How Schaduwplan handles your data.

Schaduwplan is a web application for sunlight studies (bezonningsonderzoek) on Dutch addresses. The 3D viewer runs entirely in your browser: we do not record what you do. Only when something goes wrong do we send an error report to our error monitoring. What we do do is explained per section below.

• No tracking cookies, no advertising pixels, no ad networks. What we do do: error monitoring via Sentry (EU) across the whole site, and in the logged-in part of the app pseudonymised product analytics via PostHog (EU), linked to your account id. On public pages no persistent identifier and no cookies. See Processors below.
• If something goes wrong on the site, your browser sends an error report to Sentry (EU). It contains the address you are working on in the viewer (street, house number, postcode, town, municipality, BAG identifiers and coordinates) and what you typed in the search bar in the same session. Without that data we cannot reproduce an error at a specific address. See Processors.
• Address searches go directly from your browser to PDOK (Kadaster). 3D models are fetched via our own Cloudflare cache from 3DBAG; height data from PDOK and Ellipsis Drive (the official AHN distribution partner). Once an address has loaded, we check once with Ruimtelijke Plannen (Informatiehuis Ruimte / DSO), via our own proxy, whether the zoning plan there publishes a building plot with maximum heights — that is how we know whether we can offer that feature. See Third parties & sources.
• Your work (addresses, projects, optional attachments, any height uploads) is kept by the viewer functionally in your own browser — in localStorage and IndexedDB. None of it reaches our servers; only an error report carries the address (see above). See Cookies & local storage and the cookie statement for the full list.
• When you purchase a report we process your email, invoicing details and the address of the report.

The controller within the meaning of the GDPR (Article 4(7)) is:

• Trade name: Schaduwplan
• Business: Schaduwplan is operated as a sole proprietorship (eenmanszaak) under Dutch law.
• Chamber of Commerce (KvK) number: 99118998
• VAT ID: NL005372731B91
• Registered address: the business address registered with the Chamber of Commerce can be retrieved via kvk.nl. For formal correspondence and GDPR requests the email address below is sufficient.
• Contact: [email protected] — for privacy questions, support, complaints and everything else.
• Data Protection Officer: Schaduwplan does not qualify as an organisation for which the GDPR (Article 37) requires a DPO. Questions you would put to a DPO can be sent directly to [email protected].

Schaduwplan is intended for use by people aged 16 or over (Article 8 GDPR, Dutch implementation practice). The service is not aimed at children under 16 and we do not knowingly collect personal data from minors.

Do you suspect we have unintentionally collected data from a child under 16? Email [email protected] — we will delete that data without undue delay.

Depending on how you use the service, different categories of data are processed. We deliberately split them into "locally in your browser" (which Schaduwplan technically cannot access) and "at Schaduwplan":

Locally in your browser (functional storage, only on your device — we cannot reach it):

• Recently searched addresses — at most 6, in localStorage, so you can jump back quickly in the address bar. Contains street, house number, postcode, town, RD/WGS84 coordinates and BAG id.
• Saved projects — in IndexedDB (database schaduwplan, store projects), when you save a scenario via Projects → Save. Contains the address, planned buildings, measurement points and the chosen moment in time. Any heights derived from a GeoTIFF upload are included as a measured value in the saved project — we never keep the raw GeoTIFF itself ("extract-and-discard").
• Permit attachments — in localStorage, when you upload a PDF or photo of a building permit or drawing under "Adjust source data" to support a manual height correction. At most 5 MB in total.
• Waitlist email — in localStorage, if you leave your email address via the "Sign in / accounts are coming" popover. That email stays on your device until the real account functionality goes live — only then do we explicitly ask you again to submit it.
• Temporary session state — in sessionStorage, to hand over a chosen address from the landing page to the viewer and to remember "do not show again" choices within one session. Erased as soon as you close the tab.

Full keys and retention periods are listed in the cookie statement.

At Schaduwplan (only relevant once a paid flow goes live — at present no paid reports have been delivered yet):

• Report purchase: your email address, the address of the report, and (for Business) optionally a company name and KvK number for invoicing.
• Payments: Stripe processes the payment. We only receive a transaction reference, amount and date — no card number.
• Contact: when you email [email protected] we keep that correspondence.
• Server logs from our hosting (Cloudflare Pages): technical access data (IP address, timestamp, requested path) as every web server does. Cloudflare keeps these for a short time for security and debugging and does not share them with us in aggregated or identified form.
• Error reports (Sentry): when something goes wrong, the report contains the technical error, the address you are working on (street, house number, postcode, town, municipality, BAG identifiers and coordinates) and what you typed in the search bar in the same session. Search input is only sent if an error occurs in that session.

• Delivering the purchased report (PDF by email).
• Processing payments and issuing invoices.
• Answering contact requests.
• Finding and fixing errors (error reports via Sentry).
• Legal obligations (tax retention duty on invoices).

We never use your data for marketing purposes beyond your request, never sell it to third parties, and carry out no profiling.

• Performance of the contract — for delivering the report you purchase.
• Legal obligation — for invoicing and the tax retention duty.
• Legitimate interest — for handling your contact requests, and for finding and fixing errors. An error that occurs at one address only cannot be found without that address. You can object to this (see Your rights).

