Privacy information

Updated 18 October 2026

Your account and models

We store your chosen name (a nickname is allowed), e-mail, password hash, saved maps, palettes and settings, plus the registration date and accepted account terms version, to provide the account service under Article 6(1)(b) GDPR. Name, e-mail and password are needed to create an account; the generator and downloads need no account. Account data is kept while the account exists. Deleting an account deletes maps and palettes but does not automatically delete previously submitted print inquiries and orders.

Public maps

Maps are private by default. With your optional consent you can offer a map for publication. Following approval, its area and settings become public, not your name or e-mail. You can withdraw this consent using “Revoke public sharing” in your account; the map remains private. Withdrawal does not affect earlier lawful processing.

Print inquiries and orders

We process your name, e-mail, phone, delivery location, note, model, source data and correspondence to prepare an offer, produce and deliver prints and handle claims (Article 6(1)(b)). Required contact fields are needed to handle printing. Accounting documents are kept for applicable statutory periods (Article 6(1)(c)); records needed to defend legal claims are retained while those claims or disputes remain relevant (legitimate interest, Article 6(1)(f)). The operator reviews and deletes orders and production files manually; the cleanup job does not automatically remove them. Uncompleted enquiries are kept while an offer is discussed; after discussions end we retain only records needed for legal claims until the applicable limitation period expires. Completed orders are also subject to complaint periods, statutory record retention and any pending proceedings. Once the last reason ends we delete the data and unneeded production files. The same criteria apply to related e-mails. Deletion from live data need not immediately remove a backup copy: backup data remains until overwritten in the backup cycle and is not used for routine order processing.

Ideas and feedback

Messages and optional e-mail addresses are stored privately to handle feedback and reply. The legal basis is our legitimate interest in improving the service and responding to questions (Article 6(1)(f)). E-mail is optional and is not used for marketing. Messages are deleted after at most 180 days; you may request earlier deletion. Do not include passwords or sensitive information.

Remembering your language

Clicking EN or CZ in the language selector saves your choice for 30 days in the mapstl_lang cookie. It contains only en or cs, with no visitor identifier, and is used solely to reopen the chosen language when you visit the main website address. We do not link it to your account or analytics or share it with other websites. Simply opening a page in a particular language does not set this cookie. You can change the language at any time or stop remembering your language. You can also delete the cookie in your browser. Without a saved choice the main address opens in English; direct Czech links continue to work. Deleting or blocking cookies may prevent the choice from being remembered.

Your draft map in the browser

Within the same browser tab, we temporarily remember model settings, the selected place and any GPX route so you can visit another page or reload. The draft stays in sessionStorage and is not sent to the server by this feature. It can be restored for up to 24 hours after the last use. Choose Create a new model to start again. After reloading, you need to generate the 3D preview again.

Essential storage and security

An essential session cookie supports sign-in and form security. Operational error logs are kept for up to 30 days with a size limit for troubleshooting and protection against abuse (legitimate interest). A log can include browser type, report identifier, error trace and affected model settings including its area. Registration uses a form token, a hidden check field and a timing check; registration and login attempts are limited using a server-side fingerprint of the IP address. This is not advertising tracking. If a connection fails, the browser tab may temporarily hold unsent error reports in sessionStorage and retry delivery; administration also uses it to pass settings when creating previews. This storage is tied to the browser tab, not an advertising profile. The separate change history records events, times and account IDs to document changes and protect legal rights; only records needed for an incident or legal claim are retained while that purpose applies and the operator removes them when reviewing the records after that purpose ends. To understand usage, we store the completion or download-start time, model type (single model or tiled picture), dimensions, colour and tile counts, printed frame setting and file format. Records contain no name, e-mail, coordinates, place name or visitor identifier. A random ID for each action prevents duplicate counting and does not link different actions. Reports are accessible only to administrators and are not sent to the external page-view service. We respect Do Not Track and Global Privacy Control and create no cookie or persistent browser storage for these statistics.

Aggregate page counts

The purpose is an aggregate overview of website usage and service improvement; necessary technical data is processed on the basis of legitimate interests (Article 6(1)(f) GDPR). A script from www.vladimir-vecera.cz measures page views without analytics cookies, browser storage or visitor identifiers. It respects Do Not Track and Global Privacy Control signals. On page loads and navigation between pages it sends the site identifier, a fixed page or page-group path and the document navigation type. URL parameters, place searches, account details and form contents are not included. Model details use a shared label without model names or IDs.

