Privacy Policy

1.Who we are

Mapsie (mapsie.shop) is run by DayzeOut Limited, registered in England and Wales (company no. 15305920), registered office 124–128 City Road, London, EC1V 2NX, United Kingdom. We are the “controller” of your personal information, which means we decide how and why it is used and we're responsible for looking after it.

For anything to do with your personal information, email privacy@mapsie.shop, or write to us at our registered office. For orders and anything else, use support@mapsie.shop.

This policy is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the EU GDPR where it applies, the Australian Privacy Act 1988 and Australian Privacy Principles, and US state privacy laws. Sections 10 and 11 have extra information for customers in Australia and the US.

2.What we collect, and why

Your designs

The maps you create: the places you search for and add as stops, routes, styles, stickers, the text and notes you write, and any photos you upload. Photos are stored inside the design they belong to. Your design in progress is autosaved in your own browser. A copy is stored on our servers when you save it to your account or go to checkout.

Your designs can reveal things about you, like where you've travelled, and your photos may show you or other people. We use them only to save your work, show it back to you, and print your order. Please only upload photos of other people if they're happy for you to.

Your account (if you sign in)

When you sign in with Google, Google shares your name, email address and profile picture with us, along with a unique Google account ID. We use these to create your account, keep you signed in, save your designs and show you your order history. We don't get your Google password or access to anything else in your Google account. We also record when you created your account and last signed in.

If you create an account with your email and a password instead, we store your email, the first name you give us (if any) and a secure one-way hash of your password, never the password itself. We email you a link to confirm your address, and a link to reset your password if you ask for one.

Your orders

When you order, we collect your email address, name and delivery address, the product, size, frame and delivery option you chose, the price and currency, and your order's status. We create a high-resolution print file of your design to send to our print partner.

Payments

Payments are handled by Stripe on its secure checkout page. We never see or store your full card number. Stripe tells us whether your payment succeeded and gives us the delivery details you enter at checkout.

When you contact us

If you email us, we keep your message, your email address and anything you send us (such as photos of a damaged print) so we can help you.

Technical information

Like any website, our servers receive your IP address and basic information about your browser when you visit. Our hosting provider keeps short-term technical logs to run the service securely. We don't use this information to identify you or track you across the web.

Anonymous usage statistics

We count anonymous steps people take on the site (for example "opened the designer", "reached checkout", "paid") and the words typed into the sticker search, with the website that sent them, the first page they landed on and whether they used a phone or a computer. Each visit gets a random number that lives only in the open page and isn't stored on your device or linked to your name, email or IP address. We use this, in our legitimate interest in running and improving the shop, to see where the site is confusing. Browsers sending Global Privacy Control or Do Not Track signals aren't counted. When you place an order we note the visit's random number on the order so we can count it as "paid", and nothing more.

We don't ask for, and don't want, sensitive information such as health details or religious or political beliefs. Please don't include it in your designs or messages.

3.Our lawful bases for using your information

UK and EU data protection law requires us to have a lawful basis for each use of your information. Ours are:

Where we rely on legitimate interests, we've balanced them against your rights and you can object (see section 9). We don't send marketing emails. If we start, we'll only send them to people who have agreed to receive them, and every email will have an unsubscribe link.

4.Who we share your information with

We use trusted service providers to run Mapsie. They only process your information on our instructions, or as independent services you use directly, and only for the purposes below.

We may also share information:

• with professional advisers such as accountants and lawyers, where needed;
• where the law requires it, for example with tax authorities, the police or a court;
• with a buyer or investor if our business, or part of it, is sold or restructured, in which case they'd have to protect your information in line with this policy.

We never sell your personal information, and we don't share it with anyone for advertising.

5.International transfers

Our website and database are hosted in the European Union (Frankfurt, Germany). The UK recognises the EU as providing an adequate level of protection for personal information.

