Who is responsible
The controller of your personal data is Alexey Gvozditskiy, trading as Running Cat Development, a sole proprietorship registered in Poland (CEIDG), NIP 6342994917, REGON 388765800, Katowice, Poland. Write to hello@runningcat.dev about anything in this policy.
What we keep, why and for how long
| What | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Account: your name or company name, and your email | To run your account, sign you in and write to you about your plan and our terms | Contract, art. 6(1)(b) | While the account exists |
| Sign-in: a fingerprint (hash) of each one-time sign-in link and of your session | To sign you in | Contract, art. 6(1)(b) | A session ends 30 days after you last use it; link records go 400 days after the link expires |
| Sign-in with Google or with a password: your email, your Google account number or a hash of your password, and when you signed in, kept by Google in Firebase Authentication | To sign you in | Contract, art. 6(1)(b) | While the account exists |
| API keys: a hash of each key, its first characters, its label, and when it was created, last used and revoked | To check requests and show you your keys | Contract, art. 6(1)(b) | While the account exists |
| Usage: requests per minute for each endpoint with their status and response time; requests per day for each key and endpoint | To apply your plan's limits, show you your statistics and keep the service running | Contract, art. 6(1)(b); our legitimate interest in running the service, art. 6(1)(f) | Per-minute records 90 days; daily totals 400 days |
| Where your requests point: the 0.1° square (about 11 km across) each request is about, counted per day | To show you the map in your account and to decide which regions to load into our database | Legitimate interest, art. 6(1)(f) | 90 days for your map; 400 days for regional demand counts |
| Billing, received from Paddle: customer and subscription numbers, plan, status, billing period, next payment date, your payments and invoice numbers | To run your paid plan and keep accounting records | Contract, art. 6(1)(b); legal obligation, art. 6(1)(c) | As long as Polish tax and accounting law requires |
| Emails you send us | To answer you | Contract, art. 6(1)(b), or legitimate interest, art. 6(1)(f) | As long as we need them to deal with your request |
| Technical logs: account name, endpoint, status and time of API requests; slow database queries with their parameters, without the account; web server errors, which can include an IP address | To find and fix faults and to protect the service from abuse | Legitimate interest, art. 6(1)(f) | Logs are capped in size, so older lines are overwritten as new ones arrive |
Visits to this website, only if you allow analytics: pages viewed, a random visitor number in the _ga cookies, device and browser, and an approximate location derived from your IP address | To see how the website is used and make it better | Consent, art. 6(1)(a), which you can withdraw at any time | Kept by Google for at most 14 months |
Payment card and bank details go to Paddle only; we never see them.
We see the IP address of every connection, as any web server does. Apart from the error logs above, we do not store it: the account pages hold it in memory for an hour to limit how many sign-in links one address can ask for.
What your requests contain
Requests carry coordinates, routes, areas, tags and search text. We use them to answer and do not store them, apart from the 0.1° square in your usage records and the slow-query logs described above.
If your requests contain personal data of your own users, such as a person's location, you decide what to send and you are the controller of that data. We process it only to answer your requests. If you need a data processing agreement, write to us.
Who else receives data
- Paddle (Paddle.com Market Limited, United Kingdom) sells our paid plans as Merchant of Record. It handles checkout, payments, invoices and refunds as a controller in its own right, under Paddle's privacy notice.
- Contabo GmbH (Germany) hosts our servers, where all the data above is stored.
- Google hosts our email (Gmail), so messages you send us and the ones we send you pass through it. Google also runs Firebase Authentication, which signs you in with Google or a password, and Google Analytics, which counts visits to this website if you allow it.
- Some pages load files from other services, and your browser then connects to them directly, so they see your IP address and browser details: Cloudflare's cdnjs serves the map libraries on the home page and the account page; the OpenStreetMap Foundation's tile servers serve the background map on the account page; Paddle's own script loads when you open checkout; Google's servers serve the sign-in script on the account page.
- Public authorities, when the law requires us to hand data over.
We do not sell personal data and use no advertising services. Analytics runs only if you allow it.
Data outside the European Economic Area
Paddle and the OpenStreetMap Foundation are in the United Kingdom, which the European Commission recognises as protecting personal data adequately. Google and Cloudflare are in the United States and certified under the EU–US Data Privacy Framework, which the Commission also recognises.
Cookies
We set one cookie, geo_session, when you sign in to your account. It keeps you signed in, is sent only to the account pages, and expires 30 days after your last visit. The account pages do not work without it, so we do not ask for consent. Google Analytics sets its _ga cookies only after you allow analytics on the banner; until then nothing from it loads. You can change your choice at any time with “Cookie settings” at the bottom of every page. We set no other cookies.
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to restrict how we use it, or to receive it in a machine-readable format. You can object to uses based on our legitimate interest. Write to hello@runningcat.dev from the email of your account; we answer within one month.
When we close your account, we delete your account details, keys and sessions. Usage records, logs and billing records then expire on the schedule in the table above.
You can complain to the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority in the country where you live or work.
Other things you should know
An email address is needed to open an account; without it we cannot sign you in. We make no decisions about you by automated means alone.
All traffic uses HTTPS. We store API keys, sign-in links and sessions only as hashes, so a copy of our database would not let anyone use them. Only we have access to the servers.
The service is not meant for anyone under 18. If we change this policy, we update the date at the top, and we email account holders before a change that affects them.