Privacy Policy

1. Who is responsible

VanPlot is operated by Vladimir Šterjoski, an individual based in the Republic of Serbia (“we”, “us”). Paid licenses are sold through Polar Software Inc. as merchant of record. We are the data controller for personal data processed through vanplot.com. Contact: support@vanplot.com.

2. What we collect

Account data: your email address and a hashed password, so you can sign in — or, if you choose Sign in with Google, the email address and name Google shares with us (legal basis: performance of a contract).

Your projects: van layouts, settings, custom components, and files you upload (models, textures) — stored so the product works (contract).

Purchase data: if you buy a paid plan, checkout is handled by Polar, our merchant of record, which acts as an independent controller for payment data. We receive your order status and license details, never your full card number (contract / legitimate interest).

Trial metering: to run the free trial fairly we record the active editing time on your account and a random per-browser identifier, used only to prevent abuse of the trial across multiple accounts on one device (legitimate interest). It is not used for advertising or shared with anyone. Trial minutes you earn by sharing a plan are recorded per account together with a one-way hash of the visitors who opened your link, used only to count each visitor once.

AI component generation: when you use Create with AI, the description you type is sent to Anthropic (Claude API) to generate the part's geometry; under our API terms it is not used to train their models. Each account has a daily generation quota (contract).

Support and feedback: whatever you send us when you write in or submit feedback from inside the app, delivered to us by email (legitimate interest).

Emails: we send account emails — sign-in links and your purchase confirmation (contract). After you sign up we also send a short series of emails about getting started with VanPlot and about the license, and a reminder when your trial ends; after a purchase, a short note with tips; and, at most once a month and only when something shipped, a short summary of what's new in VanPlot (legitimate interest). Every one of these includes a one-click unsubscribe link, and unsubscribing stops them for good without affecting account emails. We record which of these emails went to your account so nobody gets the same one twice. Emails are sent through Resend, our email provider.

Calls with the founder: you can book an optional video call through Cal.com, which receives your name, email address, and your answers to the booking questions (legitimate interest — you asked for the call). If you agree, both in the booking form and again out loud at the start of the call, the call is recorded and transcribed with Fathom (US) so no notes have to be taken during it. We use the recording and transcript only for product research — to understand how people plan their vans and improve VanPlot. The legal basis is your consent, which you can withdraw at any time, including during the call; saying no never affects anything else. Recordings are deleted within 30 days, transcripts within 12 months. We keep written, anonymised notes of the call with no name or email address. To have a recording, transcript, or notes deleted sooner, email support@vanplot.com.

Product usage & diagnostics: we use PostHog (EU-hosted) to understand how the product is used and to fix problems — feature-usage events tied to your account ID, error reports, page performance, and session replays of how the interface is used. Replays mask everything you type (passwords, emails, all form inputs are never recorded), and none of this is used for advertising or shared beyond PostHog acting as our processor (legitimate interest — you can object, see Your rights). When you create an account we also store the referrer or campaign of your first visit with it, so we know which channels bring builders to VanPlot. We also keep a short summary of each editing session in our own database — how long you edited, how many items you added, moved or deleted, and which exports you used — tied to your account and readable only by you and us, so we can see where the editor loses people; it never contains the layout itself.

Technical logs: our hosting providers keep short-lived request logs (IP, user agent) for security and abuse prevention (legitimate interest). We currently run no advertising trackers.

3. Cookies

We use strictly necessary cookies only: your login session and your interface preferences (like theme). No advertising or cross-site tracking cookies. If you arrive through a creator's link (?ref=), a first-party cookie remembers that code for 60 days so the creator's discount applies at checkout — it identifies the link, not you. Product analytics and session replay (PostHog, EU-hosted) run in cookieless mode — nothing is stored on your device and you are not tracked across sites; we use them to count visits, understand which features are used, and watch masked replays of how the interface behaves so we can fix what's broken.

4. Who processes it

We use a small set of processors to run the Service: Supabase (database, authentication, file storage), Cloudflare (hosting, delivery and DNS; also routes mail sent to our support address), PostHog (product analytics, error diagnostics, and masked session replay; EU-hosted, cookieless — see Cookies), Resend (email), Cal.com (scheduling calls with the founder), Fathom (call recording and transcription — only if you agree to be recorded), Anthropic (AI component generation — receives only the description you type), Google (only if you sign in with Google, and Google Meet for video calls with the founder) and Polar (payments, as merchant of record — an independent controller for the payment itself). Data may be processed in the EU and the US; transfers rely on EU Standard Contractual Clauses through these providers.

We do not sell personal data, and we don't share it beyond these providers except when the law requires it.

5. Retention

Account and project data are kept while your account exists and deleted within 30 days of account deletion. Purchase records are retained as long as tax law requires. Call recordings are deleted within 30 days and call transcripts within 12 months; anonymised call notes without your name or email are kept. Server logs rotate automatically on short cycles.

6. Your rights

You can request access, correction, deletion, export (portability), or restriction of your personal data, and object to processing based on legitimate interest — email support@vanplot.com and we'll act on it within 30 days. You can also complain to your local data protection authority; in Serbia that is the Poverenik (Commissioner for Information of Public Importance and Personal Data Protection).

7. Security & children

Data is encrypted in transit, access is restricted through row-level security, and passwords are stored hashed. No system is perfectly secure, but we keep the attack surface deliberately small. The Service is not directed at children under 16.

8. Changes

If this policy changes materially we'll announce it on the site or by email. The effective date above always reflects the current version.