If the browser provides a referring page, the script sends its domain and, where allowed by its filters, a path without query parameters or fragments; common sensitive paths are excluded. Measurement requests omit sign-in cookies and the Referer header. The provider technically receives the browser IP address through the network connection; the script does not add it to the event payload. Page counts do not represent unique people. Script blockers or disabled JavaScript may prevent measurement. mapSTL.com no longer stores or sends the former PHP counters; hosting logs are separate from these analytics.

Recipients and external services

• VEDOS web hosting – the application, database, files and technical infrastructure. Provider information.
• Seznam.cz, a.s., Email Profi – incoming and outgoing e-mail on vladimir-vecera.cz, including mapstl@vladimir-vecera.cz. It processes addresses, messages and technical mail data. Email Profi terms.
• Packeta (Zasilkovna) – name, contact details and the selected delivery location needed to deliver a parcel. Any accounting provider and authorised public authorities receive only data needed for their lawful tasks.

The same operator, Vladimír Večeřa, administers this website and the measurement service on www.vladimir-vecera.cz. Access is limited to people who need the data for the relevant purpose.

OpenStreetMap tiles load directly in the browser. Place searches through Photon (Komoot) are sent by the mapSTL.com server: the query and search area are transmitted, not login details. Do not enter personal information that you do not wish to send to the map provider. Overpass and elevation downloads are described below. See the OpenStreetMap Foundation privacy policy.

External map infrastructure may handle a request outside the European Economic Area, in particular elevation tiles on Amazon S3 in the USA. We do not add account or order details to these requests; the provider nevertheless receives network data and the selected area. Its processing and international transfers are described in the AWS privacy notice. You may ask us by e-mail for information on specific recipients and any applicable transfer safeguards.

E-mails and your rights

The website sends no newsletter. Service messages concern print inquiries, orders or replies to feedback. You can request access and a copy, correction, erasure, restriction and, where applicable, portability. You can object to processing based on legitimate interests and withdraw consent. You can delete your account in its settings. Contact the controller above to exercise these rights. We respond without undue delay, normally within one month; any lawful extension will be explained. You may complain to the Czech Office for Personal Data Protection. The service does not make automated decisions with legal or similarly significant effects.

Map data downloaded to your device

For selections fully covered by our stored regional extracts, your browser reads map features from databases hosted on mapSTL.com. Coordinates of these requests are not sent to Overpass or Geofabrik. Outside this coverage, the browser reads Overture features from public AWS S3 or Azure Blob Storage. The browser may read a small release index from stac.overturemaps.org; that request contains the release and IP address, not selection coordinates. The map-file provider receives the IP address and requested data ranges, which may reveal the approximate area. Login details and diagnostic files are not sent. Older open app versions may still use Overpass. Elevation and structure data still comes from the services listed below and fallback Mapzen elevation tiles on Amazon S3. The providers contacted receive your IP address, requested area and the website origin (without the full page address). Data is processed in browser memory, not stored in a persistent browser database. The browser controls its ordinary network cache. STL, 3MF and images you download remain on your device until you delete them.

For repeat visits, data may be cached on the server for 7 days by default, with a configurable maximum of 30 days, within a fixed storage budget. Data received from your browser is restricted to your account or current session, not shared with other visitors. Saving this temporary cache is not required to generate or download a model.

For detailed Czech and Slovak terrain the browser also contacts public services operated by ČÚZK (ags.cuzk.gov.cz) and GKÚ Bratislava / VÚGK (inspirews.skgeodesy.sk). Requests contain the selected extent, network information and website origin; we do not send account or order details. Incomplete coverage or an outage may trigger fallback Mapzen data.

Daily download limits

To protect the availability of the free service, we count different models downloaded from the same IP. The ledger stores server-generated cryptographic fingerprints of the IP and model configuration, not a readable IP or coordinates. This is pseudonymisation, not complete anonymisation. Daily counts and limit events cover the last 30 calendar days; older records are removed at the next check or report access. A limit event also appears in the operational log under its retention rules. The legal basis is our legitimate interest in service security and availability (GDPR Article 6(1)(f)). You may object. If an administrator adds an IP exception, its readable address remains in settings while the exception is in effect.

Gift preparation requests (Czech print service)

The simple request form collects your name, email, place or route description, gift type and size, and any wishes or requested date. It does not ask for a delivery address or phone number at this stage. We may request a GPX file during follow-up. The inquiry and printing retention rules above also apply to these requests.