Privacy policy

Last updated: October 2026

1. Who is responsible

Giorgio Lombisani
Bad Sodener Str. 22
65843 Sulzbach (Taunus)
Germany
E-mail: giorgio@lombisani.de

2. Visiting the website

Our web host IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) processes the technical data your browser sends (IP address, date and time, page requested, browser type) in server log files, to deliver the site and keep it secure (Art. 6 (1) (f) GDPR). The logs are deleted after a short period. All fonts, scripts and sounds of the 3D world are served from our own server; no third-party tracking or advertising tools are used.

3. Spot occupancy and artworks

To show which spots are taken, the website loads this information from our database provider Supabase Inc. (servers in Frankfurt, Germany). Your IP address is transmitted to Supabase for this purpose (Art. 6 (1) (f) GDPR). Approved artworks are loaded from Supabase storage.

3a. Anonymous visitor counting

To know how many people visit Canvas Cities, we count a few events (a visit, entering a city, clicking “Buy”, sharing a spot) as plain daily totals in our database at Supabase (Frankfurt). We do not store IP addresses, do not use cookies and cannot recognise individual visitors. A small marker in your browser's session storage prevents the same visit from being counted twice; it is deleted when you close the tab (Art. 6 (1) (f) GDPR).

4. Buying a spot (payment)

Payments are handled by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin, Ireland). Stripe collects your e-mail address, payment details and billing country directly; we never see your full card details. Stripe may process data in the USA on the basis of the EU standard contractual clauses and the EU-US Data Privacy Framework. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). We receive your e-mail address and the payment status from Stripe. Invoices and payment records are kept for the periods required by German tax law (up to 10 years).

5. Uploading your artwork

After payment you upload an image together with your artist name, the title and optionally a website link. These are stored with Supabase (Frankfurt) and, once approved, shown publicly in Canvas Cities for as long as your spot exists (Art. 6 (1) (b) GDPR). Please only publish a name you are happy to be shown publicly.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Write to giorgio@lombisani.de. You may also complain to a data protection supervisory authority, e.g. the Hessian Commissioner for Data Protection and Freedom of Information.

7. Local storage

The website stores two small settings in your browser (whether you have seen the welcome message, and whether sound is on). They never leave your device. No cookies are used for tracking.