Privacy Policy

• Account details — email address, and optionally your name and avatar. Authentication is handled by Supabase Auth; we never see or store your password.
• Content you create — maps, markers, shapes, groups, uploaded images, custom CSS and settings.
• Billing details — we store your subscription status, plan and a Polar customer identifier. We never see or store your card details; payments are processed entirely by Polar.
• Integration data — if you connect a Google Sheet, we store the spreadsheet id, the tab and range, and your column mapping, so we can sync it.

When someone views a published or embedded map, we record aggregate usage so the map owner can see how their map performs. Specifically:

• A pseudonymous visitor and session identifier, stored in the visitor’s browser (a first-party cookie and local storage) so repeat views are not counted twice.
• A salted, irreversible hash of the visitor’s IP address. We do not store the raw IP address alongside analytics events, and we do not use it to identify anyone.
• The referring domain only — not the full referring URL, and not its query string.
• Which markers were clicked, and which of the contact links (website, phone, email, directions, call-to-action) were used.

We do not build cross-site profiles, we do not sell visitor data, and we do not run third-party advertising or tracking pixels on map pages.

On map pages we set one first-party cookie and two local-storage entries (mm_vid, mm_sid) purely to deduplicate view counts. No advertising or cross-site tracking cookies are set. On the application itself, Supabase Auth sets a session cookie that is strictly necessary to keep you signed in.

If you embed a MapsMaker map on your own website and you are subject to the ePrivacy Directive or similar rules, you are the party responsible for the consent notice shown to your visitors. Mention MapsMaker analytics in your own cookie policy.

• Contract — providing the service to account holders, and processing payment.
• Legitimate interests — pseudonymous map analytics, abuse prevention and rate limiting, and keeping the service secure.
• Legal obligation — retaining billing records for tax purposes.

We share data with the following processors, and no one else:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and request logs.
• Polar — subscription billing and payment processing.
• Mapbox— map tiles, geocoding and static map images. Mapbox receives requests from map viewers’ browsers and is subject to its own privacy policy.
• Google — only if you connect a Google Sheet, and only for the spreadsheets you connect.

• Account and content data — kept until you delete your account.
• Map analytics — 14 months, then deleted automatically.
• Abuse-prevention logs — 7 days.
• Billing records — as required by law.

You can exercise the following rights yourself, immediately, from Settings in your dashboard:

• Access and portability— “Download my data” exports everything we hold about you as a JSON file.
• Erasure— “Delete account” permanently removes your account, your maps and markers, your uploaded images and your analytics. This cannot be undone.

For rectification, restriction or objection, or to raise a complaint, contact us at support@mapsmaker.com. You also have the right to complain to your local supervisory authority.

Our sub-processors may process data outside your country, including in the United States. Where required, transfers rely on the EU Standard Contractual Clauses or an equivalent safeguard offered by that provider.

If we make a material change we will update the date at the top of this page and, for account holders, notify you by email before it takes effect.

[LEGAL ENTITY NAME], [REGISTERED ADDRESS] — [PRIVACY CONTACT EMAIL]