gardmi 🇵🇱 Planista działki ogrodowej

Privacy Policy

Version dated 27 October 2026.

1. General

1.1. This Privacy Policy (the "Policy") describes what data the gardmi service (the website gardmi.com and the web application, the "Service") collects, why, for how long, with whom it is shared, and what rights the User has.

1.2. Data controller: Individual entrepreneur Ivan Vyacheslavovich Vaskov, INN 661103103710 (the "Controller", "we"). Contact for data-protection matters: support@gardmi.com.

1.3. The Policy takes into account Russian Federal Law No. 152-FZ on personal data and, where applicable, mandatory data-protection rules of the User’s country, including Regulation (EU) 2016/679 (GDPR), UK GDPR and the CCPA/CPRA (California).

1.4. This Policy explains data processing and is not itself consent. Data needed for sign-in, Project storage, fulfilling your requests and payments is processed to perform the contract or comply with legal obligations (section 3). Where a separate purpose requires consent, that consent must be specific, verifiable and recorded separately from the Terms of Service and this Policy. Merely visiting the website, entering an email or uploading a file does not replace such consent. Withdrawal is described in section 9.

2. Data we collect

2.1. Data you provide

  • Email — when signing in with a one-time code; it is the only Account identifier. Passwords are not used or stored.
  • Projects — plans of plots, houses and utilities, objects, notes, version history, settings (country, units, language).
  • Uploaded files — underlays (scans, topographic surveys, photos, images), DXF/SVG/PDF/JSON/.plan files, 3D models (GLB) and project previews.
  • Geodata — address, coordinates, cadastral number if you use the map or plot search. These can identify the location of real property — do not enter them if you do not want them stored in the Project.
  • AI assistant prompts — the text of your requests and a description of the Project scene sent to the model.
  • Support inquiries — message content and contact details.
  • gardmi Pro subscription and payments — plan, period, dates, amounts and payment statuses, order contents and the Robokassa payment identifier. You enter full card details on the Robokassa page; they are not sent to us.

2.2. Data collected automatically

  • Owner identifier (cookie gardmi_owner) — a random token linking anonymous Projects to the browser. It contains no personal details.
  • Essential cookies — session, CSRF protection, selected language/country, editor settings (including browser localStorage).
  • Browser and device data, request timestamps — in server logs and error reports. The full IP address is not stored: server logs truncate it (last IPv4 octet / IPv6 tail zeroed); for sign-in brute-force protection and rate limiting only an irreversible keyed hash of the address and the truncated address are kept; IP is not sent to error reports.
  • Web analytics — anonymised visit statistics (pages, sources, device, region) collected by Yandex.Metrica via its cookies.

2.3. We do not request or knowingly collect special categories of data (health, biometrics, religion, etc.), full payment details (card number, CVC — they are processed by the payment service) or children's data. Do not upload such data or third-party personal data without a lawful basis.

3. Purposes and legal bases

  • Providing the Service: creating and storing Projects, autosave, versions, export, share links, Account sign-in, AI assistant, maps and cadastre — performance of a contract (the Terms of Service).
  • Security: preventing abuse, code brute-forcing, DDoS; incident investigation — legitimate interest.
  • Reliability and improvement: error diagnostics, feature usage statistics, analytics — legitimate interest; analytics cookies — consent where required.
  • Communication: sign-in codes, support replies, notices of material changes — performance of a contract and legitimate interest.
  • Payments and subscription: taking one-time payments and issuing receipts — performance of a contract; accounting and tax records — legal obligation.
  • Legal obligations: responding to lawful requests of authorities, record-keeping, defending legal claims.

We do not sell personal data and do not use it for automated decision-making with legal effects on you. No marketing emails are sent without your consent.

4. Sharing with third parties

4.1. We engage contractors (processors) that receive only the data needed for their function and are bound by confidentiality obligations:

  • Hosting and infrastructure (Timeweb, Russian Federation) — application servers and databases.
  • Object storage (Timeweb Cloud, Russian Federation) — Project previews and uploaded files.
  • AI model providers (including DeepSeek and Google Gemini via API intermediaries) — receive the prompt text and the Project scene description to produce the assistant's reply. We do not send them your email and do not use your data to train our own models; providers' terms may differ — do not include confidential information in assistant prompts.
  • AI rendering (TTAPI and the connected FLUX model) — when you request a render, they receive the source view image, prompt and necessary scene information. Do not include other people's personal data or confidential material without a lawful basis. Provider processing and retention are governed by their agreements and policies.
  • Map providers (Esri, Google Maps, Yandex Maps) and state cadastral registries — when loading a map or searching for a plot, your browser or our server contacts them; providers see the IP address, the requested map area, the address/cadastral number. Their own policies apply.
  • Web analytics — Yandex.Metrica (Yandex LLC, Russia), only on public pages after separate permission. Session replay is disabled; the counter is not loaded in the editor or private account pages.
  • Error monitoring — self-hosted Sentry (error reports, browser, fragments of page state; no IP or cookies).
  • Email delivery — a mail provider for sign-in codes and notifications.
  • Payment service Robokassa — robokassa.ru (Russia). It receives the amount, description, invoice number and the email for the receipt; you enter card details on its page. Its own policy applies.

4.2. Data may be disclosed upon a lawful request of competent authorities, to protect our rights and the rights of third parties, and to a successor in a reorganisation or sale of the business (subject to this Policy).

4.3. Public Projects and share links. If you enable public access or pass on a link, the Project content (including uploaded underlays and geodata) is visible to anyone with the link. You manage this yourself in the Project settings.

