This Privacy Policy describes how WaddleWare ("we", "us", or "our") collects, uses, and protects your personal information when you use TrueSight at truesight.waddleware.eu (the "Service").

1. Data We Collect

Data Type	Purpose	Retention
Username, Email, Password (hashed)	Account authentication and management	Until account deletion
Organization name, ID, and member roles	Team collaboration and access control	Until organization/account deletion
Project data (JSON, camera placements, wiring, obstacle drawings)	Cloud project storage and rendering	Until project or account deletion
Uploaded floor plans (JPEG, PNG, WebP)	Interior mapping and scale calibration	Until project or account deletion
Invitation emails and tokens	Organization and read-only project sharing	Until acceptance, expiration, or deletion
Subscription status & Stripe Customer ID	Billing and feature access gating	Until account deletion
IP address & request logs	Security, rate limiting, and fraud prevention	Session / log rotation (max 12 months)

1.1 Data We Do NOT Collect

• Credit card numbers or full payment details (handled exclusively by Stripe).
• Device fingerprints or advertising identifiers.
• Real-time location data beyond what you explicitly enter as map coordinates or upload as floor plans.
• Browsing history outside of the Service.

2. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the TrueSight Service.
• Process transactions and manage your subscription.
• Enable collaboration features (e.g., sending organization invitations or read-only links).
• Send service-related announcements (e.g., security updates, changes to Terms).
• Prevent fraud, abuse, and unauthorized access.

3. Data Sharing & Third-Party Services

We do not sell your personal information to third parties. We only share data with trusted third-party service providers necessary to operate the Service:

Service	Purpose	Privacy Policy
Stripe	Secure payment processing	stripe.com/privacy
OpenStreetMap / Nominatim	Geocoding, location search, and map tiles	osmfoundation.org
SMTP / Email Delivery Provider	Sending password resets and invitation emails	Depends on configured provider

When you use the Service, your IP address may be transmitted to these providers as part of normal map tile loading or geocoding operations. We do not control these providers' data practices.

4. Data Security

We implement industry-standard security measures to protect your data:

• Password Hashing: Passwords are processed using PHP's password_hash() (bcrypt) and are never stored in plaintext.
• Encryption: All data in transit is encrypted via HTTPS.
• Database Security: We use PDO prepared statements to prevent SQL injection, and the SQLite database is stored outside the public document root where possible.
• Session Hardening: Cookies use HttpOnly, Secure (where HTTPS is enabled), and SameSite=Strict settings.

5. Your GDPR Rights

As a user in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): You may delete your account at any time, which triggers erasure of your personal data from our systems.
• Right to data portability: You may request an export of your project data as JSON files at any time using the built-in Export feature, or by contacting us.
• Right to restriction of processing / Right to object: You may request that we restrict or object to the processing of your data in certain circumstances.

To exercise any of your GDPR rights, contact us at privacy@waddleware.eu. We will respond within 30 days. Account deletion can be performed directly within the app via the Account Dashboard.

6. Cookies & Session Storage

TrueSight uses the following browser storage mechanisms:

• Session cookie (PHPSESSID): Strictly necessary for authentication. This is an HttpOnly, SameSite=Strict cookie.
• Remember-me cookie: Optional persistent session cookie, securely hashed, to keep you logged in across browser restarts.

We do not use tracking cookies, analytics cookies, or any third-party advertising cookies. No consent banner is required for strictly necessary cookies under the ePrivacy Directive.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law. If you delete your account, your personal data and projects will be permanently removed from our active systems within 30 days.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last Updated" date at the top of this page and, where practicable, by displaying a notice within the application or sending an email to your registered address.

9. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

WaddleWare
Email: truesight@waddleware.eu
Website: truesight.waddleware.eu

Operated by Martin Rakús – Martin's photography • IČO: 51934418 • Halalovka 2402/56, 911 08 Trenčín, Slovakia • support@waddleware.eu