Legal
Privacy Policy
This Privacy Policy explains how GlobEstate ("we", "us") processes personal data when you visit projectmodularity.com, join our waitlist, create an account, upload a portfolio, subscribe to a paid plan or otherwise use our services (the "Service"). It is designed to meet the requirements of the EU General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG) and applicable U.S. federal and state privacy laws.
1. Who is responsible
The controller responsible for processing your personal data is:
Bruno Noel Paschmann · GlobEstate · [Street address and apartment/suite] · New York, NY 10027 · United States of America · Email: sales@projectmodularity.com
For all privacy questions and to exercise your rights, simply email us at the address above. We are not required to appoint a data protection officer.
Representative in the EU (Art. 27 GDPR)
Because we are based outside the European Union but offer our Service to people in the EU, we have appointed the following representative in the EU: [Name and postal address of the EU representative].
2. Summary
- We only collect what we need to run the Service. We do not sell your personal data.
- Analytics cookies (Google Analytics) and marketing cookies (Meta Pixel) are only used after you consent in our cookie banner. You can change your choice at any time via Cookie settings at the bottom of every page.
- Payments are handled by Stripe. We never see or store your full card number.
- You can access, correct, export or delete your data at any time — including with one click in your account.
3. What we process, why, and on what legal basis
3.1 Visiting the website (server log files)
When you open our website, our hosting provider automatically processes technical data sent by your browser: IP address, date and time of the request, the page or file requested, referrer URL, browser type and version, operating system and amount of data transferred. We need this to deliver the website, keep it secure and diagnose errors.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website). Hosting provider (processor): [Name and address of the hosting provider, e.g. dogado GmbH / checkdomain, Germany]. Retention: log files are deleted after [log retention period, e.g. 14 days] unless needed to investigate a security incident.
3.2 Entry screen and demo access
Our preview is protected by an entry screen. When you click "Try the demo" or enter a developer code, we store a small flag in your browser's local storage (pm_demo_entered, pm_auth_v3) so you are not asked again. This information never leaves your device.
Legal basis: § 25(2) no. 2 TDDDG (strictly necessary) and Art. 6(1)(f) GDPR.
3.3 Launch waitlist
If you join our waitlist, we store your email address and the date and time you signed up and gave your consent. We use it only to inform you about our launch and product news.
Legal basis: Art. 6(1)(a) GDPR (your consent). You can withdraw your consent at any time by emailing us or by using the unsubscribe link included in every email; we then remove your address from the list.
3.4 User accounts
When you create an account we process your first and last name, email address, company (optional), a securely hashed version of your password (we never store passwords in plain text), the IP address and browser user agent at the time of registration, and whether you have confirmed your email address. We send you an email with a confirmation link. While you are signed in, a session cookie (pm_session) keeps you logged in, and your profile is remembered in your browser (nexus_auth).
Legal basis: Art. 6(1)(b) GDPR (performing our contract with you); for IP address and user agent, Art. 6(1)(f) GDPR (preventing abuse). Retention: until you delete your account.
Public demo: in the current demo, "Log in" signs you into a shared demo account that every demo visitor uses. Do not upload confidential or personal data to the demo account — anything uploaded there is visible to other visitors and may be reset at any time.
3.5 Portfolio uploads and property data
You can upload spreadsheets (CSV or Excel) describing properties. We store the extracted data — for example property names, addresses, asset class, valuation, occupancy, tenants and notes — in your account so we can place it on the map and show it to you. Your spreadsheet may contain personal data of third parties (for example tenant or contact names). You are responsible for having a lawful basis to share such data with us.
If you are a business customer and upload personal data of third parties, we process that data on your behalf as a processor (Art. 28 GDPR); a data processing agreement is available on request.
Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the property, replace your portfolio or delete your account.
AI-assisted column recognition. If a column heading in your spreadsheet cannot be recognized automatically, we may send only the unrecognized column headings and up to three sample values per column to Anthropic, PBC (San Francisco, USA) to identify the matching field. Anthropic acts as our processor and does not use this data to train its models. This feature is only active when we have switched it on.
