Privacy Policy
As of 27.10.2026
1. Introduction
Welcome to 360-for-you.com (the "Website"). This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
The data controller responsible for this Website is:
360ForYou
Schumannstr. 8
40237 Düsseldorf, Germany
Sole proprietorship
Owner: Dmitry Rudenko
E-mail: info@360-for-you.com
Call center: +49302239952360 (German and English)
More information about the Website Owner: https://360-for-you.com/about-us
2. What data do we collect and why?
We collect and process the following categories of personal data:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email address | Account management and notifications | Contract (Art. 6(1)(b)) | Until account deletion |
| Language, country, time zone, measurement units | Showing the service in your language, with dates in your time zone and values in your units | Contract (Art. 6(1)(b)) | Until account deletion |
| Telegram chat ID | Delivering notifications to Telegram instead of by email (optional) | Contract (Art. 6(1)(b)) | Until deleted by the user or upon account deletion |
| Email address of the Google account you connect for Street View | Publishing panoramas to Google Street View (optional, only at your request) | Contract (Art. 6(1)(b)) | Until deleted by the user or upon account deletion |
| Email address entered by another user who invites you to a project or adds you to a user group | Giving you access to the shared projects; for a project invitation, an email about it if the inviting user chooses to send one | Legitimate interest (Art. 6(1)(f)) | Until account deletion |
| Password (hashed) | Authentication | Contract (Art. 6(1)(b)) | Until account deletion |
| Email verification status | Account security | Contract (Art. 6(1)(b)) | Until account deletion |
| Profile picture | Personalization | Consent (Art. 6(1)(a)) | Until deleted or replaced by the user, or upon account deletion |
| Uploaded files (panoramas, point clouds, CAD, etc.) | Service provision | Contract (Art. 6(1)(b)) | Until project deletion or account deletion |
| Comments in projects | Collaboration | Contract (Art. 6(1)(b)) | Until deleted by the user or upon account deletion |
| Payment information (processed by Stripe) | Subscription management | Contract (Art. 6(1)(b)) | Until account deletion |
| Invoices and payment records (name, company, VAT ID, country, amounts; for bank transfers also the payer name and IBAN) | Accounting and tax obligations; also passed to our tax advisor | Legal obligation (Art. 6(1)(c)) | Statutory retention periods (§ 257 HGB, § 147 AO), also after account deletion |
| Token use (account ID, email address, number of tokens, date) | Accounting of prepaid tokens | Legal obligation (Art. 6(1)(c)) | Statutory retention periods (§ 257 HGB, § 147 AO), also after account deletion |
| Quotation requests (company, name, email address, postal address) | Preparing and sending the requested quotation | Pre-contractual measures (Art. 6(1)(b)) | Deleted after the quotation expires; if it leads to an order, statutory retention periods (§ 257 HGB, § 147 AO) |
| Name, email address, language | Tips and news about the service and a short survey after your first project | Legitimate interest (Art. 6(1)(f)) in conjunction with § 7(3) UWG | Until you unsubscribe or delete your account |
| Ad click ID (gclid) from the Google Ads link you arrived by | Measuring which of our ads lead to sign-ups and purchases; the ID is never passed to Google or anyone else | Legitimate interest (Art. 6(1)(f)) | In your account: until account deletion. Ad statistics (click ID, amount, date) remain afterwards, no longer linked to any account |
| IP addresses, server logs | Security, abuse prevention and visitor statistics | Legitimate interest (Art. 6(1)(f)) | Application logs: deleted after 30 days at the latest; the processing log of a project is deleted with the project. Other server logs (web server, containers, operating system): rotated automatically according to the server's settings. |
| Last login date | Account security | Legitimate interest (Art. 6(1)(f)) | Until account deletion |
| Consent timestamp | Proof of consent (GDPR compliance) | Legal obligation (Art. 6(1)(c)) | Until account deletion |
| Details entered for the data processing agreement (company, address, contact person, email address, data protection officer) | Concluding the data processing agreement (Art. 28 GDPR) and keeping it as proof | Legal obligation (Art. 6(1)(c)) | Until account deletion |
Emails we send
Service emails about your account and projects (for example, processing results, invitations, comment notifications, plan and payment notices, password and security messages) are part of the service and cannot be turned off. To stop receiving them, you can delete your account. You can receive most of them in Telegram instead of by email; see your profile.
A few times a year we also send tips and news about the service, and a short survey after your first project. You can object to these emails at any time in your profile or via the link included in each of them; no costs arise other than the transmission costs at basic rates.
Each automatic email we send states why you are receiving it.
3. How do we collect user data?
- Directly from you: When you register, create projects, upload files, or contact support.
- From other users: When a user invites you to a project or adds you to a user group, they enter your email address. If you are invited to a project and do not have an account yet, an account is created for this address so that you can accept the invitation. Users who add you to their project or group can see the name and email address of your account. When you comment in a project, your name is shown next to your comment to everyone who can open the project (for a public project, any visitor), unless the project owner hides comment authors.
- From quotation requests: When a quotation is requested, we receive the company, name, email address and postal address entered for it.
- From Stripe: When you pay, we receive from Stripe what you entered at checkout, such as your email address, name or company name, billing address and VAT ID, the payment method you used (for a card, its brand and last four digits), and your invoices as PDF files.
