Privacy Policy

1. Who we are & how to contact us

• Controller: JL Apps LLC (United States (Washington, non-EU)).
• Registered agent address (for legal mail): 100 N Howard St, Ste R, Spokane, WA 99201, United States.
• Privacy contact: privacy@zonavra.com.

2. EU representative (Article 27 GDPR)

We have appointed an EU representative under Article 27 GDPR. Individuals in the EU and supervisory authorities may contact the representative on all matters relating to our processing:

• EU representative: Data Protection Representative Limited (trading as DataRep)
• Address: DataRep, De Nieuwe Erven 3 Unit – 15162, 5431 NV Cuijk, Netherlands
• Email: datarequest@datarep.com

When you contact the representative, quote “Zonavra (JL Apps LLC)” so your request reaches us.

3. What we process, why, and our legal basis

We process the following categories of personal data:

• Account (sign-in email; the version of the terms you accepted and when) — to create and operate your account. No company or VAT number is needed. If you signed up earlier as a business, the company name and VAT number you gave then are kept on your account until you remove them (account page) or delete the account. Legal basis: performance of a contract (Art 6(1)(b)).
• Billing data (billing name, address, invoice records) — handled by Paddle as Merchant of Record. When you start a checkout, our servers send Paddle your sign-in e-mail address and our internal account identifier so Paddle can create your customer record; payment and billing-address details are entered directly in Paddle’s checkout, not on our pages. Legal basis: contract and legal obligation (tax/accounting).
• Cancellation and withdrawal requests (what you asked, when, the subscription reference, the name you give or confirm in a withdrawal statement, and what Paddle confirmed) — to carry out and evidence your request. Included in your data download; erased with your account, except that an unresolved withdrawal or refund is kept as a restricted case record until it is resolved (see section 8). Legal basis: contract and legal obligation (Art 6(1)(b), (c)).
• Usage & technical data (saved parcels and their map coordinates, projects — including their names, descriptions, pipeline status and any free-text notes you add — lookup counts, IP address, request metadata, security/rate-limit logs) — to provide features, meter entitlements, secure the Service and prevent abuse. Free-text fields are stored as you type them. Project notes are included in project CSV and GeoJSON exports and in your account data download; they are not included in PDF site reports. Legal basis: contract and legitimate interest (Art 6(1)(f)).
• E-mail you send us (your address, any name you give, what you write and when) — to answer you. If you e-mail us to ask for a preview, we keep that message as the record of your request, including whether you also asked for product updates. Legal basis: legitimate interest in answering (Art 6(1)(f)); for a preview request, taking the step you asked for (Art 6(1)(b)); for product updates, your consent (Art 6(1)(a)), which you withdraw by replying “stop”.
• Consent-based cookies (e.g. optional analytics) — only where you have opted in. Legal basis: consent (Art 6(1)(a)). See the Cookie Policy.

Parcel, building, zoning and constraint data shown in the app comes from open government registers and does not include property owner names or individual sale prices.

Zonavra is not intended for anyone under 13 (under 16 in the EU or the UK), and we do not knowingly collect their personal data.

4. Sources of data (Article 14)

Most personal data comes directly from you or is generated by your use of the Service. Open-data map layers are obtained from public government registers (see Attribution); these do not identify individuals in Zonavra.

5. Sub-processors we instruct

These providers process personal data on our instructions under Article 28 data-processing agreements — except Paddle, which acts as Merchant of Record and is an independent controller of buyer payment data. Services your browser contacts directly are a different category and are listed in section 6.

Paddle acts as Merchant of Record and is an independent controller of buyer payment data; its own privacy terms apply to that processing.

6. Independent recipients (map, search and VAT validation)

The map is assembled in your browser from open government and open map services, and further services are contacted by our servers on your behalf. Every provider below is an independent recipient, not our processor: we do not instruct them and they are not covered by our Article 28 agreements. Where the “Requested by” column says Your browser, that provider receives your IP address and the request itself (which map tile or feature, and when) on its own account and under its own terms; we send them no name, e-mail or account data. Where it says Our servers, the provider never sees your IP address — it receives only the query: the search term or parcel identifier you look up, or the map coordinates of the parcel you select, and — for the European Commission’s VIES validation service — the VAT number you enter.

When you sign in or check out, Clerk and Paddle also load their own code in your browser; both are listed in section 5 and act under the roles stated there. Clerk’s sign-up and sign-in forms also load Cloudflare Turnstile (challenges.cloudflare.com), a bot check, in your browser. Licences and credits for every dataset are on the Attribution page.

7. International transfers

Some providers are located outside the EEA, chiefly in the United States. The safeguard for each, as stated in the provider’s own data processing addendum: Vercel (hosting) — the EU Standard Contractual Clauses (2021, Module Two); Clerk (account sign-in) — the EU-U.S. Data Privacy Framework, with the Standard Contractual Clauses where the Framework cannot be relied on. For any other provider outside the EEA (for example Neon, our database host for account data, and Resend, our e-mail delivery provider in the United States, used for the withdrawal acknowledgement and the consent-copy e-mail), we rely on the Standard Contractual Clauses or an adequacy mechanism, as offered by that provider.

