RuralCheck

Privacy policy

Last updated 19 October 2026.

This policy says what RuralCheck does with personal data, who else sees it and what you can ask us to do about it. It covers the website at ruralcheck.eu and the reports it produces.

Who is responsible

Controller
Clemens Mosig
Address
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
Email
hello@ruralcheck.eu

There is no data protection officer. RuralCheck is below the size at which one is required.

What we hold

Your account
Your email address, an encrypted form of your password, and the dates the account was created and last signed in. Kept until you delete the account.
Reports you run
The coordinates you selected, the time, and which checks ran. The result of a report is deleted after one day unless you save the plot. The rest is kept until you delete the account.
Plots you save
The coordinates, the name and note you give them, the folders you make, and a copy of the report as it was when you saved it. Kept until you delete the plot or the account. A deleted plot goes to the Trash first. It is deleted for good 30 days later, or sooner if you empty the Trash.
Backups
Deleted plots and deleted accounts remain in our encrypted offsite backups, where each daily backup is kept for 30 days, the first backup of each month for 12 months, and the first backup of each year for 3 years.
Your plan
Which plan the account is on, and your API keys, of which we keep only a scrambled form. Kept for as long as the account exists.
Payments
If you buy a plan: the plan and its price, the country you chose at the checkout, the country of the card or bank account you paid with, how you paid, the dates of each payment, refund and cancellation, and the invoices we issue. If you asked for your plan to start straight away, the sentence you ticked and when. We do not receive your card number or your bank login. These records are kept for eight years, as German tax law requires, also after you delete the account.
Your details on reports
On the Professional plan, the business name, contact details and logo you enter for your PDFs. Kept until you change or remove them, or delete the account.
Client links
On the Professional plan, a copy of each report you download as a PDF, so that its client link keeps showing the report as it was made. Anyone who has a link can open that report, including its coordinates, while the link is on and the account is on a plan that includes client links. You can turn each link off and on again in My plots. Kept until you delete the account.
Listings you upload
On the Professional plan, the name, your reference and the position of each listing in a file you upload. The file itself is not kept. Each listing that is run becomes a saved plot with a client link, as above. When an upload has finished we send one email to your account's address to say so. Kept until you delete the upload or the account.
API use
For each API key, how many requests of each kind it made on each day. Nothing about the requests themselves. Kept for as long as the key exists.
Server logs
The web server records the address of each request, the page asked for, the time and the browser's own description of itself. Kept for 14 days and used to find faults and abuse.
Feedback
If you send us a message with the Feedback form, we keep the message, the date, your account, and which check or report it is about. The position of the plot is kept only if you tick the box to include it. Nothing else. We also send each message to our own email address, so that we can reply to you. Kept until you delete the account. Ask us and we will delete a message sooner.
Cancellations
If you cancel a plan or withdraw from it: what you chose, the reason if you gave one, and when we received it. If you use the cancellation form without signing in, also the email address and the name you enter there. Kept with the payment records, for the same eight years. If our mail server does not take a confirmation we owe you, we keep that email until it has been sent, and then delete it.
Business details
If you buy for a business, the business name, address, country and VAT ID you enter on your account page, the statement that you buy for the business, and what the EU VAT register said about the VAT ID and when. Kept until you remove them or delete the account. An invoice made out with them is kept for eight years, as German tax law requires.

We do not ask for your name, your address or the address of the property you are looking at. A report is produced from a point on a map. The one exception is an invoice for more than 250 euros, which tax law says has to name you, so the checkout asks for your name and address then.

What you have to give us

An account needs an email address and a password. Without them we cannot give you an account. Buying a plan needs the details the checkout asks for, because we need them to make the contract and the invoice. Everything else here is up to you.

Why we are allowed to hold it

Your account, your reports, your saved plots, your details on reports, your client links and your listings
To provide what you asked for. Article 6(1)(b) of the GDPR, performance of a contract.
Server logs and security
Our legitimate interest in a site that works and is not abused. Article 6(1)(f).
Visitor statistics
Our legitimate interest in knowing which pages are used, and in finding faults in the page. Article 6(1)(f). See below for why this needs no consent.
Feedback
Our legitimate interest in answering you and in correcting what you tell us about. Article 6(1)(f).
Cancellations
To carry out the cancellation and confirm it, as the law requires. Article 6(1)(b) and (c).
Payments
To sell you the plan you chose. Article 6(1)(b). Keeping the records afterwards is a legal obligation to keep business records. Article 6(1)(c).
Business details and the VAT ID check
To make out invoices as tax law requires, and to tell whether the reverse charge applies. Article 6(1)(b) and (c).

Who else sees it

RuralCheck runs on one server in Germany. The list below is everyone outside that server who receives anything, including the companies your browser contacts directly when a page loads.

