gardmi 🇦🇪 مخطط قطعة الأرض

Privacy Policy

Version dated 13 September 2026.

1. General

1.1. This Privacy Policy (the "Policy") describes what data the gardmi service (the website gardmi.com and the web application, the "Service") collects, why, for how long, with whom it is shared, and what rights the User has.

1.2. Data controller: 3 Krolika LLP, BIN 251240001464, address: 010000, Republic of Kazakhstan, Astana, Taras Shevchenko Street 4/1, unit 17, participant of the Astana Hub international technopark (the "Controller", "we"). Contact for data-protection matters: support@gardmi.com.

1.3. The Policy takes into account the Law of the Republic of Kazakhstan "On Personal Data and Their Protection", Regulation (EU) 2016/679 (GDPR), UK GDPR, the CCPA/CPRA (California) and, to the extent applicable to users in the Russian Federation, Federal Law No. 152-FZ.

1.4. By using the Service you confirm that you have read this Policy. Where the law requires consent to processing (including cross-border transfer), starting to use the Service, entering your email or uploading files constitutes such consent. Consent may be withdrawn (section 9).

2. Data we collect

2.1. Data you provide

  • Email — when signing in with a one-time code; it is the only Account identifier. Passwords are not used or stored.
  • Projects — plans of plots, houses and utilities, objects, notes, version history, settings (country, units, language).
  • Uploaded files — underlays (scans, topographic surveys, photos, images), DXF/SVG/PDF/JSON/.plan files, 3D models (GLB) and project previews.
  • Geodata — address, coordinates, cadastral number if you use the map or plot search. These can identify the location of real property — do not enter them if you do not want them stored in the Project.
  • AI assistant prompts — the text of your requests and a description of the Project scene sent to the model.
  • Support inquiries — message content and contact details.

2.2. Data collected automatically

  • Owner identifier (cookie gardmi_owner) — a random token linking anonymous Projects to the browser. It contains no personal details.
  • Essential cookies — session, CSRF protection, selected language/country, editor settings (including browser localStorage).
  • Browser and device data, request timestamps — in server logs and error reports. The full IP address is not stored: server logs truncate it (last IPv4 octet / IPv6 tail zeroed); for sign-in brute-force protection and rate limiting only an irreversible keyed hash of the address and the truncated address are kept; IP is not sent to error reports.
  • Web analytics — anonymised visit statistics (pages, sources, device, region) collected by Yandex.Metrica via its cookies.

2.3. We do not request or knowingly collect special categories of data (health, biometrics, religion, etc.), payment details (there are no paid features) or children's data. Do not upload such data or third-party personal data without a lawful basis.

3. Purposes and legal bases

  • Providing the Service: creating and storing Projects, autosave, versions, export, share links, Account sign-in, AI assistant, maps and cadastre — performance of a contract (the Terms of Service).
  • Security: preventing abuse, code brute-forcing, DDoS; incident investigation — legitimate interest.
  • Reliability and improvement: error diagnostics, feature usage statistics, analytics — legitimate interest; analytics cookies — consent where required.
  • Communication: sign-in codes, support replies, notices of material changes — performance of a contract and legitimate interest.
  • Legal obligations: responding to lawful requests of authorities, record-keeping, defending legal claims.

We do not sell personal data and do not use it for automated decision-making with legal effects on you. No marketing emails are sent without your consent.

4. Sharing with third parties

4.1. We engage contractors (processors) that receive only the data needed for their function and are bound by confidentiality obligations:

  • Hosting and infrastructure (Timeweb, Russian Federation) — application servers and databases. Individual contractors may be located in the Republic of Kazakhstan and other countries.
  • Object storage (Timeweb Cloud, Russian Federation) — Project previews and uploaded files.
  • AI model providers (including DeepSeek via API intermediaries) — receive the prompt text and the Project scene description to produce the assistant's reply. We do not send them your email and do not use your data to train our own models; providers' terms may differ — do not include confidential information in assistant prompts.
  • Map providers (Esri, Google Maps, Yandex Maps) and state cadastral registries — when loading a map or searching for a plot, your browser or our server contacts them; providers see the IP address, the requested map area, the address/cadastral number. Their own policies apply.
  • Web analytics — Yandex.Metrica (Yandex LLC, Russia).
  • Error monitoring — self-hosted Sentry (error reports, browser, fragments of page state; no IP or cookies).
  • Email delivery — a mail provider for sign-in codes and notifications.

4.2. Data may be disclosed upon a lawful request of competent authorities, to protect our rights and the rights of third parties, and to a successor in a reorganisation or sale of the business (subject to this Policy).

4.3. Public Projects and share links. If you enable public access or pass on a link, the Project content (including uploaded underlays and geodata) is visible to anyone with the link. You manage this yourself in the Project settings.

4.4. Cross-border transfers. As our contractors are located in different countries, your data may be transferred outside your country, including to countries without an adequacy decision. We apply contractual safeguards (including standard contractual clauses where required) and technical protection measures. By using the Service you consent to such transfers to the extent necessary to operate the Service.