Some of our service providers are based in, or use systems in, other countries. In particular, Stripe and Google may process information in the United States, and Prodigi prints and ships your order from a site in or near your country, so if you order from the US or Australia, your order details will be processed there. Where your information is transferred outside the UK or EU to a country without an adequacy decision, we make sure it is protected by appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. Contact us if you'd like more details.

6.How long we keep your information

We keep information only as long as we need it, then delete it or make it anonymous.

We may keep information for longer if we need it to deal with a complaint or legal claim, or if the law requires it.

7.How we keep it safe

Everything you send to mapsie.shop is encrypted in transit (HTTPS). Access to our systems is restricted to the people who need it, and our admin area is protected by Google sign-in plus an authenticator-app code. Card payments are handled entirely by Stripe. No system is perfectly secure, but if we ever have a data breach that puts you at risk, we'll tell you and the regulator as the law requires.

8.Children

Mapsie isn't aimed at children, and you must be 18 or over (or have a parent or guardian's permission) to place an order. We don't knowingly collect information from children under 13. If you think a child has given us their information, please contact us and we'll delete it.

9.Your rights

Under UK and EU data protection law, you have the right to:

• access the personal information we hold about you and get a copy;
• correct information that's wrong or incomplete;
• delete your information (sometimes called the “right to be forgotten”), unless we have to keep it, for example order records for tax;
• restrict how we use your information, for example while a complaint is looked into;
• object to us using your information where we rely on legitimate interests;
• data portability: receive the information you gave us in a common, machine-readable format, or have it sent to another organisation;
• withdraw consent at any time, where we rely on consent.

We don't make decisions about you using solely automated processing that have legal or similarly significant effects.

To use any of these rights, email privacy@mapsie.shop. It's free, and we'll reply within one month. We may need to confirm your identity first, for example by asking you to email us from the address linked to your account or order.

10.Extra information for customers in Australia

We handle your personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). In particular:

• You can ask to access the personal information we hold about you, and to correct it, by emailing privacy@mapsie.shop. We'll respond within 30 days.
• Overseas disclosure: we are based in the UK, our servers are in Germany, and some of our service providers process information in the United States. Your order is printed and delivered locally in Australia by our print partner, Prodigi. See section 4 and section 5 for who receives your information and how we protect it.
• You can deal with us without giving your name while you design maps, but we need your name, email and address to fulfil an order.
• If you have a complaint, please contact us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

11.Extra information for customers in the United States

Some US states, including California, Colorado, Connecticut, Virginia and others, give residents specific privacy rights. Whether or not those laws apply to a business of our size, we're happy to honour these requests from any US customer.

• What we collect: identifiers (name, email, delivery address, IP address, Google account ID), commercial information (your orders), the content you create (designs, text and photos), and limited technical information. Section 2 explains the sources and purposes. We don't collect sensitive personal information beyond what you choose to put in your own designs, and we don't use it to infer anything about you.
• No selling or “sharing”: we do not sell your personal information or share it for cross-context behavioural advertising, and we haven't done so in the last 12 months. We don't use tracking technology, so there's nothing to opt out of.
• Your rights: you can ask to know what information we hold and how we use it, to get a copy, to correct it, and to delete it. Email privacy@mapsie.shop. You can use an authorised agent, and we may need to verify your identity. If we decline your request, you can appeal by replying to our decision.
• No discrimination: we won't treat you differently for using your privacy rights.
• Retention periods are in section 6.

12.Complaints

If you're unhappy with how we've handled your information, please contact us first at privacy@mapsie.shop so we can try to put it right.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or by phone on 0303 123 1113. If you live in the EU, you can complain to the data protection authority in your country. Australian customers can contact the OAIC (see section 10).

13.Changes to this policy

We'll update this policy if we change how we use your information, for example if we add a new service provider. The “Last updated” date at the top shows when it last changed. If a change significantly affects you, we'll let you know before it takes effect. See also our Cookie policy and Terms & Conditions.