3.6 Maps, geocoding and 3D city views
To place your properties on the map and show 3D cities, map requests are sent to the following providers:
- Google Maps Platform (Geocoding, Places and Elevation APIs — Google LLC, USA, and Google Ireland Ltd., Ireland): addresses you upload or look up are sent from your browser and from our server to find their coordinates. Results are cached in your browser's local storage (nexus_geocode, nexus_places, nexus_elev) and on our server so that repeat lookups are faster.
- Google Photorealistic 3D Tiles, delivered via Cesium ion (Cesium GS, Inc., USA): your browser requests 3D map data for the area you are viewing, which transmits your IP address and the viewed area.
Legal basis: Art. 6(1)(b) GDPR (core function of the Service) and Art. 6(1)(f) GDPR. Your use of the map features is also subject to the Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy.
3.7 Code libraries and fonts
To display the 3D experience, your browser loads open-source libraries (three.js, 3d-tiles-renderer and related decoders) and globe textures from the content delivery networks unpkg.com and cdn.jsdelivr.net. These requests transmit your IP address and browser information to the respective providers. Our web fonts are hosted on our own server, so no data is sent to font providers such as Google Fonts.
Legal basis: Art. 6(1)(f) GDPR (fast and reliable delivery of our website).
3.8 Sharing a property
If you create a share link for a property, we store a snapshot of that property's data under a random link so that people without an account can view it. Anyone who has the link can see the snapshot. Retention: until you ask us to delete it or delete your account.
3.9 Subscriptions and payments
Paid plans are processed by Stripe (Stripe, Inc., USA, and Stripe Payments Europe, Ltd., Ireland). When you subscribe, you are redirected to Stripe Checkout, where Stripe collects your payment details directly. We receive and store your Stripe customer ID, subscription ID, plan, status and renewal date — never your full card number. Stripe also processes data for fraud prevention and its own legal obligations as an independent controller; see Stripe's Privacy Policy.
Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and bookkeeping obligations). Retention: billing records are kept as long as tax law requires (up to 10 years under § 147 German Fiscal Code; at least 7 years in the U.S.). Other subscription data is deleted when you delete your account.
3.10 Cancellations, refunds and other requests
If you use our Cancel contracts here form, request a refund or contact us by email, we process the information you provide (e.g. name, email address, contract details, reason) together with the date and time we received it, in order to handle your request and to be able to prove that we did.
Legal basis: Art. 6(1)(b), (c) and (f) GDPR. Retention: 3 years from the end of the year in which the request was completed (statutory limitation period).
3.11 Emails we send
We send transactional emails — account confirmation, cancellation and refund confirmations and billing notices — through [Name of the email / SMTP provider] as our processor. Marketing emails are only sent with your consent (see 3.3).
3.12 Analytics — Google Analytics 4 (only with your consent)
With your consent, we use Google Analytics 4 (Google Ireland Ltd., Dublin, Ireland; Google LLC, USA) to understand how visitors use our website — for example which pages are viewed, for how long, from which type of device and approximate region. Google Analytics sets cookies (_ga, _ga_<ID>) and processes a pseudonymous identifier and your IP address; for users in the EU, Google Analytics 4 does not store IP addresses. We use Google Consent Mode, and the Google Analytics script is not loaded at all until you consent.
Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR (your consent), which you can withdraw at any time via Cookie settings. Retention: analytics data is deleted after [14] months. More information: Google Privacy Policy.
3.13 Marketing — Meta Pixel (only with your consent)
With your consent, we use the Meta Pixel (Meta Platforms Ireland Ltd., Dublin, Ireland; Meta Platforms, Inc., USA) to measure the success of our advertising on Facebook and Instagram and to show relevant ads to people who have visited our website (retargeting). The pixel sets cookies (e.g. _fbp) and sends Meta information such as your IP address, browser data, the pages you visit and actions you take on our website. If you are logged in to Facebook or Instagram, Meta can link this information to your account.
