Privacy Policy

1. Data controller

The data controller is Vianim, operating the Service at https://vianim.com and established in the European Union. For privacy requests, contact support@vianim.com.

If you need our registered legal entity name, company number, or postal address for a formal notice, email support@vianim.com and we will provide the details that apply at the time of your request.

2. Personal data we process

Depending on how you use the Service, we may process the following categories of data:

• Account data: name, email address, optional profile image, and (for email/password accounts) a bcrypt-hashed password. We never store plaintext passwords.
• Authentication data: Google Sign-In identity when you choose SSO; hashed one-time tokens for email verification and password reset (with automatic expiry).
• Project and route data: GeoJSON LineString coordinates (longitude, latitude, elevation), animation settings, waypoints (including text labels), and for Pro plans, waypoint photos stored in private cloud storage.
• Billing data: Stripe customer and subscription identifiers, plan role, and Free-plan export usage counters. Card numbers and payment credentials are handled by Stripe and are not stored on our servers.
• Technical and usage data: basic product analytics via Vercel Analytics (see Cookies and analytics below), and security-related signals used for rate limiting on authentication and other sensitive endpoints.

3. Purposes and legal bases

We process personal data only where we have a lawful basis under the GDPR:

• Contract (Art. 6(1)(b)): creating and managing your account, parsing and storing routes you upload, rendering preview and export videos, delivering signed download links, and sending transactional emails (verification, password reset) via Resend.
• Legal obligation (Art. 6(1)(c)): retaining billing records required for tax and accounting where applicable.
• Legitimate interests (Art. 6(1)(f)): securing the Service (rate limits, abuse prevention), improving reliability, and understanding aggregate product usage through cookieless analytics. You may object to processing based on legitimate interests where applicable.
• Consent (Art. 6(1)(a)): only where we expressly ask for it (for example, optional marketing communications if we introduce them). You may withdraw consent at any time.

4. Cookies and analytics

We use session cookies and similar technologies that are necessary to keep you signed in and to operate the Service securely. We do not use advertising or third-party marketing cookies.

We use Vercel Analytics for privacy-oriented, cookieless product analytics (page views and performance). This helps us understand how the Service is used without building advertising profiles.

5. Processors and recipients

We use carefully selected processors who act on our instructions to operate the Service:

• Vercel — application hosting and Analytics.
• MongoDB Atlas — database storage for accounts and projects.
• Google — Google Sign-In (when you choose SSO), Google Cloud Storage for private export videos and waypoint photos, and Google Cloud Run for the video render worker.
• Stripe — subscription payments and the customer billing portal.
• Resend — transactional email delivery.
• Mapbox — map tiles and 3D terrain imagery while you view or render maps in the studio (Mapbox may process IP address and device information under its own terms when tiles are requested).

6. International transfers

Some processors are located outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and the processor’s published transfer mechanisms, unless an adequacy decision applies.

7. Retention

We keep personal data only as long as needed for the purposes above:

• Account and project data (including GeoJSON routes and waypoint photos): until you delete the project or account, or until you successfully request erasure, subject to any legal retention duties.
• Rendered MP4 exports: stored in private Google Cloud Storage and automatically deleted after 48 hours. Download links are time-limited signed URLs that typically expire after 24 hours.
• Password-reset tokens: about 60 minutes. Email-verification tokens: about 24 hours. Tokens are stored hashed and expire automatically.
• Billing-related records: retained as required by applicable tax and commercial law.

8. Your rights

If you are in the EEA (or otherwise entitled under GDPR), you have the right to:

• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”) in the circumstances set out in Art. 17 GDPR.
• Restrict processing in certain cases.
• Data portability for data you provided to us, where processing is based on contract or consent and carried out by automated means.
• Object to processing based on legitimate interests.
• Lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of an alleged infringement.

9. How to exercise your rights

Email support@vianim.com with your request. We may need to verify your identity before fulfilling it. We will respond within the timeframes required by the GDPR (generally one month).

You can also update account details in Settings where available, and manage or cancel paid subscriptions through the Stripe customer portal linked from billing settings.

10. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact support@vianim.com and we will take appropriate steps to delete it.

11. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes may also be communicated by email or an in-product notice where appropriate. Continued use of the Service after an update constitutes acknowledgment of the revised policy to the extent permitted by law.

12. Contact

Privacy questions and GDPR requests: support@vianim.com.