- From authentication providers: If you sign in with Google or Microsoft, we receive your name, email address, and profile picture from the provider.
- Automatically: Our servers collect IP addresses and technical data in server logs for security purposes.
4. Third-party services and international data transfers
We use the following third-party services to operate the Website. Your data may be transferred to countries outside the European Economic Area (EEA). Where applicable, these transfers are protected by Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.
| Service | Purpose | Data transferred | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the Website and its backups | All data stored on the Website | Germany (servers), Finland (backups) |
| Stripe Payments Europe, Ltd. | Payment processing | Email, payment details | Ireland |
| Google OAuth | Authentication | Email, name, profile picture | USA |
| Autodesk Model Derivative API | CAD file conversion | CAD files | USA |
| Google Street View Publish API | Publishing panoramas to Google Street View (optional, only at your request) | Panoramas and their location; access to the Google account you connect | USA |
| OpenStreetMap (OSMF) | Map tiles and geocoding (when georeferenced) | IP address; for the place search also the text you search for | UK |
| OpenTopoMap | Topographic map tiles (when georeferenced) | IP address | Germany |
| Esri ArcGIS Online | Map tiles (when georeferenced) | IP address | USA |
| Microsoft Bing Maps | Map tiles (when georeferenced) | IP address | USA |
| Standard marker icons of KML layers (when georeferenced) | IP address | USA | |
| OpenAI | AI Assistant | Chat messages | USA |
| OpenAI | Coordinate system detection | Coordinate system text, coordinate range, account country | USA |
| SMTP email provider | All notifications | Email address, name, payment details, project details, etc. | EU |
| Telegram (Telegram Messenger Inc.) | All notifications (optional) | Email address, name, payment details, project details, etc. | UAE (Dubai) |
The map services in this table (OpenStreetMap, OpenTopoMap, Esri, Microsoft Bing Maps and Google) are contacted only after you click "Show map" on the map. Your choice is stored in your browser (Art. 6(1)(a)); you can withdraw it at any time by deleting the data of this website in your browser.
We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use third-party analytics, advertising, or tracking services.
To suggest your country during sign-up and in your profile, we estimate your country based on your IP address using a local copy of the MaxMind GeoLite2 database stored on our own servers. Your IP address is not transmitted to MaxMind or any other third party for this lookup. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
5. Cookies and tracking technologies
We use only essential first-party cookies required for login and session management. These cookies are strictly necessary for the functioning of our website. We do not use third-party cookies, tracking pixels, fingerprinting, or any other tracking technologies.
On the pricing page for signed-in users, the embedded Stripe pricing table may set a cookie of Stripe in its own frame; we have no access to it (see the privacy policy of Stripe).
We honor Global Privacy Control (GPC) signals: when your browser sends one, we do not record the ad click ID. We neither sell nor share your personal data. Our machine-readable statement is published at /.well-known/gpc.json.
6. Data security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Passwords are hashed using an industry-standard algorithm (scrypt)
- Two-factor authentication (2FA) is available for all accounts
- CSRF protection on all forms
- Content Security Policy (CSP) headers
- Rate limiting on authentication endpoints
- All cookies are set with Secure, HttpOnly, and SameSite attributes
- All resources are self-hosted (no external CDN dependencies), except the map services named in section 4 (map tiles and geocoding) and the Stripe pricing table on the pricing page for signed-in users
7. Your rights under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): you can export all your personal data from your profile page at any time.
- Right to rectification (Art. 16): you can update your name, password, and other profile information at any time.
- Right to erasure (Art. 17): you can delete your account from your profile page. Your account data, your uploads, the projects only you own and your comments, together with the replies to them, are deleted at once. A project you own together with other users stays with them, including the files you uploaded to it, and your replies to other users' comments stay, shown without your name. Your email address remains in the upload records of projects and in the copies of the database the application makes before updates for up to 30 days. The exceptions are invoices, payment records and the records of your token use, which we are required by law to keep for the statutory retention periods (Art. 17(3)(b)).
- Right to data portability (Art. 20): you can export your data in machine-readable JSON format from your profile page.
- Right to restriction of processing (Art. 18): you have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while the accuracy of the data is disputed).
- Right to object (Art. 21): you have the right to object to processing based on legitimate interests (Art. 6(1)(f)), such as server log retention. We will stop such processing unless we have compelling legitimate grounds.
- Right to object to direct marketing (Art. 21(2)): you can unsubscribe from tips and news at any time in your profile or via the link in each such email. We then stop using your data for this purpose.
- Right to withdraw consent (Art. 7(3)): you can withdraw your consent at any time by deleting your account. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- Right to lodge a complaint: you have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.
8. Data breach notification
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, if required, inform affected users without undue delay.
9. Contact information
If you have any questions or concerns regarding data protection, or wish to exercise any of your rights, please contact us:
- by email: support@360-for-you.com
- by phone: +49302239952360 (German and English)
10. Updates to this Privacy Policy
We may update this Privacy Policy from time to time. All changes will be published on this page, along with the date of the update. If we make significant changes that affect your rights, we will notify you via email or a notice on our Website. We encourage you to review this page periodically.