LEGAL
Privacy Policy
This policy explains what personal data RouteWasm processes when you visit our website, create an account, pay for a plan or use our hosted map and routing data, and what your rights are under the General Data Protection Regulation (GDPR). It is written to cover the information Article 13 GDPR requires.
The short version: route start points and destinations calculated with RouteWasm stay on the device and never reach us. We keep what we need to run your account, deliver tiles and meet our tax obligations, and nothing for advertising. There are no analytics or tracking cookies on our sites.
Who we are
The controller is Soti Space, a sole proprietorship trading as RouteWasm, registered with the Dutch Chamber of Commerce under KvK number 91247101, Groenlandselaan 1, 2612 JL Delft, the Netherlands, VAT NL004877863B51. Contact us about privacy at team@routewasm.dev. We are not required to appoint a data protection officer.
What we process, why, and for how long
- Account
- Your email address, a hash of your password (never the password itself), whether your address is verified, and when the account was created. Why: to give you an account and sign you in. Legal basis: performance of our contract with you (Article 6(1)(b)). Kept: until you delete the account.
- Project settings
- Your public project ID, a hash of your secret API key, the website addresses you allow, and your plan. Why: to issue hosted-data access to your apps. Basis: contract. Kept: for the life of the account.
- Billing details
- Business name, address, country and VAT number; the result and consultation number of the EU VIES check of that VAT number; the Stripe customer, payment and subscription references; and your paid-until date. Why: to charge the right price and VAT, issue invoices and manage renewals. Basis: contract, and our legal obligation to keep tax records (Article 6(1)(c)). Kept: seven years after the end of the year they relate to, as Dutch tax law requires (Article 52 of the General Tax Act, AWR).
- Invoices
- Invoice number and date, the plan and period, amounts, VAT rate and your billing details at the time. Basis: legal obligation. Kept: seven years, as above.
- Card and bank details
- Entered on Stripe’s payment pages and processed by Stripe Payments Europe, Ltd. under its own privacy statement. We never receive or store them.
- Usage records
- For each map or routing download from our servers: a request ID, your project ID, the time, the response status and the number of bytes delivered. These come from our CDN logs, which are configured to leave out IP addresses, cookies, authorisation headers and query strings. Why: to show your monthly usage, apply plan allowances and detect abuse. Basis: contract and our legitimate interest in preventing abuse (Article 6(1)(f)). Kept: request-level records only while needed to calculate and verify monthly totals, which are kept for the life of the account.
- Security logs
- When you use the account service: IP address, time, requested page and response status. Why: rate limiting, preventing abuse and fixing faults. Basis: legitimate interest in keeping the service secure. Kept: five days.
- Emails
- We send service emails only: the welcome email, password-reset links and invoices. No newsletters or marketing. If you write to us, we keep the correspondence as long as needed to deal with it and for any follow-up, and billing correspondence as part of our tax records. Basis: contract, or legitimate interest in answering you.
- Product updates
- If you ask for updates, your email address, when you confirmed and a random link token. Why: to send occasional emails about new features and releases. Legal basis: your consent (Article 6(1)(a)), given by clicking the confirmation link we email you; nothing is sent before that. Kept: until you unsubscribe, which every email lets you do with one click.
- Feature requests
- What you write in the request form and, if you add it, your email address so we can reply. Why: to plan what to build. Basis: our legitimate interest in improving the product. Kept: while the request is relevant to our roadmap; ask us to delete it at any time.
- Your app’s users
- When your app downloads map or routing data from us, our CDN (Cloudflare) necessarily sees the device’s IP address to deliver it; we do not receive or store those addresses. Route inputs are calculated on the device and are never sent to us. For this delivery we act as your processor, and we can sign a data processing agreement on request.
- Website visitors
- Our websites load no analytics or advertising. The only third-party script is Cloudflare Turnstile on the signup form, which checks browser signals to tell people from bots so nobody can sign up other people’s email addresses; it sets no tracking cookies. The demos on our pages store map and routing data in your browser’s own storage so they work offline; it stays on your device.
We do not sell personal data, use it for advertising, or make decisions about you by automated means, including profiling. Automatic database backups are made daily and kept on the server for three days; copies made before maintenance are deleted once they are no longer needed.
Who receives your data
- Scaleway SAS (France)
- Hosts our server and database in the EU. Processor.
- Cloudflare, Inc. (United States)
- Provides DNS, HTTPS proxying, the CDN that delivers map and routing data, file storage and delivery logs. Processor. Transfers to the US rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
- Proton AG (Switzerland)
- Sends our service emails and hosts our mailbox. Processor. Switzerland has an EU adequacy decision.
- Stripe Payments Europe, Ltd. (Ireland)
- Processes payments as an independent controller and receives your email address, the amount and the payment description from us.
- Cloudflare Turnstile
- Runs the bot check on the signup form. Processor, covered by the Cloudflare terms above.
- European Commission (VIES)
- Receives the VAT number you enter, so we can confirm it is registered.
- Authorities and advisers
- The Dutch Tax Administration and other authorities when the law requires it, and an accountant or legal adviser bound to confidentiality when we need one.
Cookies and browser storage
We use one cookie: pb_auth, which keeps you signed in to your account for up to seven days. It is strictly necessary, so it needs no consent. The quickstart and demo apps store a random installation ID in your browser’s local storage, which is used to sign hosted-data sessions and is not stored on our side, and they cache map and routing data in browser storage. You can clear all of it in your browser settings at any time.
Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive the data you gave us in a portable format. Where processing relies on our legitimate interests, you can object at any time. Some data, such as invoices, must be kept for the legal retention period even if you ask us to delete it; we then keep only what the law requires.
You can delete your account yourself under Delete account on your account page; it removes your account, project, keys and billing details at once and cancels any subscription. For the other rights, email team@routewasm.dev from the address on your account. We answer within one month. If you are not satisfied, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live or work.
Security
All traffic uses HTTPS. Passwords and secret API keys are stored only as hashes. The database administration interface is not reachable from the internet. Access to the server is limited to its operator.
Changes
If we change this policy in a way that matters to you, we will email account holders before the change takes effect. Earlier versions are available on request.