8. Retention

For personal invitations we store only a hash of the random link code and, until activation, a hash of the recipient email address. Unused links expire after 7 days. The daily retention job clears the recipient hash after expiry or revocation; redemption clears it immediately. A redeemed invitation is linked to your account while it exists. Account deletion removes that link and revokes unused invitations for your stored email address. The unlinked token hash and status are retained to prevent reuse of the same invitation. Your data export includes invitation status, never the secret link code.

E-mail you send us is kept for as long as we need it to answer you, and at most 12 months after the conversation ends. A preview request or a request for product updates is kept until five years after the last e-mail we send you on that basis, because we must be able to show that you asked; after a “stop” we keep only your address on a do-not-contact list.

We keep your account data for as long as your account exists. Deleting your account (see section 9) erases that record and, by database cascade, your saved parcels, projects, usage counters and report-credit ledger. Three things deliberately survive, and we would rather state why than leave it implied:

• Billing-event records are kept for seven years. They are how we guarantee a payment notification is processed exactly once, so discarding them could cause a duplicate charge or grant. They are minimised at the moment they are written: they contain no name, e-mail, address, VAT number or our account identifier. Paddle event, customer, subscription and transaction references remain; these are pseudonymous personal data while linkable to your account, are included in your data export, and lose their local link when the account row is erased.
• Invoices and payment records are held by Paddle as Merchant of Record, under its own statutory accounting-retention obligation. We hold no copy of them.
• Unresolved refund, withdrawal or dispute cases. If you delete your account while a withdrawal, refund, payment dispute, duplicate subscription or still-active subscription is unresolved, we keep a restricted case record so the matter can still be settled: its type, the Paddle subscription, customer, transaction or adjustment references, when it was received, any legal deadline, what Paddle reported, and our handling and resolution steps. It contains no name, e-mail address, parcels, projects or usage history, and it is no longer linked to an account; only our operators can see it. After the matter is resolved, the record is reviewed for deletion. The length of that review period has not been set yet; until it is, resolved records are not deleted automatically. Legal basis: contract and legal obligation (Art 6(1)(b), (c)).

Short-window request rate-limit counters exist in server memory and are discarded within minutes.

Free-lookup counts. To keep the free allowance (10 parcels a day) fair, our servers keep a daily count for your network: a pseudonym computed with a secret server key (HMAC) from your IPv4 address, or for IPv6 the first 64 bits — never the raw address and never your browser's user-agent — and, when you are signed in without a plan, a second count under a pseudonym of your account identifier. Everyone sharing one address or prefix shares one count. Rows are kept per UTC day and deleted by a daily job once they are more than 31 days old (normally within about 33 days); a missed run delays deletion. Legal basis: legitimate interest in preventing abuse of the free tier (Art 6(1)(f)).

Preview (test) deployments are access-restricted builds used to test changes before release; they are not the public site. Where such a deployment has accounts switched on, the count is stored in a server database by UTC day under an HMAC pseudonym computed with a server key from your network address only: the IPv4 address, or for IPv6 the network prefix (the first 64 bits). Your browser’s user-agent is not used, and raw IP addresses are not stored in that table. Because the key is not rotated automatically, the same network produces the same pseudonym on different days, and everyone sharing that address or prefix shares one count. Scheduled jobs run only on the production service, so these preview rows are not deleted automatically; they remain until deleted by hand.

The same daily job deletes billing-event records once they are more than seven years old.

Copies outside the live tables. Deleting a row removes it from the live database; it does not immediately remove copies in our database provider’s point-in-time recovery history or in hosting request logs, which follow those providers’ own retention periods. Address searches and map-point lookups are sent to our servers as part of the request address (the search text or the coordinates), so they can be recorded in those request logs together with your IP address.

WOZ data is currently unavailable, so Zonavra does not query Kadaster or retain a WOZ value.

9. Your rights

You have the right to access, rectification, erasure, restriction, portability, and objection, and to withdraw consent at any time. Three of these are self-service on the Account page: Download my data returns everything we hold about you as a structured JSON file (Articles 15 and 20), Delete my account erases it (Article 17), and the profile form covers rectification. You can also exercise any right by contacting our privacy contact (privacy@zonavra.com) or our EU representative; we respond within one month (Article 12(3)). You may also lodge a complaint with a supervisory authority. As we are established outside the EU, the one-stop-shop does not apply, so no single authority leads. You can complain to the authority in the EU country where you live or work or where the alleged infringement took place — in the Netherlands, the Autoriteit Persoonsgegevens (Dutch DPA).

10. Changes

We may update this policy; the “last updated” date reflects the current version.