1. Who is responsible
MapAPlace is operated by Creative Shed Agency Ltd, company number 06660990, registered at 4 Lidgett Lane, Garforth, Leeds, England, LS25 1EQ. We are the controller where we decide how and why personal data is processed.
Customers are responsible for ensuring that personal data they add to a map may lawfully be processed and published.
2. Data we process
- Account data including email address, identifiers, authentication records, password hashes and account status.
- Map content including names, markers, categories, settings and uploaded image assets.
- Subscription and transaction references. Stripe collects full payment-card details on its hosted pages; MapAPlace does not store complete card numbers.
- Technical and security data including IP address, request details, browser information, diagnostic logs and security events.
- Information you send in support, complaint, account or legal correspondence.
3. How and why we use data
We process data to provide and secure accounts, save and publish maps, operate APIs, administer subscriptions, provide support, prevent abuse, diagnose reliability problems, enforce our terms and comply with law.
Our lawful bases include performance of a contract, legitimate interests in operating and securing the service, legal obligations, and consent where a feature specifically requests it.
4. External providers
- Stripe provides hosted checkout, the billing portal and subscription processing.
- OpenFreeMap supplies standard map styles and tiles. A visitor's browser requests those resources and normally sends its IP address and request information.
- Optional location suggestions use Photon, a third-party location search service. Before consent, the location field shows an inline enable control instead of the search input. Photon is contacted only after the visitor enables location search. The browser then sends the search text and basic connection details to Photon.
- Hosting, email and infrastructure providers process the limited data needed to operate and secure the service.
5. Public and password-protected maps
A map published without password protection is public and may be linked to, embedded, cached, copied or redistributed. Customers are responsible for the notices and permissions relating to their content.
When a visitor unlocks a password-protected map, MapAPlace issues a signed token bound to that map for up to eight hours. Password protection limits access but does not guarantee confidentiality.
6. Retention and deletion
We keep account, map, integration and billing records only as long as needed to provide the service, meet legal obligations, handle disputes, prevent abuse and maintain proportionate backups. Backups may retain deleted data temporarily until they rotate out.
Account deletion follows the confirmation process shown in the account area. Some billing, security or legal records may need to be retained after deletion.
7. Your rights and contact
Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent and complain to a supervisory authority.
Send privacy questions or requests to hello@mapaplace.com. You may also complain to the UK Information Commissioner's Office or another competent supervisory authority.