Privacy notice

The company details are being added to this page.

Last updated 21 October 2026.

This notice explains what personal data Plan Takeoff processes, why, and for how long. The controller is the operator named on the Company page, contact the address on the Company page.

Your drawings

When you open a plan, the file is sent to our server, which turns the page you are viewing into an image. The file is processed for that request only and is not kept. The rendered page is kept in the server's memory for at most one hour so that switching between pages is fast, and is then discarded. Drawings are never stored permanently, shared, or used to train any model. Legal basis: performing the service you asked for (GDPR Art. 6(1)(b)).

Your measurements

Measurements, prices and settings are stored only in your own browser (local storage) and in project files you choose to download. We do not receive them.

Payments

Payments are handled by Stripe. We receive the name, email, billing address, company name, VAT number and payment status you enter at checkout, and use them to provide the export pass, issue invoices and keep accounting records. Card details go to Stripe only. Invoices and accounting records are kept for seven years as required by the Estonian Accounting Act (Raamatupidamise seadus § 12). Legal bases: contract and legal obligation (GDPR Art. 6(1)(b) and (c)).

Export passes

There are no user accounts. After a payment, your browser keeps a random pass token and a random browser secret in its local storage; the server keeps the pass with a fingerprint of the plan file (a SHA-256 hash, not the file) and the Stripe payment references. These are needed to provide what you bought, so no consent banner is used. Deleting your browser data removes the token from your device.

Server logs

The server logs the IP address, time and requested address of API calls to protect the service against abuse (rate limits) and to investigate faults. Logs are deleted after 30 days. Legal basis: legitimate interest in keeping the service secure (GDPR Art. 6(1)(f)).

Service providers

• Stripe (payments and invoices). Stripe's data processing terms apply: stripe.com/legal/dpa.
• Tailscale Inc. (network connection to our server). It carries encrypted traffic and sees IP addresses; it cannot read the content. Terms: tailscale.com/legal/dpa.

Both may process data outside the EU under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

No cookies, no tracking

Plan Takeoff sets no cookies and uses no analytics or advertising trackers.

Your rights

You can ask for access to, correction or deletion of your personal data, restriction of or objection to its processing, and a copy of it, by writing to the address on the Company page. We answer within one month. Accounting records cannot be deleted before the legal retention period ends. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).