Privacy Policy
As of 24.09.2026
1. Introduction
Welcome to 360-for-you.com (the "Website"). This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
The data controller responsible for this Website is:
360ForYou
Schumannstr. 8
40237 Düsseldorf, Germany
Sole proprietorship
Owner: Dmitry Rudenko
E-mail: info@360-for-you.com
Call center: +49302239952360 (German and English)
More information about the Website Owner: https://360-for-you.com/about-us
2. What data do we collect and why?
We collect and process the following categories of personal data:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address | Account management and notifications | Contract (Art. 6(1)(b)) | Until account deletion |
| Language, country, time zone, measurement units | Showing the service in your language, with dates in your time zone and values in your units | Contract (Art. 6(1)(b)) | Until account deletion |
| Telegram chat ID | Delivering notifications to Telegram instead of by email (optional) | Contract (Art. 6(1)(b)) | Until deleted by the user or upon account deletion |
| Email address entered by another user who invites you to a project or adds you to a user group | Giving you access to the shared projects; for a project invitation, an email about it if the inviting user chooses to send one | Legitimate interest (Art. 6(1)(f)) | Until account deletion |
| Password (hashed) | Authentication | Contract (Art. 6(1)(b)) | Until account deletion |
| Email verification status | Account security | Contract (Art. 6(1)(b)) | Until account deletion |
| Profile picture | Personalization | Consent (Art. 6(1)(a)) | Until deleted by the user or upon account deletion |
| Uploaded files (panoramas, point clouds, CAD, etc.) | Service provision | Contract (Art. 6(1)(b)) | Until project deletion or account deletion |
| Comments in projects | Collaboration | Contract (Art. 6(1)(b)) | Until deleted by the user or upon account deletion |
| Payment information (processed by Stripe) | Subscription management | Contract (Art. 6(1)(b)) | Until account deletion |
| Invoices and payment records (name, company, VAT ID, country, amounts; for bank transfers also the payer name and IBAN) | Accounting and tax obligations | Legal obligation (Art. 6(1)(c)) | Statutory retention periods (§ 257 HGB, § 147 AO), also after account deletion |
| Quotation requests (company, name, email address, postal address) | Preparing and sending the requested quotation | Pre-contractual measures (Art. 6(1)(b)) | Deleted after the quotation expires; if it leads to an order, statutory retention periods (§ 257 HGB, § 147 AO) |
| Name, email address, language | Tips and news about the service and a short survey after your first project | Legitimate interest (Art. 6(1)(f)) in conjunction with § 7(3) UWG | Until you unsubscribe or delete your account |
| Ad click ID (gclid) from the Google Ads link you arrived by | Measuring which of our ads lead to sign-ups and purchases; the ID is never passed to Google or anyone else | Legitimate interest (Art. 6(1)(f)) | In your account: until account deletion. Ad statistics (click ID, amount, date) remain afterwards, no longer linked to any account |
| IP addresses, server logs | Security, abuse prevention | Legitimate interest (Art. 6(1)(f)) | Deleted automatically on log rotation (by size or age) |
| Last login date | Account security | Legitimate interest (Art. 6(1)(f)) | Until account deletion |
| Consent timestamp | Proof of consent (GDPR compliance) | Legal obligation (Art. 6(1)(c)) | Until account deletion |
Emails we send
Service emails about your account and projects (for example, processing results, invitations, comment notifications, plan and payment notices, password and security messages) are part of the service and cannot be turned off. To stop receiving them, you can delete your account. You can receive most of them in Telegram instead of by email; see your profile.
A few times a year we also send tips and news about the service, and a short survey after your first project. You can object to these emails at any time in your profile or via the link included in each of them; no costs arise other than the transmission costs at basic rates.
Each automatic email we send states why you are receiving it.
3. How do we collect user data?
- Directly from you: When you register, create projects, upload files, or contact support.
- From other users: When a user invites you to a project or adds you to a user group, they enter your email address. If you are invited to a project and do not have an account yet, an account is created for this address so that you can accept the invitation. Users who add you to their project or group can see the name and email address of your account.
- From quotation requests: When a quotation is requested, we receive the company, name, email address and postal address entered for it.