We and Meta are joint controllers (Art. 26 GDPR) for collecting this data on our website and transmitting it to Meta; the Meta Controller Addendum sets out our respective responsibilities. Meta alone is responsible for any further processing — see Meta's Privacy Policy.
Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR (your consent), which you can withdraw at any time via Cookie settings.
4. Cookies and similar technologies
We use cookies and your browser's local storage. Strictly necessary items are used without consent (§ 25(2) no. 2 TDDDG); everything else only with your consent (§ 25(1) TDDDG). You can review and change your choice at any time via Cookie settings at the bottom of every page. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal of marketing cookies.
| Name | Provider | Purpose | Storage & duration | Category |
|---|---|---|---|---|
| pm_session | GlobEstate | Keeps you signed in | Cookie · until the browser closes | Necessary |
| pm_consent_v1 | GlobEstate | Stores your cookie choices | Local storage · 12 months | Necessary |
| pm_demo_entered, pm_auth_v3 | GlobEstate | Remembers that you passed the entry screen | Local storage · until cleared | Necessary |
| nexus_auth | GlobEstate | Remembers your signed-in profile in the app | Local storage · until you sign out | Necessary |
| nexus_geocode, nexus_places, nexus_elev | GlobEstate | Caches map lookups so the map loads faster | Local storage · until cleared | Necessary |
| _ga, _ga_<ID> | Distinguishes visitors for usage statistics | Cookie · up to 2 years | Analytics (consent) | |
| _fbp | Meta | Recognizes browsers for ad measurement and retargeting | Cookie · 90 days | Marketing (consent) |
5. Recipients
We only share personal data as described in this policy — with our hosting and email providers, Stripe, Google (Maps Platform, Analytics), Cesium, Meta, Anthropic and content-delivery networks — and with advisers or authorities where we are legally required to. We do not sell personal data.
6. International data transfers
We are based in the United States, and several of our service providers process data in the U.S. Where a recipient is certified under the EU-U.S. Data Privacy Framework (including its UK and Swiss extensions), transfers are based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Otherwise we use the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with supplementary measures where necessary. Transfers that are necessary to perform our contract with you may also be based on Art. 49(1)(b) GDPR.
7. How long we keep data
We delete personal data as soon as it is no longer needed for the purposes described above, unless we are legally required to keep it (for example tax records). The specific retention periods are listed in section 3.
8. Your rights (EU, EEA and UK)
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- correct inaccurate data (Art. 16);
- erase your data (Art. 17) — you can delete your account and all portfolio data yourself via Account → Profile → Delete account & data;
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- withdraw consent at any time with effect for the future (Art. 7(3)) — for cookies via Cookie settings;
- lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state where you live or work.
Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time for reasons arising from your particular situation. You may object to the use of your data for direct marketing at any time, without giving reasons.
To exercise any of these rights, email us at sales@projectmodularity.com.
9. Your rights in the United States
Depending on the state you live in (for example California, Colorado, Connecticut, Virginia and others), you may have the right to know what personal data we collect, to access, correct and delete it, to obtain a copy, and to opt out of the "sale" or "sharing" of personal data and of targeted advertising. We do not sell personal data for money. Using the Meta Pixel for retargeting may be considered "sharing" or "targeted advertising" under some state laws — you can opt out at any time by rejecting marketing cookies in Cookie settings, and we honor Global Privacy Control signals.
To make a request, email sales@projectmodularity.com. We will verify your request and respond within the time required by law (generally 45 days). You may use an authorized agent, and we will not discriminate against you for exercising your rights.
10. Children
The Service is intended for adults and business users. It is not directed to children under 16 in the EU or under 13 in the United States, and we do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.
11. Security
All connections to our website are encrypted (HTTPS). Passwords are stored only as salted hashes, access to stored data is restricted, and uploaded data is kept separate per account. No method of transmission or storage is completely secure, but we work to protect your data with appropriate technical and organizational measures.
12. Automated decision-making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
13. Changes to this policy
We update this policy when our Service or the law changes. The current version and its effective date are shown at the top of this page. If a change significantly affects you, we will let you know in advance.