Privacy policy

Who we are

Planorama is made by DNG Studio, a studio in Serbia. For data collected through this site we are the data controller.

Write to kontakt@planorama.rs with any question about your data. We answer within 30 days, usually the same day.

No cookies here either

planorama.rs has no cookies and no trackers that follow you from site to site.

We do measure visits, with a tool that sets no cookies, keeps no IP address and builds no profile of you. The next section says how.

That is also why there is no cookie banner here: there is nothing to consent to.

Fonts are served from our own server, so your browser sends no request to Google or anyone else.

Measuring visits

We keep statistics with Umami, which works without cookies.

What is recorded:

• which page was opened and how long it was read,
• which site you came from, if you came from one,
• a rough location, at the level of country and city,
• device type, operating system and browser.

It sets no cookies, keeps no IP address and does not recognize you on other sites. The data is aggregate and cannot say who you are. If we do not host the tool ourselves, its provider sees those aggregate figures too.

This applies to planorama.rs only. The widget on a developer’s site has none of it.

When you request a demo

The form asks for a name, an email address and a message. Phone and company are optional. We also record which language you used, so we can reply in it, and when you sent it.

We use this only to reply and to send you access to a demo. No newsletter, no profiling, nothing sold to anyone.

The legal basis is taking steps at your request before entering into a contract. If we do not end up working together, the request is deleted at most 24 months after our last exchange.

Server logs

Our server keeps ordinary access logs: IP address, time, the address requested and the browser type. They exist for security and for finding faults.

Rate limiting uses the IP address but holds it in memory only and never writes it to the database.

When you sign in to the admin

Signing in sets up to three cookies, all strictly necessary and admin-only: as_session (seven days, the session), as_login_code (ten minutes, confirms the emailed code) and as_trusted (thirty days, remembers that this browser already confirmed a code). They follow you nowhere and carry an account id and a signature rather than your email address.

Passwords are not stored. Only a scrypt hash with a per-password random salt, from which the password cannot be recovered. Changing a password or suspending an account ends every existing session for it at once.

When you are a visitor on a developer’s site

Planorama is embedded on a developer’s own website. There the developer is the controller and we are the processor: we handle data on their instructions and for their purposes. Address your rights to them first.

What happens there:

• Apartment inquiry: name, email, phone, message, which apartment, and the address of the page it was sent from. We also store the consent text you agreed to, so it is clear later what it covered.
• Statistics: which floor and which apartment were opened. Each event carries a random number kept in your browser’s sessionStorage, which disappears when you close the tab. No IP address is recorded with those events.
• First-visit tour: if the project turns it on, your browser keeps in localStorage only how far you got and whether you finished or skipped it, so it does not show again. It stays on your device and is not sent to us.
• Availability on a phone: if you switch it off, your browser remembers that in localStorage, so it stays off next time. It stays on your device and is not sent to us.
• Location map: if the project has coordinates, the map is drawn with tiles from OpenStreetMap. Your browser fetches those tiles directly from their servers, so OpenStreetMap sees your IP address and the page address. With no coordinates there is no map and no such request.
• Assistant: exists only if the developer switched it on and a model key is configured. Your question and the project’s apartment data are then sent to that provider to compose an answer. We also keep the question and the answer, to see what buyers ask and to notice misuse; no name and no IP address is stored beside them.
• Fonts: served from the server Planorama runs on. No request goes to Google.
• Links to a 360° tour, WhatsApp, Viber or Telegram open someone else’s site or app only when you click them, and its own privacy policy applies.

Who else sees the data

We do not sell data and we do not share it for advertising. Data reaches these providers, and only as far as the service requires:

• Hetzner Online GmbH, Germany: the server Planorama runs on and where the database lives.
• Resend: sending email, only if email is switched on: the notice of a new apartment inquiry or demo request, and the six-digit sign-in code for the admin. Those messages then pass through their service.
• Cloudflare: DNS for planorama.rs and, where proxying is on, relaying traffic to the server. It then sees your IP address and the page address.
• Anthropic or OpenAI: only if the assistant is switched on, and only for the questions you ask it.
• OpenStreetMap Foundation: only if the project has coordinates, and directly from your browser when the map tiles load.

Resend, the assistant and the map are optional and off by default. Without them Planorama sends no request outside the server it runs on.

How long we keep things

• Demo requests: at most 24 months after our last exchange.
• Apartment inquiries: until the developer deletes them. The retention period is theirs to set, because they are the controller.
• Statistics: 13 months, so a year can be compared with the one before; they contain nothing by which a person can be identified. Older rows are deleted automatically.
• Questions to the assistant and its answers: 6 months, then deleted automatically.
• Accounts: for as long as they exist. Deleting an account deletes its access rights with it.
• Server logs: short term, on the ordinary rotation.

Your rights

You may ask for access to your data, for it to be corrected, deleted, restricted or ported, and you may object to the processing. An email is enough.

If something is not right, write to kontakt@planorama.rs and we will sort it out. You also have the right to contact the Serbian Commissioner for Information of Public Importance and Personal Data Protection.

Security

All traffic goes over HTTPS. Passwords are stored as a scrypt hash. Access to projects is per account, and an account without access to a project gets the same page as if the project did not exist.

If you find a security flaw, write to kontakt@planorama.rs and we will treat it as a priority.

Changes

If this policy changes in substance we change the date at the top and, where the change matters, tell clients by email.