Privacy notice
Version 2026-10-11 · TerraTopic Folkedal · Org. no. 933 307 956Who is responsible
TerraTopic Folkedal, organisation number 933 307 956, Veslebakken 1, 3047 Drammen, Norway, is responsible for TerraTopic's processing of personal data. Contact anders@terratopic.com for privacy questions or a rights request. This notice covers the TerraTopic terrain shop and its order, delivery and support services.
Orders, identity and support
We process the email address and technical identity used to place and retrieve an order, order references, selected terrain specifications, country and business/tax declarations, payment references, status, receipt, refund and support records. Stripe collects card and billing information through its payment form; our application does not receive your full card number or security code. Firebase provides authentication, including a technical identity for guest purchasing. Creating a public account is not a condition of shopping, but protected delivery and rebuild requests must establish ownership. Order and support processing is necessary to perform the contract or take steps you request before a contract (GDPR Article 6(1)(b)). Records legally required for tax and accounting are processed to comply with those obligations (Article 6(1)(c)). Our online withdrawal form records your name, order reference, confirmation email, statement and the received date/time. This lets us acknowledge and handle your notice under the contract and applicable consumer-law obligations.
Browsing, security and service counts
Requests reach our hosting and infrastructure providers, which process network and technical information such as IP addresses and logs. We use necessary security and diagnostic records to protect access, prevent fraud and fix faults. Our own service counter records the door used, time, country and referring hostname, and a public/staff classification; its counting records do not contain a visitor IP address, user identifier, browser string or a fingerprint. We use these counts to understand shop usage. Security and proportionate operational measurement rely on our legitimate interests (Article 6(1)(f)); you may object and we assess the interests and your situation. See the cookies and device storage page for browser storage. For withdrawal-form abuse prevention we keep short-lived counters keyed by salted hashes of the network address and confirmation email for each hour; these counter records contain neither the address nor the email. They expire after two hours and are removed by our scheduled cleanup. The withdrawal notice itself remains a separate consumer-request record.
Maps, search and AI Scout
Map requests may reach the map or imagery provider you select, which receives network information and tile coordinates. Search terms and selected coordinates are sent to the services used to answer a location request, including Google Places and OpenStreetMap/Nominatim where used. If you use AI Scout, your message, conversation context and relevant map context are sent to Google's Vertex AI service to produce a response. Please do not enter sensitive personal information. These features process the information needed to answer your request (Article 6(1)(b)); provider security processing follows its applicable terms. AI suggestions do not make decisions about your legal rights or eligibility for a refund.
Who receives information
Service providers include Google Cloud/Firebase for authentication, databases, terrain-data processing and requested AI features; Vercel for web hosting; Cloudflare for delivery storage and network services; Resend for transactional email; and Stripe for payments. Our infrastructure also uses managed queue/cache services to process orders. Anders handles support and investigations. Stripe and some infrastructure or map providers also act as independent controllers for their own fraud prevention, compliance or service operations. We do not sell customer data or send advertising emails as part of an order. Authorities or professional advisers receive records where needed for a legal obligation or a dispute.
International processing
Some terrain-data processing and file storage is located in Europe. This does not mean all provider processing or support access stays in the EEA. Providers can process information in the United States and other countries. Transfers must use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses with an assessment of the transfer and additional measures where needed. Contact us for information about the safeguard applicable to your data or a copy, with confidential details redacted where appropriate. We do not use consent to the terms as a substitute for a lawful transfer mechanism.
How long information is kept
New downloadable packages and processing storage use a 14-day lifecycle; your email states the package download deadline. Earlier packages keep their recorded policy. Deleting a package does not delete the order record. We retain the original specification needed for an offered rebuild through its 30-day request window and any active replacement. Payment, receipt and accounting records are kept for the legal period that applies to the record: Norwegian primary accounting material generally has a five-year period after the financial year, and applicable EU OSS records require ten years. Other order, support and security records are kept only while needed for the service, an unresolved request or a reasonably foreseeable claim, then reviewed for deletion or anonymisation. Provider backups and logs follow their applicable schedules. Ask us about a particular record or request erasure; we explain any legal retention exception.
Your choices and rights
You can request access, correction, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Write to anders@terratopic.com; an order reference helps but is not required to make a privacy request. We verify identity proportionately and normally answer within one month. If a lawful extension is needed, we explain it within that first month. You can complain to Datatilsynet in Norway or your competent local data-protection authority. Providing information needed for payment, fulfilment and ownership checks is necessary for those services; we explain if we cannot fulfil a request without it.
Changes
We update this notice when our processing changes. Material changes are brought to affected customers' attention where required. A new notice does not retrospectively authorise a new purpose for old data.