Privacy policy
Last updated: 2026-10-22
This policy explains, under Art. 13 and 14 GDPR and the Austrian Data Protection Act (DSG), which personal data Place Check processes. Place Check is a private, non-commercial project; because it is publicly available and offers accounts, the GDPR applies in full. This is a translation; the German version prevails.
1. Controller
place-check, Leopoldsdorf, e-mail: kontakt@place-check.com. No data protection officer is appointed (not required under Art. 37 GDPR).
2. Data we process
| Category | Data | Retention |
|---|---|---|
| Account | e-mail address, name (optional), profile picture from a sign-in provider, e-mail verification status, created/updated times | until the account is deleted |
| Password | only as a salted scrypt hash, never in plain text | until the account or the password is deleted |
| Linked sign-in providers | Google / Microsoft / GitHub: account id at the provider and the tokens it returns | until the account is deleted |
| Sessions | session token, IP address and browser identifier (user agent) at sign-in | 30 days from the last renewal; immediately on sign-out or account deletion |
| Sign-in links and confirmations | magic links (hash only), e-mail confirmation and password reset tokens | 10 minutes to 24 hours |
| Sign-up abuse protection | keyed hash (HMAC) of the IP address per e-mail + password sign-up | 24 hours |
| Rate limiting | IP address and auth path with a counter (sign-in endpoints); for the address search only a hash of the IP | the limit window (minutes to 1 day); see section 6 |
| Free credit per mailbox | SHA-256 hash of the normalised e-mail address and the grant date (table signup_grants) | kept after account deletion, see section 6 |
| Reports | the address or coordinates you enter, language, optional property details (e.g. HWB, areas, purchase price, year built, basement/well/sewer) and the report result | until the account is deleted (full reports) |
| Anonymous reports | only a generalised place (Gemeinde level, offset circle) and rounded values; no address, no inputs | indefinitely, also after account deletion (not linked to a person) |
| Credits | ledger entries (free, promo and admin credits, usage, refunds) with report id | until the account is deleted |
| API keys | name, SHA-256 hash of the key, prefix and last 4 characters, created and last used | until revoked or the account is deleted |
| Connected apps (OAuth/MCP) | client registration of the app (e.g. Claude, ChatGPT), your consent, access tokens (hash, 15 minutes) and refresh tokens (30 days) | until disconnected in the dashboard or the account is deleted |
| Server logs | technical logs of the host (time, URL, status code, IP address, user agent); the application itself does not log addresses, e-mail addresses or IP addresses | per the host's settings, see section 6 |
We process no special categories of personal data and make no automated decisions within the meaning of Art. 22 GDPR.
3. Purposes and legal bases
- Providing the service (account, sign-in, reports, credits, API keys, connected apps): Art. 6(1)(b) GDPR (use under the terms).
- Security and abuse prevention (rate limits, sign-up limit per IP, one free credit per mailbox, server logs): Art. 6(1)(f) GDPR; the legitimate interest is running a free service securely and without abuse.
- Legal obligations (e.g. requests from authorities, records of data subject requests): Art. 6(1)(c) GDPR.
- Language cookie: Art. 6(1)(f) GDPR and § 165(3) TKG 2021 (a function requested by the user).
4. Cookies
Place Check uses strictly necessary cookies only. There is no tracking and no analytics, advertising or social media service, hence no cookie banner.
| Cookie | Purpose | Duration |
|---|---|---|
| lb_lang | chosen language (en/de) | 1 year |
| lb_pending | report request before sign-in (address, coordinates, language, anonymous yes/no, property details), AES-256-GCM encrypted, httpOnly; deleted once the report is created or you sign out | 1 hour, 24 hours while an e-mail confirmation is pending |
| lb_seen | remembers that this browser had a session (the login page then shows "Sign in" instead of "Create account") | 1 year |
| __Secure-better-auth.session_token and related better-auth.* cookies | sign-in session, OAuth state during sign-in | session up to 30 days; state cookies a few minutes |
5. Recipients and processors
- Vercel Inc. (USA): application hosting, functions in Frankfurt (fra1); delivery via a global edge network. Processor under Art. 28 GDPR.
- Neon (Databricks, Inc., USA): database in AWS eu-central-1 (Frankfurt). Processor.
- Resend (Plus Five Five, Inc., USA): sending confirmation, sign-in and password e-mails (e-mail address, message content). Processor.
- Google (Google Ireland Ltd. / Google LLC), Microsoft (Microsoft Ireland Operations Ltd.), GitHub (GitHub, Inc., USA): only if you sign in with them; the provider learns that you sign in to Place Check and sends us your e-mail, name and profile picture. The provider is an independent controller for this.
- AI applications you connect yourself (e.g. Claude by Anthropic, ChatGPT by OpenAI): receive the reports you fetch through the MCP tools. Their privacy policies apply to processing in those applications.
Transfers to the USA: Vercel, Neon/Databricks, Resend, Google, Microsoft and GitHub rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where certified, and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in their data processing agreements. [TO VERIFY: current DPF certification per provider at dataprivacyframework.gov]
We do not sell data or share it for advertising.
6. Retention
Retention per category is listed in section 2. In addition:
- Free credit: the hash in signup_grants is kept after account deletion so that a new account with the same mailbox gets no second free credit (legitimate interest: abuse prevention). Without the e-mail address the hash does not identify you and contains no other data. Retention: [TO DECIDE, proposal: 3 years from the grant].
- Rate limiting of the sign-in endpoints: entries are overwritten on the next request but currently not deleted automatically. [TO DECIDE, proposal: delete after 24 hours].
- Host server logs: [TO VERIFY, depending on the Vercel plan, typically 1 hour to 30 days].
- Full reports of an existing account: currently until account deletion. [TO DECIDE, proposal: delete accounts and reports after 24 months of inactivity, with prior notice by e-mail].
- The data source cache (24 hours) holds results per rounded coordinate only, not linked to any person.
7. Queries to data sources
To build a report the server queries public data services. Only coordinates or a map extent are sent (for the address search, the search text), never your name, e-mail address or property details. Categories: federal and state geodata and map services (e.g. BEV, state GIS services, data.gv.at, RIS), GeoSphere Austria, Statistik Austria, Umweltbundesamt, Bundesdenkmalamt, RTR (Netztest), European Environment Agency (EEA) and EU JRC (PVGIS), address search via Photon (komoot) and Nominatim (OpenStreetMap), OpenStreetMap vector tiles (OpenFreeMap, VersaTiles) and Overpass, Transitous journey planning. Details: data sources.
The report map loads map tiles and layers directly from your browser, in particular from basemap.at (mapsneu.wien.gv.at) and federal and state geodata services. Those servers receive your IP address and the map extent shown, as with any web page request.
8. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Write to kontakt@place-check.com.
Deleting your account: in the dashboard under "Delete account" (type DELETE). This deletes the account, sessions, linked sign-in providers, password hash, API keys, connected apps, credit ledger and all full reports. Anonymous reports are kept without an owner. Also kept: the hash in signup_grants and, for at most 24 hours, the IP hash of the sign-up limit.
Complaints: you can complain to the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.
9. Security
Transport only via TLS (HTTPS); passwords, API keys, magic links and OAuth tokens stored only as hashes; encrypted request cookie; database in the EU; access to production systems by the operator only.
10. Contact and changes
Privacy questions: kontakt@place-check.com. We update this policy when the service changes; the version published here applies.