4.4. Cross-border transfers. When you use AI features, external maps and other third-party services listed in section 4, requests and data needed to respond may be processed by foreign providers outside Russia. Storing the primary Account and Project data in Russia does not mean that all processing by external providers takes place in Russia. Cross-border transfers require the legal bases and safeguards prescribed by applicable law; reading this Policy does not replace those bases, separate consent where required, or mandatory notifications to competent authorities.

5. Retention

  • Account and Projects — while the Account is active; after more than 12 months of inactivity the Account and Projects may be deleted. While a gardmi Pro subscription is active, the Account and Projects are not deleted for inactivity.
  • Anonymous Projects — while the owner cookie is valid; after more than 6 months of inactivity they may be deleted.
  • Version history — the last 20 auto-versions of a Project are kept automatically (100 with gardmi Pro); auto-versions older than 30 days are deleted automatically, a few latest versions always remain. Up to 100 latest manual versions of a Project are kept; saving a new version above this limit deletes the oldest one.
  • Sign-in codes and attempts (email, hashed and truncated IP) — up to 30 days.
  • Server logs and error reports — up to 90 days.
  • Projects you deleted — 30 days in the trash (restorable), then permanently deleted together with their files.
  • Payment records — 5 years after the payment (accounting, tax and dispute resolution).
  • AI assistant prompts — not stored on our servers beyond processing time; the conversation history is kept in your browser. Exception: if the assistant reports a failure or an unsupported request, the current conversation (without your email) is stored as a report for the developers until the issue is resolved, but no longer than 12 months. Retention by model providers is governed by their policies.
  • AI render history — source images, results, prompts and scene descriptions are stored on our servers with the Project. Deleting a render or permanently deleting the Project/Account removes these records and files from primary storage; backups expire as described below.
  • Backups — up to 30 days after deletion from the primary database.
  • Support correspondence — up to 3 years to defend legal claims.

6. Data protection

We use encrypted connections (HTTPS), restricted access to servers and databases, secured cookies (Secure, HttpOnly, SameSite), rate limiting of sign-in codes, regular updates and monitoring. No method of transmission or storage is completely secure; in the event of an incident posing a high risk to your rights we will notify you and the supervisory authority within the periods set by law.

7. Cookies and analytics

7.1. Essential cookies: session, CSRF token, the owner cookie for anonymous Projects, language/country. The Service does not work without them; no consent is required.

7.2. Analytics cookies: Yandex.Metrica statistics start after you choose “Accept” in a separate notice. Refusal does not limit the Service. Change your choice using “Cookie settings” at the bottom of a public page. Session replay and page-content recording are disabled. Previously set cookies can be removed in your browser settings.

7.3. Browser localStorage / IndexedDB are used for editor settings, drafts and cache; this data does not leave your device except when a Project is autosaved to the server.

7.4. The "Do Not Track" signal is not fully standardised; we do not respond to it but respect your browser cookie settings.

8. Your rights

8.1. You have the right to: access your data and obtain a copy; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; object to processing based on legitimate interest; receive data in a machine-readable format (JSON export of a Project is available in the editor); withdraw consent; lodge a complaint with a supervisory authority (in Russia — Roskomnadzor; in the EEA — your national supervisory authority; in the UK — the ICO).

8.2. Send requests to support@gardmi.com from the email address linked to your Account. We respond within 30 calendar days (extendable in cases provided by law, with notice).

9. Account and data deletion

9.1. You can delete your Account in the Account settings. This deletes the Account, Projects, versions, previews and uploaded files. Copies in backups are removed within 30 days. Data we are required to retain by law (for example, to defend a claim) may be kept for the necessary period with restricted access.

9.2. Anonymous Projects are deleted by the User from the project list; after clearing cookies access to them is lost and they will be deleted after the inactivity period.

9.3. Withdrawal of consent does not affect the lawfulness of processing before withdrawal and may make further use of the Service impossible.

10. Children

The Service is not intended for persons under 18 and we do not knowingly collect their data. If you become aware that a child has provided us with data, contact support@gardmi.com and we will delete it.

11. Users in the EEA and UK (GDPR)

Legal bases are set out in section 3. Transfers outside the EEA/UK are made in accordance with section 4.4. You may exercise your rights under Articles 15–22 GDPR via support@gardmi.com. No EU/UK representative has been appointed due to the limited scale and occasional nature of processing (Article 27(2) GDPR); this will be updated if circumstances change.

12. California users (CCPA/CPRA)

In the past 12 months we have collected the categories of data described in section 2 (identifiers, internet activity, region derived from a truncated IP, user-entered geodata and content). We do not sell or "share" personal information for cross-context behavioural advertising. You have the right to know what data is collected, to request its deletion and correction, and not to be discriminated against for exercising your rights. Requests: support@gardmi.com.

13. Users in the Russian Federation

The primary Account and Project databases and uploaded-file storage are located in the Russian Federation (Timeweb). Processing for the Service and payments is based on the contract and legal obligations as described in section 3. The use of foreign providers is described in section 4 and does not change the Russian service provider. For data-processing inquiries or withdrawal of previously given consent, contact support@gardmi.com. Withdrawal does not end processing that has an independent lawful basis.

14. Changes to the Policy

We may amend this Policy; the new version is published on this page with its date. We will notify you of material changes on the website or by email. Publication of a new version and continued use of the Service do not replace separate consent to new processing purposes where required by law.

15. Governing law

This Policy is governed by the laws of the Russian Federation, subject to mandatory data-protection rules of the User's country. Disputes are resolved as set out in the Terms of Service.

16. Contacts

Individual entrepreneur Ivan Vyacheslavovich Vaskov, INN 661103103710
Email: support@gardmi.com

Stuknij „Udostępnij” → „Do ekranu początkowego”.