Privacy Policy
Version: 14 October 2026
Previous versions: available on request at agne@gijahub.com.
P1. Who is responsible
P1.1 For the data described in this policy as "ours", the controller is:
GIJA HUB MB
Polocko g. 4B-20, Vilnius, Lithuania
Company code: 307210538
Email: agne@gijahub.com
P1.2 We operate the platform under two names, Forresten (forresten.dk) and GIJA MAPS (gijamaps.com).
P1.3 We have not appointed a data protection officer, because the GDPR does not require it. Contact us at agne@gijahub.com for any privacy question.
P2. Our two roles
We act in two roles. They depend on the data.
| Data | Examples | Our role | Rules |
|---|---|---|---|
| Customer Content | Drone images and their metadata, datasets, results (orthophotos, point clouds, models), text you write in a Client Gallery | You are the controller. We are your processor. | Data Processing Agreement (DPA) and Terms |
| Account data | Email address, password hash, Google account ID, account level, balance, job records | We are the controller | This policy |
| Payment records | Amounts, VAT, country, payment IDs | We are the controller for our records. Stripe is an independent controller for taking the payment. | This policy and Stripe's privacy notice |
| Security and access data | IP addresses, sessions, gallery access attempts | We are the controller | This policy |
| Messages to us | Contact form and support emails | We are the controller | This policy |
| Website analytics | Page visits, aggregated | We are the controller (Umami Cloud is our processor) | This policy |
P2.1 This means: when you upload drone images, you decide why and how they are processed, and you are responsible for having a lawful basis and for informing the people in them. We process them only to provide the Service to you (clause P4).
P3. Data we collect as controller, and why
We collect only what we need to provide the Service.
P3.1 Account data.
- Email address: for login, job and account notices, and (if you subscribed) the newsletter. If you sign in with Google, we receive your email address from Google.
- Password: stored only as a salted one-way hash. We cannot see it. If you sign up with Google, we store a random unused hash as a placeholder. We never have your Google password.
- Google account ID: only if you use Google Sign-In. We store it to link your Google account to your account here. It is never shown or shared. Google Sign-In is optional. You can always use email and password instead.
- Account settings: account level (Basic or Full Service), balance and transaction history, language and brand of the site you registered on.
P3.2 Job and usage records. Job names, presets, image counts, status, timings, prices and error codes. They are needed to run the Service, for billing history and for support. They are not the content of your images.
P3.3 Security and access data. IP address and session data, for security. This includes the IP address recorded with purchases and sign-ins.
P3.4 Payments. When you buy balance, Stripe takes the payment as merchant of record. We receive the payment ID, amount, VAT, currency and your country. Stripe can also show us the order data you give at checkout (for example your name, billing address, phone number and VAT ID). We do not receive your card number. See clause P5.
P3.5 Messages to us. If you use the contact form, we receive your name, email address, telephone number (if you give it) and message. We use them to reply.
P3.6 Client Gallery access data.
- For the owner: the access code is a 6-digit code that is stored with the gallery, so the owner can see it in the account. The text the owner writes in a gallery is Customer Content (clause P4).
- For visitors: visitors need no account. After a correct password, we create a temporary session that lasts 8 hours. It is a random token that we store only as a SHA-256 hash. When a wrong password is entered, we store the visitor's IP address and the number of wrong attempts for that gallery, to stop password guessing. Ten wrong attempts from one IP address lock it out for 15 minutes. We count how often a gallery was opened and when it was last opened. We do not store who opened it, and we do not store visitors' names.
P3.7 Newsletter. If you sign up, we store your email address and your consent. You can withdraw at any time.
P3.8 We do not ask for your name, address or telephone number when you register. We have your name, address or telephone number only if you give them to us (for example in the contact form or at Stripe's checkout).
P4. Customer Content: what we do and do not do
P4.1 Your uploaded images and the results are stored in the EU and processed only to provide the Service. We process them as your processor under the DPA.
P4.2 We do not use Customer Content to train, fine-tune or test AI or machine-learning models. We do not publish it, market it, or use it for demos or research.
P4.3 We do not look at Customer Content as part of normal operation. Processing is automatic. We open specific content only to solve a problem: a support request that you raised, or a processing failure or incident that affects your job. We use the smallest amount of data needed. We may also have to disclose it where the law requires (clause P14).
P4.4 Storage. Customer Content is stored for 30 days for Basic and 365 days for Full Service (clause P11).
P4.5 Share links. Result files are delivered through a share link. The link is protected only by its random token. It is not password-protected. Anyone who has it can download the files. You are responsible for keeping it confidential.
P4.6 Point cloud viewer. The point cloud viewer shows thumbnails of the drone photos that cover a clicked point, and can open the original photos in full resolution. This applies to you and to visitors of a Client Gallery that includes the point cloud. You cannot switch it off. You can hide the point cloud for a location in the gallery.