To make the 3D viewer work we connect to a number of external services. Some connections run directly from your browser to the source, others run via our Cloudflare cache (so we do not overload the upstream API and you get faster responses):

• PDOK Locatieserver (Kadaster) — address autocomplete and BAG building resolution. Directly from your browser. A government service; no personal data recorded beyond the search itself.
• 3DBAG (TU Delft + 3DGI) — 3D building models and building attributes. Via our Cloudflare Pages function at /api/bag3d/* (24-hour edge cache, because 3DBAG sends no CORS headers). Open data, CC BY 4.0; no personal data — although Cloudflare does log standard access metadata such as IP and timestamp for security.
• PDOK (AHN4) — height data via WCS. Directly from your browser. Open data.
• Ellipsis Drive (AHN5 / AHN6) — more recent height data, only when 3DBAG is outdated for your building or could not produce a roof fit. Ellipsis Drive is a Dutch SaaS appointed by AHN as the official distribution partner for AHN5+ (see ahn.nl/dataroom). Directly from your browser. No personal data.
• Ruimtelijke Plannen API (Informatiehuis Ruimte / DSO) — building plot and maximum eaves and building height from the zoning plan, for the permitted building volume. Once per loaded address, automatically, so the viewer knows whether this zoning plan is published digitally; after that only if you click “Try again” yourself. The coordinate of the searched address then goes via our own Cloudflare Pages function at /api/rp/* to this government service; our API key stays server-side. Read responses are edge-cached for at most 24 hours; the searches are kept for at most 7 days in a shared response cache. What is kept there is the government service's own answer — open planning data — under a key in which your address is not readable. That is a readability measure, not anonymisation: the real protection comes from the access boundary and the 7-day retention. The values you confirm stay in your browser and only enter your report at checkout.
• Cloudflare Pages — our hosting. Serves the website and the 3DBAG cache from EU edges. Cloudflare sees standard web server logs (IP, timestamp, path).
• Stripe (Stripe Payments Europe Ltd, Ireland) — for payments (not yet live at the time of this statement). An EU processor with its own privacy policy.

We use no Google Analytics, no Meta Pixel, no Cloudflare Web Analytics and no advertising or social tracking. For error monitoring we use Sentry (EU) with privacy-conservative settings; for product analytics in the logged-in part PostHog (EU). Both are described in detail under "Processors" below. Fonts (Fraunces, Inter Tight, JetBrains Mono) are bundled into our build via @fontsource — so no request goes to Google Fonts or a comparable CDN.

For the services listed below we work with a data processing agreement (DPA) or the supplier's standard DPA. All with an EU establishment or an EU-residency guarantee. A complete up-to-date list, including DPA versions and transfer mechanisms, is in our sub-processor register (GDPR Art. 30).

• Cloudflare, Inc. — hosting (Cloudflare Pages, Workers, R2 object storage, Queues, DNS). EU edges; R2 bucket in EU jurisdiction; standard DPA and EU SCCs for any transatlantic sub-processing.
• Supabase Inc. (eu-central-1, Frankfurt) — database (Postgres with Row Level Security), authentication and Realtime broadcasts for the customer dashboard. Own DPA with EU SCCs Module 2.
• Stripe Payments Europe Ltd (Dublin, Ireland) — payment processor for the paid reports: Stripe Checkout for the transaction, Stripe Tax for automatic VAT calculation and Stripe Invoicing for invoice generation. EU entity, PCI DSS Level 1, own DPA.
• Resend (eu-west-1, Ireland; Plus Five Five, Inc.) — transactional email (report ready, payment error) via the subdomain mail.schaduwplan.nl and SMTP relay for Supabase Auth emails (password reset, email verification). EU SCCs Module 2 + EU-US DPF.
• Sentry (de.sentry.io, Frankfurt; Functional Software, Inc.) — error monitoring for the frontend and the render Worker. With an error in your browser, Sentry receives the address you are working on (street, house number, postcode, town, municipality, BAG identifiers and coordinates) and what you typed in the search bar in the same session; after sign-in linked to your account id. We send no IP address (sendDefaultPii: false), no session replay, sample rate 10% for performance traces. Own DPA v5.1.0 with EU SCCs Module 2.
• PostHog, Inc. (eu.posthog.com, AWS Frankfurt) — product analytics. On public pages without a persistent identifier and without cookies (disable_persistence: true); in the logged-in part linked to your account id for conversion-funnel analysis, with opt-in via the terms of use at registration. No session recording, no heatmaps, no autocapture. Own DPA + EU SCCs Module 2.
• Zoho Corporation B.V. (EU) — incoming email for hello@, privacy@, security@ and similar aliases under @schaduwplan.nl. Standard Zoho DPA based on Model Contractual Clauses.
• Backblaze, Inc. (B2, region EU Central, Amsterdam) — storage of our encrypted offsite backups of the database and the report files. Those backups are encrypted with OpenPGP before they are sent; Backblaze does not hold the key and cannot read the contents. Standard Backblaze DPA with EU SCCs; Backblaze is certified under the EU-US Data Privacy Framework.

