Records of Processing Activities (RoPA)
Last updated: 25 October 2026
Controller & representative
Controller: JL Apps LLC (United States (Washington, non-EU)); registered agent address (for legal mail): 100 N Howard St, Ste R, Spokane, WA 99201, United States. Contact privacy@zonavra.com. Art 27 EU representative: Data Protection Representative Limited (trading as DataRep) (datarequest@datarep.com). Supervisory authority: none leads — as a controller established outside the EU there is no one-stop-shop, so complaints go to the competent EU authority, for the pilot market the Autoriteit Persoonsgegevens (Dutch DPA).
Processing activities
| Activity | Purpose | Data categories | Subjects | Legal basis | Recipients | Retention | Transfers |
|---|---|---|---|---|---|---|---|
| Account & consumer onboarding | Create/operate accounts; record acceptance of the consumer terms | Email, terms version and acceptance time; company name / VAT number only for accounts that gave them at an earlier sign-up | Customers | Contract (6(1)(b)) | Clerk (auth), Neon (database); European Commission VIES only if a stored VAT number is re-entered (VAT number only) | Until the account is deleted (self-service, immediate cascade); no separate time-based deletion | US (SCCs where applicable); VAT check to the EU |
| Billing & tax | Take payment, issue invoices, remit VAT | Billing name, address, payment & invoice records; sign-in e-mail and account id sent by our servers to Paddle at checkout; cancellation and withdrawal requests (kind, time, subscription reference, the name given in a withdrawal statement, provider confirmation) | Customers | Contract (6(1)(b)); legal obligation (6(1)(c)) | Paddle (Merchant of Record / independent controller) | Invoices are held by Paddle under statutory accounting retention. Our minimised webhook log is kept for seven years for anti-replay/payment integrity; provider references are pseudonymous while linkable to an account | UK/EU |
| Service usage & storage | Saved parcels, projects, entitlement metering | Saved parcel refs and coordinates; project names, descriptions, pipeline status and free-text notes; usage counts; account id | Customers | Contract (6(1)(b)) | Neon (database), Vercel (hosting) | Until the account is deleted (cascades with the account row) | EU — functions pinned to Frankfurt (fra1); Neon project in an EU region |
| Security & abuse prevention | Rate limiting, logging, fraud/abuse prevention | IP address/request metadata in hosting logs; on the public site: HMAC fingerprint of the client network — the IPv4 address or the IPv6 /64, no user-agent (fixed key, so stable across days) — and daily anonymous-preview count in Neon; timestamps | All visitors | Legitimate interest (6(1)(f)) | Vercel (hosting), Neon (durable anonymous-preview counter) | Short-window rate-limit counters are discarded within minutes; anonymous-preview rows are keyed by UTC day and, where the production service uses a server database, deleted by a daily scheduled job once dated more than 31 days before the current UTC date (a missed run delays deletion); request logs follow Vercel's retention; deleted rows persist in Neon point-in-time recovery history for the provider's restore window | EU/US |
| Map & search delivery | Render the map and resolve address / parcel-ID searches | IP address and tile/feature requests (browser-to-provider); search terms and selected-parcel coordinates (via our servers) | All visitors | Legitimate interest (6(1)(f)) — delivering the requested map | Independent recipients: PDOK/Kadaster, 3D BAG, DSO-LV, European Commission VIES | Not stored in our database. Search text and coordinates travel in request URLs and can be recorded in hosting request logs, which follow Vercel's retention | EU/US (per provider's own terms) |
| Optional analytics | Aggregated product-usage insight (if enabled) | Pseudonymous usage events | Consenting visitors | Consent (6(1)(a)) | — none active today | Not applicable — no consent-based analytics is in use. Our servers do count a few page events (a landing or guide page view, the sample report or the plan dialog opened), each stored only as the event, a campaign label and the time — no identifier, no cookie and nothing stored on the device to count them | None — no consent-based analytics is in use |
| E-mail correspondence & preview requests | Answer e-mail; send one preview invitation to a person who asked for it; optional product updates only on request | E-mail address, any name given, message content and time, whether updates were requested | People who e-mail us | Legitimate interest (6(1)(f)); steps at the person's request (6(1)(b)); consent for updates (6(1)(a)) | Zoho Mail (mailbox) | Until answered, at most 12 months after the conversation; a preview or updates request until five years after the last e-mail sent on that basis; after "stop" only the address on a do-not-contact list | None — Zoho EU data centre |
Sub-processors & independent recipients
Sub-processors we instruct (Art 28): Vercel, Clerk, Neon, Resend, Zoho Mail, each under an Art 28 data-processing agreement that is in place. Paddle acts as Merchant of Record and is an independent controller of buyer payment data. Technical & organisational measures include TLS in transit, access controls, least-privilege secrets, and API rate limiting.
Independent recipients (not processors): service.pdok.nl, data.3dbag.nl, api.pdok.nl, service.pdok.nl, service.omgevingswet.overheid.nl, ec.europa.eu. Some map services are contacted directly by the visitor’s browser and receive the visitor IP; search, VAT and zoning services are called by our servers and receive only the relevant query. The Privacy Policy table identifies which path applies to each recipient — see the Privacy Policy §6.