measuring and improving the site, (f) | aggregated, max. 24 months |
| E-mail outreach (e.g. estate agencies, municipalities) | work e-mail and name from a public source (company or municipal website) | legitimate interest in introducing the project, (f) | until objection, otherwise max. 12 months |
We process no payment data: nothing is paid for and credits cannot be bought. We do not sell data or use it for advertising or profiling. There is no automated decision-making with legal effects.
3. Property data and third parties
Reports work with data about property, not people. From the cadastre we take parcel numbers, areas and land types; owners' names are not shown or stored in reports. For town hall monitoring we read public notice boards; documents are kept to compare changes, and names of private persons are hidden on public pages. If you appear in such documents and object to our processing, write to us (objection under Art. 21 GDPR).
4. Who processes data for us (processors)
- Cloudflare, Inc. (USA) — hosting and database, Turnstile protection, anonymous Web Analytics, AI Gateway.
- xAI (USA, via Cloudflare AI Gateway) — AI reads the text and photos of pasted listings and property facts to write report texts. Your e-mail is not sent to it.
- Resend (USA) — sending sign-in and service e-mails.
- Mapbox, Inc. (USA) — base maps and the 3D map; your browser connects to Mapbox directly (IP address, an anonymous device identifier for map usage statistics).
- Verbatim (verbatimux.com) — the offer of a voluntary usability test. The script loads from their server; it records a session (clicks, screen recording with masked inputs) only if you join a test yourself.
For 3D buildings your browser may also query public OpenStreetMap Overpass servers (Germany and other EU countries) — only a map extent is sent, nothing about you. Other public sources (ČÚZK, CENIA, ČGS, Open-Meteo and others) are queried from our server with coordinates or a parcel only.
5. Transfers outside the EU
Processors based in the USA process data under the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) where certified, and otherwise under the Commission's standard contractual clauses (Art. 46 GDPR). We will send you a copy or details of the safeguards on request.
6. Cookies and local storage
We only use what the site needs to work, so we do not ask for cookie consent. We use no advertising or tracking cookies.
- pk_session — sign-in (httpOnly cookie, 30 days), strictly necessary.
- pk_lang — chosen site language (cookie, 1 year), set at your request.
- Browser local storage — appearance (light/dark), a report in progress and map caches, hiding the test offer, the source of your first visit (this session only) and a technical identifier of the Mapbox library.
Cloudflare Web Analytics uses no cookies or device identifiers. You can delete cookies and storage in your browser settings at any time; deleting pk_session signs you out.
7. E-mail outreach and news
We send news only to people who agreed when registering. Work e-mails inviting businesses or municipalities to try the project are sent rarely, once, to addresses published for work contact, always with a way to opt out. Every e-mail contains a contact to refuse further messages; we respect that immediately and keep the address only on a “do not contact” list.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability, the right to object to processing based on legitimate interest and to withdraw consent at any time (without affecting earlier processing). Write to david@podklad.com; we reply within one month. To verify you we may ask for a message from your account e-mail.
Deleting your account: there is no self-service button yet. Send a deletion request from your account e-mail; we delete the account, reports, watches and shares within 30 days and confirm it. You can delete individual reports yourself in your account.
You may also complain to a supervisory authority: in Czechia the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or the authority of the country where you live or work (in the Netherlands the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
9. Security and changes
Connections are encrypted (HTTPS), we use no passwords, rate-limit IP addresses are stored only hashed and only the administrator can access the database. We may update this notice; the effective date is at the top and registered users are told about material changes. The terms of the service are in the terms of service.