In short: you do not need to register, we load measurement and advertising code only with your consent, we never see your card details, and we handle only the data the site needs to work and to fulfil your order.
The controller is Pánácz Digital Kft. (registered seat: 9672 Gérce, Kossuth utca 2., Hungary; company registration number: 18-09-116022; tax number: 32579374-2-18). For data protection matters you can reach us at [email protected]. We are not required to appoint a data protection officer, so we have none.
The processing is governed by the General Data Protection Regulation of the European Union (GDPR, 2016/679) and the Hungarian Act CXII of 2011 on informational self-determination.
We ask for no name or e-mail address for these. The legal basis is our legitimate interest in running the site and keeping it secure (GDPR Article 6(1)(f)).
When you have a garden plan made, we store the photo you upload, the area you draw, your answers (country, region, light, soil, style, wishes) and the request you type in freely, attached to the plan. We handle them because you ask us to make a plan from them (GDPR Article 6(1)(b): steps before entering into a contract, then performance of the contract).
We pass the photo, the drawing and the answers to the artificial intelligence provider that makes the plan and the garden picture (OpenAI): one model reads the conditions of the garden from the photo, another puts the plants together, an image model draws the garden picture, and a further model checks the picture.
Upload a photo that shows no recognisable person, number plate, house number or other detail that can be linked to a person. The photo should be of your own garden, or one you have the right to upload.
The plan lives at a random address that is hard to guess. Anyone who knows this address can view the plan and the garden picture on it, so pass it on only to those you want to show it to. Search engines may not index the page of a plan.
A plan that was not bought is deleted, with its photo and pictures, 90 days after it was made, unless it belongs to a My garden kept under your e-mail address: that one stays as long as the garden does. A plan that was bought is kept for five years from the purchase so that you can open it again; if you ask, we delete the photo and the pictures earlier. When you upload a photo we remove the data the camera or phone wrote into it (where it was taken, for example). A photo no plan is made from is deleted after a day. The server is backed up; deleted data drops out of these backups within four weeks at most.
For a purchase we ask for your e-mail address, the billing name and address, and the tax number of a company. We also store the details of the order: what you bought, for how much, in which country, with which coupon, when you made the declaration about the right of withdrawal, the identifiers of the payment and the invoice, and whether you had consented to marketing cookies when you ordered.
To see where visitors get stuck, we note which steps of planning a visit reached (for example: opened the planner, uploaded a photo, the plan was made, paid). The visit is identified by a random mark that lives as long as your session: no name, IP address or device identifier belongs to it, and it sets no cookie of its own.
The steps after the plan is made are tied to the plan, and a plan that was bought has an e-mail address, so these notes can be traced back to buyers and are therefore personal data. The legal basis is our legitimate interest in improving the service (GDPR Article 6(1)(f)); you can object to it. We delete the notes after 400 days.
If you write to us, we handle your message and e-mail address in order to answer you (legitimate interest, or performance of the contract where an order is concerned), and delete them one year after the matter is closed. Under the Hungarian Consumer Protection Act (Act CLV of 1997, Section 17/A) we must keep a consumer complaint and our reply for three years.
We always use the cookies the site needs to work: a session cookie and a security (XSRF) cookie, which expire with the session, and, once you save a plant or make a garden plan, the My garden cookie, which lives for 180 days, and, once you decide in the cookie bar, a cookie that keeps your choice for one year. To filter out bots, Cloudflare may also set a security cookie (__cf_bm) that lives for 30 minutes. They need no consent.
We load analytics (Google Analytics) and advertising (Google Ads, Meta, that is Facebook and Instagram) cookies only if you consent in the cookie bar (GDPR Article 6(1)(a)). You can decide separately about statistics and marketing cookies, and you can refuse both: the site works just the same.
If you consented to marketing cookies, we report two events to Google and Meta to measure our ads: when the preview of your free plan is made, and when you buy a plan (with the amount and the currency). Your e-mail address, if you gave it, is passed on only in an irreversibly encoded form (SHA-256 hash), so the ad system can match it with its own users. Our server also sends these events to Meta directly (Conversions API), together with your IP address, your browser type and the identifiers in Meta’s cookies, because ad blockers often swallow the browser’s report. For this we keep those details for at most two days when you start a purchase. The legal basis is your consent (GDPR Article 6(1)(a)); once you withdraw it, we send no new events.
Your browser remembers your choice, and you can change or withdraw it at any time with the “Cookie settings” link in the footer. Withdrawal does not affect the lawfulness of earlier processing.
We do not sell your data. To run the site we use the following providers, each of which receives only the data its task needs:
DigitalOcean, Cloudflare, OpenAI, Stripe, Resend, Google and Meta may also handle data in the United States. These transfers are safeguarded by an adequacy decision of the European Commission (the EU–US Data Privacy Framework) or, failing that, by the standard contractual clauses adopted by the Commission. Write to us if you would like to know more about them.
The plant recommendations, the garden plan and the garden picture are made by artificial intelligence. They are suggestions: we make no automated decision about you that has legal effect or affects you in a similarly significant way, and we do not profile you.
The site is meant for adults. You must be 18 or over to order a garden plan, and we do not knowingly collect data from anyone under 16.
The site is served over an encrypted connection (HTTPS), only those who need it to run the site have access to the data, and payment takes place entirely within the systems of Stripe. Should a data breach occur that puts you at risk, we will notify you as the law requires.
You can ask us to tell you what data we hold about you and to give you a copy, to correct or erase it, to restrict its processing, and to hand over the data you gave us in a machine-readable form (data portability). You can object to processing based on legitimate interest, and you can withdraw your consent at any time. We cannot erase the invoice and other data we are obliged to keep before the retention period ends.
Send your request to [email protected]. We answer within one month at the latest, free of charge; where necessary we may first ask you to confirm that the data is yours.
If you believe we have infringed your rights, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9–11., www.naih.hu) or with the data protection authority of the country you live in, or go to court.
If the way the site works changes, we update this notice and show the date of the change.
Effective from 16 October 2026.
Besides the cookies the site needs to work, we would like to use analytics and advertising cookies (Google, Facebook), if you allow it. Details