Privacy notice

Last updated Oct 23, 2026.

Controller

Christoph Ploner, Georg Hahnekampstraße 13, 7000 Eisenstadt, Austria · contact form

Our product data

The list we sell is company-level: it contains building-level information taken from public datasets of the City of New York (Department of Buildings facade filings, job filings, permits and violations, HPD registration data, PLUTO): address, BIN, block and lot, the status and date of the facade report, the name and business address of the inspection firm that filed it, sidewalk shed and scaffold permits with the permit holder's company name, contractor company names from earlier facade permits, facade-related violations, the owner entity and the managing agent company, floors, year built, units, building front and coordinates, and estimates of penalty exposure and job size derived from these data. We do not include the names of individual people: inspectors, applicants, filing representatives and owners' representatives named in DOB filings are never shown; inspection firms and contractors appear only under their business name; owners that are individuals are shown as "Individual owner" without a name or address, and personal names of HPD contacts are not included. We do not include personal phone numbers or personal e-mail addresses, and we do not buy data from data brokers. An inspection firm can ask us to hide its name in the contractor list.

Contacting facade contractors

We contact facade contractors (restoration, masonry and sidewalk shed firms) at business e-mail addresses published on the firm's own website, and by postcard to the business address, to offer our service (legitimate interest, Art. 6(1)(f) GDPR: business-to-business marketing of a service relevant to the firm's professional activity). Source of the firm information: public Department of Buildings permits (business name, license type and the number of facade jobs and sheds since 2024) and the firm's own website. Data processed: firm name, business address, name and role of the owner or managing partner where published on the firm's own website, business e-mail address, the web page where it is published, the number of facade permits and sheds in recent years. We do not use private e-mail addresses or data brokers. You can object at any time by using the unsubscribe link in our e-mail, or through our contact form; we then stop all further messages immediately and keep only a suppression entry (the e-mail address) so that we do not contact you again. Data is stored for as long as needed for this purpose, at most 24 months.

Free update by e-mail

If you ask for the free update for a borough, we store your business e-mail address, the boroughs you chose, the time of sign-up and confirmation, the campaign parameters of the link that brought you to our site (for example utm_source=newsletter) and when we last sent you the update. We send a confirmation link first (double opt-in); nothing else is sent until you click it, and unconfirmed sign-ups are deleted after 30 days. To limit abuse we count sign-ups per network for 24 hours using a keyed one-way hash of the IP address; the IP address itself is not stored. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the one-click unsubscribe link in every e-mail or through our contact form. After you unsubscribe we keep only a suppression entry so that you are not signed up again by mistake.

"Already taken" reports

If you mark a case as "Already taken" in the subscriber area, we store the building, the time, your account (and the team member who clicked) and, if you enter one, a short reason. We use this to hide the case for your firm, to re-check it and, if several subscribers report the same case, to mark or remove it for everyone (performance of the contract, Art. 6(1)(b) GDPR, and our legitimate interest in an accurate list, Art. 6(1)(f) GDPR). Other subscribers never learn who reported a case. Reports are deleted together with your work data (see "Retention").

Contact form

If you write to us through our contact form (facaderepairradar.com/contact.php), we store your name, firm, business e-mail address, the topic, your message, the time and the campaign parameters of the visit, and forward a copy to our own mailbox so that we can answer you by e-mail. Purpose: answering your request. Legal basis: your request and, where it concerns a plan or a reservation, steps prior to or the performance of a contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR). Messages are deleted 12 months after receipt, unless they are needed for an ongoing plan or a legal claim. To limit misuse we keep a one-way hash of the sending IP address for 24 hours (legitimate interest, Art. 6(1)(f) GDPR).

Reservations

While online checkout is not active, you can reserve a package with a form. We store the package, your firm name, your business e-mail address, the time of the request and the campaign parameters of the visit, send you one confirmation e-mail and a copy to our own mailbox, and later send you the payment link. Legal basis: steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR). A reservation is deleted 12 months after the request unless it becomes a purchase. To limit misuse we keep a one-way hash of the sending IP address for 24 hours (legitimate interest, Art. 6(1)(f) GDPR).