5. Retention

  • Account and Projects — while the Account is active; after more than 12 months of inactivity the Account and Projects may be deleted.
  • Anonymous Projects — while the owner cookie is valid; after more than 6 months of inactivity they may be deleted.
  • Version history — the last 20 auto-versions of a Project are kept automatically; older ones are deleted automatically. Manual versions are kept with the Project.
  • Sign-in codes and attempts (email, hashed and truncated IP) — up to 30 days.
  • Server logs and error reports — up to 90 days.
  • Projects you deleted — 30 days in the trash (restorable), then permanently deleted together with their files.
  • AI assistant prompts — not stored on our servers beyond processing time; the conversation history is kept in your browser. Exception: if the assistant reports a failure or an unsupported request, the current conversation (without your email) is stored as a report for the developers until the issue is resolved, but no longer than 12 months. Retention by model providers is governed by their policies.
  • Backups — up to 30 days after deletion from the primary database.
  • Support correspondence — up to 3 years to defend legal claims.

6. Data protection

We use encrypted connections (HTTPS), restricted access to servers and databases, secured cookies (Secure, HttpOnly, SameSite), rate limiting of sign-in codes, regular updates and monitoring. No method of transmission or storage is completely secure; in the event of an incident posing a high risk to your rights we will notify you and the supervisory authority within the periods set by law.

7. Cookies and analytics

7.1. Essential cookies: session, CSRF token, the owner cookie for anonymous Projects, language/country. The Service does not work without them; no consent is required.

7.2. Analytics cookies: Yandex.Metrica for anonymised statistics. You can disable it in your browser (blocking third-party cookies, extensions) and via the provider's tool: Yandex.Metrica opt-out.

7.3. Browser localStorage / IndexedDB are used for editor settings, drafts and cache; this data does not leave your device except when a Project is autosaved to the server.

7.4. The "Do Not Track" signal is not fully standardised; we do not respond to it but respect your browser cookie settings.

8. Your rights

8.1. You have the right to: access your data and obtain a copy; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; object to processing based on legitimate interest; receive data in a machine-readable format (JSON export of a Project is available in the editor); withdraw consent; lodge a complaint with a supervisory authority (in Kazakhstan — the authorised body for personal data protection; in the EEA — your national supervisory authority; in the UK — the ICO).

8.2. Send requests to support@gardmi.com from the email address linked to your Account. We respond within 30 calendar days (extendable in cases provided by law, with notice).

9. Account and data deletion

9.1. You can delete your Account in the Account settings. This deletes the Account, Projects, versions, previews and uploaded files. Copies in backups are removed within 30 days. Data we are required to retain by law (for example, to defend a claim) may be kept for the necessary period with restricted access.

9.2. Anonymous Projects are deleted by the User from the project list; after clearing cookies access to them is lost and they will be deleted after the inactivity period.

9.3. Withdrawal of consent does not affect the lawfulness of processing before withdrawal and may make further use of the Service impossible.

10. Children

The Service is not intended for persons under 18 and we do not knowingly collect their data. If you become aware that a child has provided us with data, contact support@gardmi.com and we will delete it.

11. Users in the EEA and UK (GDPR)

Legal bases are set out in section 3. Transfers outside the EEA/UK are made in accordance with section 4.4. You may exercise your rights under Articles 15–22 GDPR via support@gardmi.com. No EU/UK representative has been appointed due to the limited scale and occasional nature of processing (Article 27(2) GDPR); this will be updated if circumstances change.

12. California users (CCPA/CPRA)

In the past 12 months we have collected the categories of data described in section 2 (identifiers, internet activity, region derived from a truncated IP, user-entered geodata and content). We do not sell or "share" personal information for cross-context behavioural advertising. You have the right to know what data is collected, to request its deletion and correction, and not to be discriminated against for exercising your rights. Requests: support@gardmi.com.

13. Users in the Russian Federation

Personal data of Russian citizens is processed with regard to the requirements of Federal Law No. 152-FZ. Servers storing Projects and Account data may be located in the Russian Federation. By continuing to use the Service you consent to processing for the purposes in section 3 and to cross-border transfer to the contractors listed in section 4, including to the Republic of Kazakhstan and other countries. Consent may be withdrawn by email to support@gardmi.com.

14. Changes to the Policy

We may amend this Policy; the new version is published on this page with its date. We will notify you of material changes on the website or by email. Continued use of the Service constitutes acceptance of the new version.

15. Governing law

This Policy is governed by the laws of the Republic of Kazakhstan, subject to mandatory data-protection rules of the User's country. Disputes are resolved as set out in the Terms of Service.

16. Contacts

3 Krolika LLP, BIN 251240001464
010000, Republic of Kazakhstan, Astana, Taras Shevchenko Street 4/1, unit 17
Participant of the Astana Hub international technopark
Email: support@gardmi.com