Hetzner Online GmbH, Germany
The server itself, the encrypted offsite backups, and the mail server that sends our emails (account and password emails, order and cancellation confirmations, notices about payments) and receives your feedback. Everything described above is stored here. Our processor.
PostHog Inc., United States, with European Union hosting
Visitor statistics. Your browser sends the events to PostHog directly, so PostHog receives your IP address and the browser's description of itself, and works out from the address roughly which country and city a visit comes from. With each event it receives the page you are on, without anything after the page's own address, and which button or link you used, without its text. When you run a report it receives where, rounded to about 10 km. When the page fails, it receives the error message and where in our code it happened, so that we can fix it. It does not receive your email address, your account or the plot you selected. PostHog keeps the events, with the IP address, for one year and then deletes them. Our processor. The data is stored in the EU. PostHog has certified its compliance with the EU-U.S. Data Privacy Framework, which covers any access from the United States (Article 45 GDPR).
Esri, United States
Supplies the aerial photography on the map and in the 3D view. Your browser requests those images directly, so Esri receives your address and which part of the map you are looking at. This happens when you open a sample report, whose view from the plot and 3D view are drawn from these photos. On a paid plan it happens whenever you use the map: when the map loads, when a report draws its view from the plot, when you zoom in close, and in the 3D view. Esri is in the United States and has certified its compliance with the EU-U.S. Data Privacy Framework, for which the European Commission has decided that the protection is adequate (Article 45 GDPR). On a paid plan the basis is the contract for your plan, Article 6(1)(b). For a sample report it is our legitimate interest in showing you a complete report, Article 6(1)(f).
OpenFreeMap (Hyperknot Software Kft., Hungary)
Supplies the map on the main page. Your browser requests the map tiles directly, so the service receives your address and which part of the map you are looking at. No other page on this site loads a map. The basis is our legitimate interest in showing you a map, Article 6(1)(f). OpenFreeMap's own privacy policy says it keeps no addresses in its access logs and deletes its error logs after 7 days.
Mollie B.V., Netherlands
Takes payments for the plans. You pay on Mollie's own page, so Mollie receives your card or bank details there and whatever else that page asks for. From us it receives your email address, your account's id, the plan and the amount. Mollie is a licensed payment institution and is responsible for the payment details itself, under its own privacy statement. This happens only if you buy a plan.
European Commission, VIES, European Union
The EU VAT register. When you save a VAT ID on your account page, our server sends the number to it to check that it is valid. It receives the number and nothing else about you. This happens only if you enter a VAT ID.

Your account and your password are held on our own server. They are not sent to an identity provider or a sign-in service. The map software the page runs is served from our own server too, so no content delivery network sees your visit.

Nothing is sold, and nothing is shared for advertising.

Automated decisions

We make one decision about you automatically. We do not sell plans to consumers in the United Kingdom, so if you buy as a consumer and the card or bank account you pay with is from the United Kingdom, the payment is refunded in full and the plan does not start. The country comes from Mollie. If you think this is wrong, write to us and we will look at it ourselves. Nothing else here is decided about you by a machine, and there is no profiling.

Visitor statistics, and why there is no cookie banner

We use PostHog to count visits and to see which parts of the site are used. It is set up so that no consent is needed and no banner is shown:

German law requires consent before anything is stored on or read from your device, unless it is needed for something you asked for (section 25 TDDDG). The statistics store nothing on your device, so the rule does not apply to them, and we rely on our legitimate interest for the counting itself. You can object to it at any time using the address above. If we ever turn on anything that needs consent, you will be asked first.

Cookies and storage in your browser

Signing in sets two cookies that keep you signed in. They are necessary for the site to work and are not used for anything else. Your browser cannot read them. There are no advertising or tracking cookies.

The map page also keeps a few of your own settings in your browser's storage, so that they are there next time: the checks you pinned, the columns you chose in My plots, the places you last chose, the units and currency you picked, and whether you left a panel open or shut. That is what you asked the page to remember, so no consent is needed. They stay on your device and you can clear them in your browser at any time. When you are signed in, the units and currency are kept with your account instead.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, or to receive it in a portable form. Write to the address above.

Your right to object

Where we rely on our legitimate interest (Article 6(1)(f)), you can object at any time, for reasons arising from your situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims (Article 21 GDPR). Write to the address above.

You can delete your account yourself from your account page. That removes the account, your saved plots and notes, your API keys, your business details, your details and logo on reports, your client links, your listing uploads, your feedback and the list of reports you ran. The payment records and invoices stay for as long as tax law requires, without the account.

You can also complain to a data protection supervisory authority, either in the country where you live or the one responsible for us. The business is established in Leipzig, so ours is the authority for Saxony:

Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17
01067 Dresden
Germany
post@sdtb.sachsen.de

Changes

If this policy changes, the date at the top of the page changes with it.