- From authentication providers: If you sign in with Google or Microsoft, we receive your name, email address, and profile picture from the provider.
- Automatically: Our servers collect IP addresses and technical data in server logs for security purposes.
4. Third-party services and international data transfers
We use the following third-party services to operate the Website. Your data may be transferred to countries outside the European Economic Area (EEA). Where applicable, these transfers are protected by Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.
| Service | Purpose | Data transferred | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing | Email, payment details | Ireland |
| Google OAuth | Authentication | Email, name, profile picture | USA |
| Autodesk Model Derivative API | CAD file conversion (optional) | CAD files | USA |
| Google Street View Publish API | Publishing panoramas to Google Street View (optional, only at your request) | Panoramas and their location; access to the Google account you connect | USA |
| OpenStreetMap (OSMF) | Map tiles and geocoding (when georeferenced) | IP address | UK |
| OpenTopoMap | Topographic map tiles (when georeferenced) | IP address | Germany |
| Esri ArcGIS Online | Map tiles (when georeferenced) | IP address | USA |
| Microsoft Bing Maps | Map tiles (when georeferenced) | IP address | USA |
| OpenAI | AI Assistant | Chat messages | USA |
| OpenAI | Coordinate system detection | Coordinate system descriptions (no personal data) | USA |
| SMTP email provider | All notifications | Email address, name, payment details, project details, etc. | EU |
| Telegram (Telegram Messenger Inc.) | All notifications (optional) | Email address, name, payment details, project details, etc. | UAE (Dubai) |
We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use third-party analytics, advertising, or tracking services.
To suggest your country during sign-up, we estimate your country based on your IP address using a local copy of the MaxMind GeoLite2 database stored on our own servers. Your IP address is not transmitted to MaxMind or any other third party for this lookup. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
5. Cookies and tracking technologies
We use only essential first-party cookies required for login and session management. These cookies are strictly necessary for the functioning of our website. We do not use third-party cookies, tracking pixels, fingerprinting, or any other tracking technologies.
We honor Global Privacy Control (GPC) signals: when your browser sends one, we do not record the ad click ID. We neither sell nor share your personal data. Our machine-readable statement is published at /.well-known/gpc.json.
6. Data security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Passwords are hashed using an industry-standard algorithm (scrypt)
- Two-factor authentication (2FA) is available for all accounts
- CSRF protection on all forms
- Content Security Policy (CSP) headers
- Rate limiting on authentication endpoints
- All cookies are set with Secure, HttpOnly, and SameSite attributes
- All resources are self-hosted (no external CDN dependencies)
7. Your rights under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): you can export all your personal data from your profile page at any time.
- Right to rectification (Art. 16): you can update your name, password, and other profile information at any time.
- Right to erasure (Art. 17): you can delete your account from your profile page. All your personal data, uploaded files, comments, and associated records will be permanently and immediately deleted. The exception is invoices and payment records, which we are required by law to keep for the statutory retention periods (Art. 17(3)(b)).
- Right to data portability (Art. 20): you can export your data in machine-readable JSON format from your profile page.
- Right to restriction of processing (Art. 18): you have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while the accuracy of the data is disputed).
- Right to object (Art. 21): you have the right to object to processing based on legitimate interests (Art. 6(1)(f)), such as server log retention. We will stop such processing unless we have compelling legitimate grounds.
- Right to object to direct marketing (Art. 21(2)): you can unsubscribe from tips and news at any time in your profile or via the link in each such email. We then stop using your data for this purpose.
- Right to withdraw consent (Art. 7(3)): you can withdraw your consent at any time by deleting your account. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.
8. Data breach notification
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, if required, inform affected users without undue delay.
9. Contact information
If you have any questions or concerns regarding data protection, or wish to exercise any of your rights, please contact us:
- by email: support@360-for-you.com
- by phone: +49302239952360 (German and English)
10. Updates to this Privacy Policy
We may update this Privacy Policy from time to time. All changes will be published on this page, along with the date of the update. If we make significant changes that affect your rights, we will notify you via email or a notice on our Website. We encourage you to review this page periodically.