Privacy Policy

AirScan Kft.
Registered office: 8420 Zirc, Kossuth Lajos utca 35.
VAT number: HU26519041
E-mail: info@mappertool.com
Website: www.mappertool.com

The purpose of this Privacy Policy is to describe how MapperTool (hereinafter: Service Provider) processes users’ personal and technical data on the www.mappertool.com website and in connection with the related services (SaaS data processing).

All data processing complies with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and the relevant Hungarian legislation.

Name: AirScan Kft.
Registered office: 8420 Zirc, Kossuth Lajos utca 35.
E-mail: info@mappertool.com

The MapperTool service is operated by AirScan Kft.

For account, billing, technical and analytics data, AirScan Kft. acts as data controller.

For the content uploaded by the user (drone imagery, point clouds and other input data) and for the outputs generated from it, the user is the data controller and AirScan Kft. acts as a data processor under Article 28 GDPR, processing this content solely to provide the service and on the user’s instructions. For business (B2B) users a separate Data Processing Agreement is available and applies to this content.

Uploaded drone imagery may contain personal data relating to third parties (for example identifiable persons, vehicles, or property). The user is responsible for ensuring a lawful basis for uploading and processing such data and warrants that the necessary legal conditions are met.

• Operating the MapperTool system, managing user accounts, subscriptions and ensuring automatic data processing.
• Lawful provision of services and invoicing.
• Monitoring technical faults and security events.
• User experience and performance analysis (Hotjar, Google Analytics).
• Communication, customer service and handling incident reports.

5.1. Registration and account data:

• Full name
• E-mail address
• Phone number (optional)
• Billing details (company name, tax number, address, country)
• Subscription tier and status (Free, Basic, Pro)
• Unique user identifier (automatically generated)

Legal basis: GDPR Article 6(1)(b): performance of a contract

5.2. Technical data:

• IP address
• Browser type and version
• Operating system details
• Device identifier, screen resolution
• Website activity (pages, clicks, visit timestamps)
• Cookies and behavioural analytics data (Hotjar, Google Analytics)

Legal basis: for essential technical and security processing, GDPR Article 6(1)(f): legitimate interest (system security, service operation).
For non-essential analytics and behavioural data (Hotjar, Google Analytics), GDPR Article 6(1)(a): consent. These tools may process personal data such as IP addresses and online identifiers in pseudonymised form; they are activated only after the user’s consent.

5.3. Uploaded and processed content:

• Uploaded raw data (drone images, photogrammetric imagery, point clouds)
• Project metadata (project name, location)
• Processed results (orthophoto, DTM, DSM, 3D point cloud, NDVI and thermal orthophoto) and measurement data

Legal basis: GDPR Article 6(1)(b): performance of a contract. Where this content contains personal data, AirScan Kft. processes it as a processor on behalf of the user (see Section 3).

5.4. Financial data:

• Payment transaction data (Stripe)
• Order/subscription ID, amount paid, currency
• Billing information

Legal basis: GDPR Article 6(1)(c): legal obligation (invoicing, tax compliance)

• User account data: for the duration of registration. Upon account deletion, all data are permanently deleted.
• Uploaded raw drone images where processing has been started: deleted automatically and irreversibly 24 hours after the project is completed (this window allows reprocessing of the same input within 24 hours).
• Uploaded raw drone images where processing has not been started: deleted automatically after 30 days from upload.
• Processed outputs and projects: available for a period that depends on the subscription tier, shown by a per-project countdown. When the period expires, the entire project and all its data are deleted.
• Billing data: retained for 8 years in accordance with accounting regulations.
• Technical log data: stored for 1 year for security purposes.

The following data processors are used by MapperTool:

• Stripe, Inc. / Stripe Payments Europe, Ltd., payment processing (EU / USA data storage)
• Google Firebase (Google Ireland Ltd.), user authentication, database (Ireland)
• Google Analytics / Search Console, traffic and performance analytics (Ireland)
• Hotjar Ltd., user behaviour analytics (Malta / EU)
• Cloudflare, Inc. (R2 Storage), file storage, CDN, protection (EU / USA)

Beyond the above, the Service Provider does not transfer data to third parties.

For any transfer of personal data to the USA, compliance is ensured through the EU Standard Contractual Clauses (SCC) and, where the recipient is certified, the EU-US Data Privacy Framework (DPF), together with appropriate supplementary safeguards.

MapperTool uses cookies for operation, analytics and preferences. Analytics and behavioural cookies are activated only after the user’s consent. Details are set out in the separate Cookie Policy.

All data are stored within the territory of the European Union (Cloudflare R2, Google Firebase). Backups are also created in EU data centres. For data transferred to the USA (Stripe, Cloudflare), the SCC / DPF mechanisms ensure compliance for data transfers.

The processing of uploaded data is automated, but the Service Provider does not carry out automated decision-making, including profiling, that produces legal effects concerning the user or similarly significantly affects the user.

The user (data subject) may exercise the following rights:

• Right of access: to request information at any time about the data processed.
• Right to rectification: to request correction or modification of data.
• Right to erasure (“right to be forgotten”): to request permanent deletion of data at any time.
• Right to restriction of processing.
• Data portability: to request data in a machine-readable format.
• Right to object: to object to processing based on legitimate interest.
• Withdrawal of consent: consent given for analytics or marketing may be withdrawn at any time.

Requests may be sent by the user to info@mappertool.com.

MapperTool implements all necessary technical and organisational measures to ensure data security:

• encrypted data transmission (HTTPS),
• secure password hashing,
• regular backups,
• restricted access to servers,
• logging and access control.

Users may at any time request:

• deletion of the entire account,
• permanent removal of specific projects.

Deletion is final and data cannot be restored. Uploaded raw files are also irreversibly deleted from the Cloudflare R2 system in accordance with the retention rules in Section 6.

If the user believes that MapperTool has violated their data protection rights, they may contact the Hungarian supervisory authority below. A user resident in another EU Member State may also lodge a complaint with the supervisory authority of their own country.

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 (1) 391-1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu

The Service Provider is not required to designate a Data Protection Officer and has not designated one. Data protection enquiries may be sent to info@mappertool.com.

MapperTool reserves the right to amend this notice if required by legal or technical changes. In the event of a change, the updated policy will be published on the website for users’ information.