Privacy Policy

1. Who is responsible

VanPlot is operated by Vladimir Šterjoski, sole proprietor (preduzetnik), Republic of Serbia (“we”, “us”). We are the data controller for personal data processed through vanplot.com. Contact: support@vanplot.com.

2. What we collect

Account data: your email address and a hashed password, so you can sign in (legal basis: performance of a contract).

Your projects: van layouts, settings, custom components, and files you upload (models, textures) — stored so the product works (contract).

Purchase data: if you buy a paid plan, checkout is handled by our merchant of record (named on the checkout page), which acts as an independent controller for payment data. We receive your order status and license details, never your full card number (contract / legitimate interest).

Trial metering: to run the free trial fairly we record the active editing time on your account and a random per-browser identifier, used only to prevent abuse of the trial across multiple accounts on one device (legitimate interest). It is not used for advertising or shared with anyone.

Support email: whatever you send us when you write in (legitimate interest).

Technical logs: our hosting providers keep short-lived request logs (IP, user agent) for security and abuse prevention (legitimate interest). We currently run no advertising trackers.

3. Cookies

We use strictly necessary cookies only: your login session and your interface preferences (like theme). No advertising or cross-site tracking cookies. Product analytics (PostHog, EU-hosted) runs in cookieless mode — it stores nothing on your device and does not track you across sites; we use it to count visits and understand which features are used.

4. Who processes it

We use a small set of processors to run the Service: Supabase (database, authentication, file storage), Vercel (hosting and delivery), PostHog (privacy-focused product analytics, EU-hosted, cookieless — see Cookies) and our merchant of record (payments, named at checkout). Data may be processed in the EU and the US; transfers rely on EU Standard Contractual Clauses through these providers.

We do not sell personal data, and we don't share it beyond these providers except when the law requires it.

5. Retention

Account and project data are kept while your account exists and deleted within 30 days of account deletion. Purchase records are retained as long as tax law requires. Server logs rotate automatically on short cycles.

6. Your rights

You can request access, correction, deletion, export (portability), or restriction of your personal data, and object to processing based on legitimate interest — email support@vanplot.com and we'll act on it within 30 days. You can also complain to your local data protection authority; in Serbia that is the Poverenik (Commissioner for Information of Public Importance and Personal Data Protection).

7. Security & children

Data is encrypted in transit, access is restricted through row-level security, and passwords are stored hashed. No system is perfectly secure, but we keep the attack surface deliberately small. The Service is not directed at children under 16.

8. Changes

If this policy changes materially we'll announce it on the site or by email. The effective date above always reflects the current version.