Any future expansion of the stack will be added to this statement in advance, at least 30 days before it is put into use. Sentry and PostHog were announced on this date (2026-05-14) and go live with the Schaduwplan paid-backend MVP. Since 2026-09-19 Backblaze replaces Zoho WorkDrive as the backup store, without that notice period: Backblaze stores only encrypted files and has no access to their contents.

We aim to process data within the European Economic Area (EEA). Cloudflare and Stripe are, however, part of groups with US parent companies, which means supporting processing may occasionally take place outside the EEA. Where that is the case, we rely on the standard safeguards the GDPR prescribes:

• a valid adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, insofar as the receiving party is certified under it); or
• the European Standard Contractual Clauses (SCCs), supplemented where appropriate with additional safeguards such as encryption and pseudonymised processing; or
• another appropriate safeguard in accordance with GDPR Chapter V.

An up-to-date list of our processors and their transfer mechanism is available on request via [email protected].

At Schaduwplan:

• Report-related data: 12 months after purchase (for support and iteration), then deleted unless kept longer at your request.
• Invoices: 7 years (statutory tax retention duty, Art. 52 AWR).
• Contact emails: at most 24 months.
• Backups: an encrypted copy of the database (daily) and of the report PDFs (weekly), kept outside the production environment. Daily copies are overwritten after 31 days, monthly copies after 6 months. An overwritten copy stays as a hidden version for 30 more days and is then deleted automatically.
• Hosting / server logs: Cloudflare keeps access logs at edge level for at most a few days by default. We ourselves log nothing structurally. Error reports at Sentry, with the address and the search input, are kept for at most 90 days.

Locally in your browser — we do not set these periods, you do:

• sessionStorage is erased as soon as you close the tab.
• localStorage and IndexedDB remain until you erase them via your browser settings, via "Clear recent addresses" / "Remove attachment" in the viewer, or until your browser cleans up on its own (e.g. iOS Safari eviction after prolonged inactivity).
• For projects you can optionally allow navigator.storage.persist() so the browser does not clean up your work unprompted.

You have the right to:

• Access to which data we hold about you.
• Correction of inaccurate data.
• Erasure ("right to be forgotten") within what the tax retention duty allows.
• Restriction of processing.
• Data portability.
• Object to processing based on legitimate interest.
• The right to complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

Questions about your rights? Email [email protected]. We respond within the statutory period of four weeks.

You have the right to have your data and (future) account deleted.

• Local data (3D viewer) you can erase yourself via the browser settings for schaduwplan.nl, or via the "Delete" buttons in the viewer.
• Self-service at schaduwplan.nl/app/settings — if you have an account, you can there (a) delete your account with all associated report bytes at the press of a button, and (b) download a JSON export of all your data (Art. 20 GDPR — right to data portability). Confirmation follows immediately in the UI.
• By email is also possible, from the email address known to us, to [email protected]. We confirm the deletion within the statutory period of 30 days (extendable by 60 days for complex requests).
• What we are legally required to keep: invoices remain under the tax retention duty (Art. 52 AWR — 7 years), even after a deletion request. A deletion request for this category is refused on the basis of Art. 17(3)(b) GDPR (statutory retention duty). The link with the deleted account is broken (the project row remains, user_id becomes NULL).
• Backups: your deletion takes effect immediately in the live environment. We do not search or edit backups — they are overwritten automatically and the old version is deleted 30 days later, so at most 7 months after your request your data is gone from those too. We restore a backup only on data loss, never to bring deleted data back.
• Stripe keeps a payment history separate from Schaduwplan. If you also want their copy deleted, you can do so via privacy.stripe.com.

We place no tracking cookies and no advertising cookies. We do use functional local browser storage (sessionStorage, localStorage and IndexedDB) to keep your work between sessions. This falls under "strictly necessary" storage within the meaning of Article 11.7a of the Dutch Telecommunications Act — so no cookie consent is required.

The full list of keys, purpose and retention is in the cookie statement.

The website runs on Cloudflare Pages with TLS 1.3. Payment data is processed by Stripe with PCI DSS Level 1 compliance. Emails are sent and stored encrypted (TLS). Report PDFs are stored encrypted. Local browser storage is accessible only to you — we have no read access to it.

We back up the database every night and the report PDFs every week. Those backups are encrypted before they leave our build environment, and the key that opens them is kept offline — so the storage provider cannot read them. Every backup is restored into a throwaway database in the same automated run and checked for completeness; if that fails, the run fails visibly instead of silently.

Should a data breach involving your personal data unexpectedly occur and present a risk, we will report it in accordance with Article 33 GDPR within 72 hours of discovery to the Dutch Data Protection Authority. Where the breach is likely to result in a high risk to your rights and freedoms, we will inform you directly without undue delay (Article 34 GDPR). Do you suspect a breach yourself? Email [email protected] as specifically as possible.

We announce substantial changes via a banner on the website at least 30 days before they take effect. Small editorial changes we publish quietly, with an updated "last updated" date at the top.

Questions, complaints or requests: [email protected]. We respond within one business day.