This Privacy Policy explains how personal data is processed when you use osm2cdr.com, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR).
1. Controller
Ivan Saroka (Osm2cdr)
Sole proprietorship registered in Poland (CEIDG)
NIP 5372700110 · REGON 546025224
ul. Mikołaja Kopernika 20/39, 21-500 Biała Podlaska, Poland
E-mail: support@osm2cdr.com
For any privacy question or request, write to support@osm2cdr.com.
2. What We Collect
- Account data: your e-mail address and, if you sign in with a third-party account (Google or GitHub), the identifier and e-mail address that provider passes to us.
- Orders: the map area you select, the format and options, the files produced and the order history.
- Payments: amount, currency, date, status and the payment reference. Card payments are handled by Stripe; your card details go directly to Stripe and we do not receive or store them.
- Technical data: IP address, browser type, pages requested, error logs.
- Cookies and local storage: see section 8.
- Messages: what you write to us by e-mail or through the contact form.
Your e-mail address is needed to create an account and to deliver paid exports; without it we cannot provide those services. Browsing the site and the free demo files do not require an account.
3. Purposes and Legal Bases
- Providing the service — account, exports, wallet, delivery and support: performance of a contract, Art. 6(1)(b) GDPR.
- Accounting and tax records for payments: legal obligation, Art. 6(1)(c) GDPR.
- Security, fraud prevention, troubleshooting and defending legal claims: our legitimate interest, Art. 6(1)(f) GDPR.
- Optional analytics cookies and newsletters: your consent, Art. 6(1)(a) GDPR. You can withdraw consent at any time; this does not affect processing carried out before.
We do not sell personal data and do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Who Receives the Data
We share data only with service providers who process it on our behalf under a data processing agreement, and only as far as needed:
- Stripe, Inc. — card payments, and Link by Stripe — one-click checkout, only if you choose it; card details go straight to Stripe, we do not receive or store them;
- OVH SAS (France) — hosting: servers in Strasbourg, France (EU) that run the site and store the files;
- Yandex LLC (Yandex 360 mail, Russian Federation) — delivery of order confirmations and service e-mails; receives your e-mail address and the message text;
- Google LLC (Google Analytics 4) — web analytics, only after you accept analytics cookies;
- Anthropic, PBC (United States) — AI assistant that helps our staff review support requests and complaints and assess custom map orders; receives the text of your request and the order parameters, never your card data;
- ip-api.com — IP geolocation: your IP address is looked up to find your country and approximate city, to centre the map and to offer the sign-in and payment options available in your country; the result is cached on our servers for up to 30 days;
- Telegram — notifications to our staff: for a paid order, your e-mail address and name, what you bought, your country and how you found the site; for a message to support, only which fields you filled in, not their content;
- sign-in providers (Google, GitHub) — only if you choose that sign-in method.
We may also disclose data to public authorities where the law requires it.
5. Transfers Outside the EEA
Some providers process data outside the European Economic Area, for example in the United States. Where the destination country has no adequacy decision of the European Commission, the transfer relies on the Commission's Standard Contractual Clauses or another safeguard under Chapter V GDPR. Service e-mails (order confirmations, sign-in links, replies to your requests) are sent through Yandex 360; this means your e-mail address and the text of the message are transferred to Yandex LLC in the Russian Federation. No other data is transferred there. You can ask us for a copy of the relevant safeguards.
6. How Long We Keep Data
- Account and order data: for as long as your account exists; deleted after you close the account, except as stated below.
- Payment and accounting records: five years from the end of the calendar year in which the tax payment deadline expired, as required by Polish tax law.
- Generated files: for the download period shown in your account, then deleted.
- Technical logs: for a short period only, unless needed longer to investigate a specific security incident.
- Support messages: as long as needed to handle the request and any follow-up claims.
7. Your Rights
Under the GDPR you have the right to:
- access your data and receive a copy;
- rectify inaccurate data;
- erasure («right to be forgotten»);
- restrict processing;
- data portability;
- object to processing based on our legitimate interest;
- withdraw consent at any time.
Send requests to support@osm2cdr.com. We reply within 2 business days; requests under the GDPR are completed within one month at the latest. We may ask you to confirm that the request comes from the account owner.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw. You may also complain to the authority in your own EU country.
8. Cookies and Local Storage
- Strictly necessary (no consent required):
lang— your language; the sign-in session after you sign in;osm2cdr_cookie_consent_v2(local storage) — your cookie choice;osm_bc_until(local storage) — a mark that your browser passed the automated bot check (security, no personal data), and the security cookiesbcandhpof that check;mapStyle(local storage) — your map background choice (first party, no personal data, not shared with anyone). ab_user_key(365 days) — first-party browser identifier: the key of your guest purchase and wallet balance, also used to keep you in the same variant of our own site experiments; not shared with anyone.- Analytics (consent required): Google Analytics 4. It is not loaded until you click «Accept» in the cookie banner. You can change your choice at any time with the «Cookie preferences» link in the site footer.
9. Children
The service is not directed at children under 16, and we do not knowingly collect their data.
10. Changes
We will publish any update to this policy on this page and inform account holders by e-mail about material changes.
Effective: 2026-11-04