P5. Payments
P5.1 Balance purchases go through Stripe. Stripe is the merchant of record. It takes the payment, handles VAT, issues the receipt and invoice, and deals with payment disputes and payment support.
P5.2 For this, Stripe is an independent controller. It uses your payment data under its own privacy notice, linked at checkout. We are not Stripe's processor and Stripe is not ours.
P5.3 We send Stripe your email address and an internal account reference, so that the purchase is linked to your account. We get back the payment facts listed in clause P3.4.
P6. Website analytics
P6.1 We use Umami Cloud (Umami Software, Inc.) to see how the website is used. It is cookieless. It collects aggregated and pseudonymised data: page visits, clicks and visit paths, with browser, device type, screen size, language and approximate country. This includes shared viewer and client gallery pages; a client gallery link is recorded only as a one-way code, never the link itself.
P6.2 We do not use advertising cookies, tracking pixels, or fingerprinting for profiling.
P6.3 Our legal basis is legitimate interest (Article 6(1)(f) GDPR): to understand and improve our website. We limit the impact on you by using an analytics tool without cookies, keeping the data aggregated and pseudonymised, and not combining it with account data. You can object at any time (clause P15). You can also block the analytics script in your browser.
P6.4 Umami is our processor and is based in the United States. See clause P10.
P7. Cookies and similar storage
P7.1 We use one session cookie to keep you signed in, and a small amount of functional browser storage. Details are in the Cookie Policy.
P7.2 Client Galleries use no cookie for access. After unlocking, your browser keeps the session token in the tab's sessionStorage. It disappears when you close the tab or after 8 hours.
P7.3 We set no advertising or tracking cookies. Stripe sets no cookies on our website. When you pay, you go to Stripe's checkout page, which sets its own cookies there under Stripe's own policy.
P8. Purposes and legal bases (GDPR Article 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and managing your account | Account data | Contract (Art. 6(1)(b)) |
| Running the Service and showing your job history | Job and usage records | Contract (Art. 6(1)(b)) |
| Payments, balance and refunds | Payment records | Contract (Art. 6(1)(b)) |
| Keeping accounting and tax records | Payment records | Legal obligation (Art. 6(1)(c)) |
| Sign-in with Google (optional) | Google account ID, email | Contract (Art. 6(1)(b)) |
| Service emails: job status, results link, balance expiry warning, changes to the Terms | Email address, job data | Contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) for notices we must give |
| Security logging, fraud prevention and abuse prevention (including abuse of free processing) | IP address, sessions, events | Legitimate interest (Art. 6(1)(f)) |
| Access control for Client Galleries (password, sessions, protection against guessing) | Visitor IP address, attempt counts, session token hash | Legitimate interest (Art. 6(1)(f)) |
| Replying to messages and support | Name, email, phone, message | Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Website analytics | Cookieless, aggregated, pseudonymised usage data | Legitimate interest (Art. 6(1)(f)) |
| Newsletter | Email address | Consent (Art. 6(1)(a)); explicit opt-in |
| Legal claims, and legal requests | Any of the above as needed | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
P8.1 Customer Content is not in this table. We process it as your processor, under your instructions. The lawful basis is yours.
P8.2 If you do not give us the data we need for your account (for example your email address), we cannot provide the Service.
P9. Who receives data
P9.1 Our providers are listed on the Sub-processors page, with their countries and roles. In short:
- Hetzner (Germany and Finland): hosting, storage, processing servers and delivery of results.
- Google Cloud (Finland, Belgium and the Netherlands): temporary processing servers.
- OVH (France, possible) and Contabo (Germany, planned): possible future processing.
- Brevo (EU): all our email: service emails, contact-form messages and the newsletter.
- Umami Cloud: cookieless website analytics.
P9.2 Stripe and Google (for Google Sign-In) are independent controllers. See clauses P5 and P10.
P9.3 Maps, elevation and weather data. When you use maps (for example the flight planner or coverage map), your browser loads map images, elevation and weather data directly from third-party map and data providers. They receive your IP address and the map area or coordinates that you request, under their own privacy policies. Some are outside the EU. We do not send them your account data or your images.
P9.4 We may share data with professional advisers under confidentiality, and with authorities where the law requires it (clause P14).
P10. International transfers
P10.1 We store and process Customer Content and our account data in the EU.
P10.2 Outside the EU/EEA:
- Umami Cloud (USA): analytics data, which is aggregated and pseudonymised. Safeguard: the EU Standard Contractual Clauses in Umami's data processing agreement.
- Stripe (Sold through Link, LLC, USA, and Stripe group companies in Ireland and elsewhere): payment data that you give at checkout. Stripe is an independent controller and uses its own transfer safeguards, described in its privacy notice.
- Google (Google Sign-In): if you choose it, Google receives sign-in data under its own privacy policy. For EEA users the controller is Google Ireland Limited. Google may transfer data internationally under its own safeguards.