Links in our postcards, letters and e-mails; “E-mail me the free cases”

The QR codes and short links (facaderepairradar.com/k/…) in our postcards and letters, and the links in our e-mails, carry a campaign label and a firm number from our own list (for example utm_content=f0002), never a name. When you open such a link, our cookieless counter stores this number with the page view, so we can see which contacted firm looked at the free cases - without asking for your e-mail address. Legal basis: our legitimate interest in measuring our business-to-business marketing (Art. 6(1)(f) GDPR); statistics are kept for 24 months (see “Statistics”).

If you use “E-mail me the free cases” on a postcard page, we send exactly one e-mail with the free cases you asked for (link and PDF) to the address you enter. We do not add the address to any list and do not store it in plain text: to prevent repeated sending we keep a keyed one-way hash of the address and the borough for 7 days, and a keyed hash of your IP address for 24 hours. The monthly update is only sent if you sign up for it separately and confirm by e-mail (double opt-in, see above). Legal basis: your request (Art. 6(1)(b) GDPR).

Feedback, quotations and earlier free test access

In the subscriber area you can give feedback ("How is it going?"): a star rating, optionally one sentence of up to 300 characters and your choice whether we may quote you. We store the rating, your text, your choice, the time, your firm's subscription and the name under which you appear in your team (for a quotation with name also the name, role and firm you enter; for an anonymous quotation the role and borough you enter). We use it to improve the service; legal basis: our legitimate interest in learning how the service works for customers (Art. 6(1)(f) GDPR). We publish a quotation on our website only with your consent (Art. 6(1)(a) GDPR), in your own words (shortened at most) and in the form you chose (named, or anonymously with role, "facade contractor" and borough, plus the month). Quotations from firms that received free test access always carry the note "Received free test access in exchange for feedback". You can withdraw consent at any time through our contact form; we then remove the quotation from the website without undue delay. Feedback that is not published is deleted together with your work data (see "Retention"); published quotations stay until you withdraw them. To show the feedback box at most once every 30 days we store, per access link, when it was last shown or closed. We send one reminder e-mail about the feedback six weeks after the start of access.

Until October 23, 2026 firms could apply on our website for free test access. We no longer accept applications. From earlier applications we still hold the firm name, business e-mail address, the borough named, the time and the campaign parameters of the visit (steps prior to a contract at your request, Art. 6(1)(b) GDPR); applications that did not lead to an account are deleted 12 months after the application, and the separate list used to count places is deleted after 30 days. For a firm that received free test access we keep the same account record as for customers (see below), marked as free test access with its start and end date. In the first two weeks of a subscription we send up to three short getting-started e-mails (day 2 only if the list has not been opened, day 7, day 14) as part of the service; each has a one-click link to stop them.

Customers (account and billing)

For plans we are the controller of your account and billing details: firm, business e-mail address, package, payment references and the dates of purchase, renewal, end, cancellation or refund (Art. 6(1)(b) GDPR). We keep accounting records as required by Austrian law (7 years); this account record therefore stays after the end of a plan, without your work data. Once online checkout is live, payments are handled by our payment provider Paddle.com acting as merchant of record. We send you the e-mails that belong to your plan (access link, weekly e-mail with new and closed cases, follow-up reminders you set, renewal notice 15 to 30 days before renewal) and, in the free basic plan, a short e-mail about every four weeks with its cases (each of these e-mails has a one-click link to stop them; we then store the date you switched them off). For the referral bonus (terms, section 5e) we store your referral code and, for a firm that bought through a referral link, which account referred it, the result and the bonus months granted; the referring customer is told only that a referred firm paid, not which one (Art. 6(1)(b) GDPR). For the basic plan we store the date of the account owner's last visit, to end an unused basic plan after 12 months, and the borough chosen (Art. 6(1)(b) GDPR). If you tell us through the subscriber area that you won a job or send us feedback, we store the message with the building, the note and the name of the team member who sent it, to improve the product (legitimate interest, Art. 6(1)(f) GDPR); we quote it publicly only with your permission.

