Security & data

Plain answers to the questions contractors ask before they put their notes into a new tool: where the data lives, who can see it, how you sign in, and how it is deleted. This page summarises our privacy notice and terms; where they say more, they apply.

Last updated Oct 23, 2026.

Where your data is stored

The website and the subscriber area run on Hostinger web hosting in the EU. Weekly data runs, daily checks and backups run on a virtual server we rent from Hostinger in a data centre in Vilnius, Lithuania (EU). Every page is served over HTTPS only.

What we store

• The list itself: public building data from NYC Open Data and the NYC Department of Buildings.
• Your work data: statuses, notes, follow-up dates, assignments, “Already taken” reports, saved views, the activity history, and the names and business e-mail addresses of your team members.
• Your account and billing record: firm, business e-mail address, package, payment references and the dates of purchase, renewal or refund.

Who can see it

Only your team. What you and your colleagues enter in the subscriber area is shown to the people on your account and to no other subscriber. If you mark a case as “Already taken”, other subscribers may see that a case was reported, but they never learn who reported it.

For your work data we act as your processor under Art. 28 GDPR: section 8 of our terms is the data processing agreement. We process that data only to run the service for your firm.

Signing in

• There are no passwords, so we store none. You sign in with a personal access link that we send by e-mail.
• Every team member gets their own link. The account owner can add up to 10 colleagues and remove any of them; a removed member's link stops working at once.
• Lost your link? The Log in page sends it again, and only to the e-mail address on file for that access. The page does not reveal whether an address belongs to a customer.

Backups

A daily backup of customer, team and work-list data is kept on our server for 30 days. Once a week an encrypted copy of the same data (AES-256, the key is held only by us) is stored in the operator's Google Workspace/Gmail account and deleted there after 30 days. Without the key the copy cannot be read.

How long we keep it

• When a plan ends, the account owner keeps a free basic plan and the work list stays. Team members are removed 30 days after the basic plan starts.
• 30 days after the basic plan ends (after 12 months without a visit, at your request, or after a termination for good cause), or 30 days after a refund, your work data is deleted: work list, notes, follow-ups, “Already taken” reports, history, saved views and all team members. Within the same 30 days it is also removed from the backups on our server.
• Reservations are deleted 12 months after the request unless they become a purchase.
• Your account and billing record is kept for 7 years, as Austrian accounting law requires, without your work data.
• You can export your list from the subscriber area at any time before the end.

Cookies and tracking

This website uses no cookies and no third-party tracking or analytics services. We count page views and clicks with our own small script on our own hosting. Your IP address is not stored; the visitor ID is a one-way hash that changes every day. Campaign parameters in a link (utm_…) are kept in your browser's session storage until you close the tab. The QR codes and short links (facaderepairradar.com/k/…) in our postcards and letters, and the links in our e-mails, carry a campaign label and a firm number from our own list (for example utm_content=f0002), never a name. When you open such a link, our counter stores this number with the page view, so we can see which contacted firm looked at the free cases. Visits without such a link are counted only under the daily changing visitor ID. In the subscriber area your browser only remembers whether you have seen the product tour. The map there loads map images from OpenStreetMap, which receives the viewer's IP address.

We do not sell data

We do not sell data about our customers or visitors to anyone. Your work data is used for nothing else than running the service for your firm, and it is never passed to the tools we use for our own outreach.

No personal data in the lists

The list is company-level. Inspection firms and contractors appear only under their business name. Inspectors, applicants, filing representatives and owners' representatives named in DOB filings are never shown. Owners who are individuals appear as “Individual owner”, without a name or address. There are no personal phone numbers or personal e-mail addresses, and we do not buy data from data brokers. Your building or firm is in one of our free cases and you want it removed? Use our contact form.

Payment

Online checkout is not live yet. Today you reserve a package with a form, without any payment details, and we e-mail you a payment link. Once it is live, payments are handled by our payment provider Paddle.com as merchant of record, which also issues the invoice and adds sales tax where it applies. Your card details go to the payment provider, never to us.

Sub-processors and incidents

• Hostinger International Ltd.: web hosting, customer e-mail delivery, virtual server in Lithuania.
• Google Ireland Limited: storage of the encrypted weekly backup copy.
• The payment provider receives account and billing data as merchant of record and independent controller.

We tell you before we add or replace a sub-processor, and you may object. If a personal data breach affects your data, we inform you without undue delay.

Questions

Ask us anything about security or data through our contact form. Facade Repair Radar is run by Christoph (Chris) Ploner near Vienna, Austria; the full address is in our imprint.