- Map and data providers (clause P9.3): your IP address and the coordinates you request. Some providers are outside the EU.
- Customers outside the EU/EEA: when you download your own data to a country outside the EU/EEA, this can be a transfer. The DPA (clause D10) covers it.
P10.3 You can ask us for a copy of the safeguards (agne@gijahub.com).
P11. How long we keep data
| Data | How long |
|---|---|
| Account data (email, password hash, Google account ID if linked) | Until your account is closed. We then delete it from our active systems within 30 days. |
| Job and usage records | As long as your account exists, then deleted with the account. |
| Customer Content (uploaded images, results, share links) | 30 days for Basic and 365 days for Full Service, counted from the job's creation. We delete it from our active systems within 30 days after the storage period ends, after your account is closed, or after your deletion request. |
| Client Gallery details (password, text you wrote) | Until you delete the gallery, or until your account is closed. A location drops out of the gallery when its results expire. |
| Security logs (IP addresses, sessions, events) | 90 days |
| Payment and accounting records | As long as accounting law requires |
| Client Gallery visitor session (hashed token) | 8 hours |
| Client Gallery wrong-attempt record (IP address, count) | Until the visitor enters the correct password or the gallery is deleted |
| Contact-form messages and support emails | 2 years |
| Newsletter subscription | Until you withdraw your consent |
| Database backups | See clause P11.1 |
P11.1 Backups.
- The files you upload and the result files (images, orthophotos, point clouds, models and other outputs) are not included in our backups.
- Our database backups are snapshots of account data. They can contain email addresses, IP addresses, session records, job records and Client Gallery details, including gallery passwords and the text you wrote in a gallery.
- We keep database backups for operational recovery, for as long as we need them for that purpose, and no longer. They are access-restricted. We never restore a backup for any purpose other than disaster recovery.
- If data that was deleted at your request is ever restored from a backup, we delete it again.
P12. Security
P12.1 We protect personal data with technical and organisational measures that suit the risk. Examples: TLS encryption in transit, hashed passwords, limits on wrong password attempts, random unguessable link tokens, firewall rules, restricted and logged administrative access to production systems, and independent external monitoring of availability. The full list for Customer Content is in Annex II of the DPA.
P12.2 Share links are bearer links. Anyone who has the link can download the files. Keep them private.
P13. Personal data breaches
P13.1 If a personal data breach affects data for which you are the controller (Customer Content), we tell you without undue delay, and within 24 hours of becoming aware.
P13.2 If a breach affects data for which we are the controller, we notify the Lithuanian supervisory authority within 72 hours where the law requires it, and we tell affected people without undue delay where there is a high risk to them.
P14. Legal requests
P14.1 We give personal data to an authority or a third party only where a valid, binding legal order requires it. We check the request, disclose only what is required, and tell the affected customer before we disclose, unless the law forbids it. Terms clause T17 gives the details.
P15. Your rights
P15.1 Under the GDPR you have the right to:
- Access: to see what data we hold about you (Art. 15);
- Rectification: to have wrong data corrected (Art. 16);
- Erasure: to have data deleted (Art. 17);
- Restriction: to limit processing in some cases (Art. 18);
- Portability: to receive your data in a machine-readable format (Art. 20);
- Object: to object to processing based on legitimate interest (Art. 21);
- Withdraw consent: at any time, for processing based on consent, without effect on earlier processing (Art. 7(3)).
P15.2 To use your rights, including account deletion, write to agne@gijahub.com. We reply within one month (Art. 12(3) GDPR). We may extend this by up to two more months for complex requests, and we then tell you why.
P15.3 We may ask for proof of identity.
P16. If you appear in a drone image
P16.1 Drone images can show people, vehicles and property. The operator who uploaded the images (our customer) is the controller of those images. We process them for the operator as its processor.
P16.2 To use your rights over an image, contact the operator first. If you do not know who it is, write to agne@gijahub.com. We cannot answer requests about Customer Content ourselves, but we will pass your request to the customer and help it respond (DPA, clause D6).
P17. Automated decisions and profiling
P17.1 We do not make automated decisions, and we do not profile you, in a way that has legal or similarly significant effects on you.
P18. Complaints
P18.1 If you think we process your data in breach of the GDPR, you can complain to the Lithuanian supervisory authority, or to the authority in your own country:
Valstybinė duomenų apsaugos inspekcija (VDAI)
L. Sapiegos g. 17, Vilnius, Lithuania
vdai.lrv.lt
P19. Age
P19.1 The Service is for people aged 18 or over. We do not knowingly collect data about children.
P20. Changes to this policy
P20.1 We update this policy if our practices change. We tell you by email at least 30 days before material changes take effect, and we publish the new version with its version date. Earlier versions are available on request at agne@gijahub.com. A new version applies to existing accounts 30 days after we email the notice, and to new accounts when they accept it.