Your work data and team members: we act as your processor

What you and your team enter in the subscriber area is your data: statuses, notes, follow-up dates and notes, assignments, the activity history, saved views and the names and business e-mail addresses of team members (with the dates of invitation and last visit and whether the product tour was completed). The account owner can add up to 10 colleagues. For this data you, the subscribing firm, are the controller, and we process it only as your processor under Art. 28 GDPR on the basis of section 8 of our Terms, which form the data processing agreement. We therefore do not rely on legal bases of our own for it and use it for no other purpose. If you choose so, we send a team member one invitation e-mail with a personal access link; changes in the shared work list are shown with the member's name so your team can see who did what. Removing a team member deactivates the link immediately and removes the member from the team list; names in the case history remain until the plan ends. Please do not enter personal contact details of building owners, residents or managing agents' staff, or other sensitive information.

Retention after the end of a plan

When a plan or earlier free test access ends (expiry or cancellation), the account owner keeps a free basic plan (Terms, section 5d) and the work list is kept; team members are removed 30 days after the basic plan starts. The basic plan ends after 12 months without a visit, at your request or after a termination for good cause. 30 days after the basic plan ends, or 30 days after a refund (no basic plan), your work data is deleted: work list, notes, follow-ups, "Already taken" reports, activity history, saved views and all team members, together with names and notes in our activity logs and feedback that was not published. Within the same 30 days it is also removed from the backups on our server, and the encrypted weekly backup copies (see below) are deleted after 30 days. Your account and billing record stays as described above. You can export your list at any time before the end.

Website and statistics

This website uses no cookies and no third-party tracking. To see how many people visit and which samples are downloaded, we count page views and clicks on sample, pricing and contact links with our own script on our own web hosting (Hostinger, EU). We store the time, the page, the borough or package in the link, campaign parameters in the link, the referring website (domain only), the device type and a visitor ID that is a one-way hash of a daily changing random value, your IP address and browser. The IP address itself is not stored, and the ID cannot be traced back once the day has changed. Campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term) are kept in your browser's local storage (not a cookie) for 30 days and then deleted (a new campaign link replaces them), so that we can count which e-mail campaign led to a sample download, a sign-up, a reservation or a purchase; they are passed to our payment provider as part of the order. If you open the website through a customer's referral link (?ref=…), the referral code is kept the same way in local storage for 30 days and passed with a reservation or the order, so that the referring customer can receive the referral bonus (terms, section 5e). Legal basis: legitimate interest in measuring our marketing (Art. 6(1)(f) GDPR). Statistics are kept for 24 months. In the subscriber area your browser's local storage remembers whether you have seen the product tour. Nothing else is stored in your browser. Our hosting provider also processes server log data for security purposes. The map in the subscriber area loads map images from OpenStreetMap servers, which receive the viewer's IP address.

Hosting, operation and backups

The website and the subscriber area run on Hostinger web hosting (EU), which also delivers our customer e-mails. Weekly data runs, daily checks and backups run on our own server, a virtual server rented from Hostinger in a data centre in the EU (Vilnius, Lithuania). A daily backup of customer, team and work-list data is kept on that server for 30 days. In addition, an encrypted weekly backup of the same data (AES-256; the key is held only by us) is stored in the owner's Google Workspace/Gmail account (Google Ireland Limited), delivered there as an e-mail attachment and deleted after 30 days; without the key the backup cannot be read.

Sub-processors and recipients

Sub-processors for subscribers' work data and team members (section 8 of the Terms): Hostinger International Ltd. (web hosting, customer e-mail delivery, virtual server in Lithuania); Google Ireland Limited (storage of the encrypted weekly backup in the owner's Google Workspace/Gmail account). Recipients of account and billing data: the payment provider as merchant of record and independent controller (Paddle.com Market Ltd.), Hostinger (hosting, e-mail). Copies of reservations and feedback are sent to the controller's own Gmail mailbox. Map images in the subscriber area: OpenStreetMap, which receives the viewer's IP address. For our own outreach to facade contractors (see above; we are the controller, not part of any subscription) we plan to use Google Workspace (mailbox for our sending domain) and Instantly (sending of outreach e-mails), and a print and mail service (Lob.com, Inc. or PostGrid Inc.) that receives the firm name, business address and the printed content of our postcards and letters in order to print and post them; none of these is set up yet, and subscribers' work data is never passed to these services. Where data is transferred to the United States, this is based on the EU-U.S. Data Privacy Framework or standard contractual clauses.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. For work data and team members in a subscription, please contact the subscribing firm as controller; we support it in answering your request. You can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at). Companies that appear in our public samples can ask to be removed from them through our contact form.