Privacy & Cookie Policy
Last updated: 27 June 2026
Flyover.video turns the geotagged photos you already have into a cinematic 3D map flyover. The work happens in your browser — your photos are never uploaded to us and we never see or store them. This page explains the few places data does travel, exactly which cookies and storage we use, and your rights.
01 Who we are
Flyover.video (“we”, “us”) is the data controller for the limited personal data described here. We can be reached at:
- Controller: SOCIAL IT S.R.L.
- Registered office: Splaiul Unirii nr. 160, corp clădire C3-Filatura, aripa 1, parter, camera 7, Sector 4, 040041 București, Romania
- Trade Register: J40/21133/03.12.2021 · VAT / CUI: RO45300881 · EUID: ROONRC.J40/21133/2021
- Email: contact@socialit.ro
If you are in the EU/EEA or UK, this policy is written to meet the GDPR / UK GDPR and the ePrivacy (“cookie”) rules.
02 What data we process
We are built to need as little of your data as possible. In summary:
- Your photos and their location data — read and processed entirely inside your browser. They are never uploaded to our servers. The only exception is the map provider, which receives coordinates to draw the map (see §3).
- Payment data — only if you buy a paid export, and only handled by our payment processor, Stripe. We never receive your card details (see §4).
- Analytics data — only if you opt in via the cookie banner; anonymised and aggregate (see §5).
- On-device storage — your editing project and your cookie choice are kept in your browser’s own storage, on your device (see §6).
03 Your photos & location
When you drop photos in, your browser reads the EXIF metadata (including GPS coordinates and capture dates), builds the route, renders the 3D map and encodes the final video — all locally on your device. No photo file ever leaves your device or reaches a server of ours.
What the map provider sees
To draw the map, satellite imagery and 3D terrain under your route, your browser requests map tiles directly from our mapping providers. Those requests necessarily include the geographic coordinates of your route (derived from your photos) and your IP address. This is standard for any interactive map and is required to render it. The providers are Mapbox (map & 3D rendering), map data from OpenStreetMap contributors, and, in 3D modes, Cesium for 3D tiles. We do not send them your photos — only coordinates needed to fetch the right map tiles.
04 Payments & your email
Flyover.video is free to build and preview. If you buy a video bundle (export credits), payment is handled by Stripe as our payment processor:
- You enter your card details on Stripe’s secure checkout. We never see, receive or store your card number.
- Stripe processes your payment and may set its own cookies for fraud prevention (Stripe Radar). Stripe is the controller of the payment data it collects; see Stripe’s privacy policy.
- To grant and let you re-use what you paid for, our server stores a small, pseudonymous record: your access code, your remaining export credits, a payment reference, a non-reversible hash of each video you unlock (so we know which you already own), and timestamps. This record contains no photos, no videos, no locations and no payment card data.
- Stripe shares a transaction/receipt and limited details with us for accounting, support and dispute handling.
Your email — the one piece of personal data we keep
To sell you export credits we collect and keep your email address. We are deliberate about what we do — and do not — hold:
- What we never store: we do not store your photos, your videos, or the locations in them. All rendering and export happen in your browser — your images and their GPS data never leave your device and never reach our servers.
- Why we keep your email: to deliver your code and let you re-access what you paid for (performance of our contract, GDPR Art. 6(1)(b)), and to meet our tax and accounting duties such as issuing and retaining invoices (legal obligation, GDPR Art. 6(1)(c)). For a free promotional code, we hold the email only to deliver it (your request / our legitimate interest, Art. 6(1)(f)).
- How long: only for the period required by applicable tax and accounting law (in Romania, accounting records are generally kept up to 10 years). Promotional-only emails are deleted once the code is delivered. See §9.
- No marketing, no selling: we use your email only to deliver your code, re-send it on request, and keep legally required records. We never send marketing, and never sell or share it — except with Stripe (our processor) and the authorities where the law requires.
05 Analytics
We use Google Analytics 4 to understand, in aggregate, how the site is used (pages viewed, broad device/region) so we can improve it. It tells us nothing about your photos.
- Opt-in only. Analytics is set to denied by default (Google Consent Mode v2). The Google Analytics script is not even loaded until you click Accept in the cookie banner. If you reject or ignore the banner, no analytics cookie is set and no analytics request is sent.
- IP anonymisation is enabled.
- You can change or withdraw your choice anytime — manage your cookie consent.
Google processes this data as described in Google’s Privacy Policy.
07 Third parties
We keep third parties to a minimum. Those that may receive some data:
- Mapbox — map & 3D rendering. Receives your route coordinates and IP to serve map tiles.
- Cesium — 3D photoreal tiles (3D modes only). Receives coordinates and IP to serve tiles.
- OpenStreetMap — map data, delivered via Mapbox.
- Google Analytics — aggregate usage analytics. Only after you opt in.
- Stripe — payment processing (only if you buy a paid export).
08 Legal bases (GDPR)
- Consent — analytics cookies (you can withdraw it anytime).
- Performance of a contract — processing a payment and granting your export.
- Legitimate interests — security and fraud prevention, and keeping the site working (strictly-necessary storage); balanced against your rights.
- Legal obligation — retaining payment/accounting records where law requires.
09 Retention
- Your photos & videos: we never hold them — they live only in your browser until you clear them or start a new video. You are in control.
- Payment, email & entitlement records: your email and the pseudonymous payment/voucher record are kept as required by tax and accounting law (in Romania, accounting records are generally kept up to 10 years); invoices/transaction records are also retained by Stripe. A free promotional-only email is deleted once the code is delivered.
- Analytics: retained by Google for the period configured in our GA property (GA4 default is 2–14 months), then aggregated.
10 International transfers
Some providers (Google, Stripe, Mapbox, Cesium) are based in the United States. Where data leaves the EEA/UK, it is protected by appropriate safeguards such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses, as set out in each provider’s privacy policy linked above.
11 Your rights
If you are in the EEA/UK you have the right to access, rectify, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time. Because we don’t require an account and don’t store your photos, the personal data we actually hold is limited (your email and a pseudonymous payment/voucher record). Note that we may be unable to erase your email while we are legally required to keep it for tax/accounting (see §9); we’ll erase it once that period ends. To exercise a right, email contact@socialit.ro. You also have the right to complain to your data protection authority (e.g. your national supervisory authority in the EU, or the ICO in the UK).
12 Children
Flyover.video is not directed at children under 16 and we do not knowingly process their personal data.
13 Changes & contact
We’ll update this page when our processing changes and revise the “last updated” date above. Questions or requests: contact@socialit.ro.