This is a prototype and not a finished product. Some features may be missing or incomplete.Developed by Mousewerk
Mapzio

Privacy Policy

Last updated July 2026

1. Controller

The controller responsible for processing your personal data under the General Data Protection Regulation (GDPR) is:

Mousewerk
Maurice Kleindienst
Weserstraße 16 A, 34125 Kassel, Germany
Email: hello@mapzio.de

See our Impressum for our full legal notice.

2. Data we collect, and why (legal basis)

Directly from you:

  • Account details - name, email address, and a hashed (never plaintext) password. Processed to perform our contract with you (Art. 6(1)(b) GDPR).
  • Content you create - event site plans, map elements, comments, notes, cover images, and exported images, plus organization names and member roles. Processed to perform our contract with you (Art. 6(1)(b) GDPR).
  • Support or billing communications you send us. Processed on the basis of our legitimate interest in responding to you (Art. 6(1)(f) GDPR).

Automatically:

  • Session data - a session token, the IP address and browser user-agent used to sign in. Processed on the basis of our legitimate interest in keeping the Service secure (Art. 6(1)(f) GDPR) - for example, detecting sign-ins from a new device.
  • Basic usage data inherent to operating the Service (e.g. rate-limit counters to prevent abuse). Same legal basis as above.

From third parties:

  • Billing status from Stripe (plan, subscription status) if your organization subscribes to a paid plan, processed to perform our contract with you. We do not receive or store your card number - Stripe handles payment details directly.

3. We do not sell your data

We do not sell your personal data, and we do not use your content to train any models.

4. Recipients and international transfers

We share personal data only with the following categories of recipients, each strictly for the purpose listed:

  • Stripe (Stripe Payments Europe, Ltd. and/or Stripe, Inc.) - payment processing and subscription billing for paid plans. Stripe is bound by the EU Standard Contractual Clauses (SCCs) for any transfer of data outside the EU/EEA.
  • Our email delivery provider (SMTP) - delivering verification, password-reset, invite, and security-notification emails.
  • Esri - satellite/street map tile imagery displayed in the map editor.
  • OpenStreetMap Nominatim - address search/geocoding when you search for a site location.
  • Our hosting provider (Hetzner Online GmbH, Germany) - the Service and its database run on infrastructure located in the EU.

We have (or, where still outstanding, are putting in place) a data processing agreement (Art. 28 GDPR) with each processor listed above.

5. Cookies and local storage

We use a small number of essential/strictly-necessary cookies: a session cookie (keeps you signed in), and cookies that remember your language and which organization you're currently viewing. Under §25 TTDSG, these do not require consent because the Service cannot function without them. We also use your browser's local storage for interface preferences (light/dark theme, sidebar state, pinned tools). None of these are used for advertising or cross-site tracking.

6. Public share links

If you or someone in your organization enables a public share link for an event, anyone with that link can view the event's name, description, and map layout without signing in. Public share links and organization invite links are opt-in and can be disabled at any time by an event owner or org admin.

7. Data retention

We retain account and content data for as long as your account exists, plus any period required by statutory retention obligations (e.g. German commercial/tax record-keeping rules for invoices, typically up to 10 years for those records specifically). Deleting your account (Settings → Danger Zone) permanently removes your profile, sessions, and - for any organization where you were the sole member - that organization's events, map data, and exported files. See the in-app deletion flow for exactly what's removed before you confirm.

8. Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you (Art. 15);
  • Have inaccurate data corrected (Art. 16);
  • Have your data erased ("right to be forgotten") (Art. 17);
  • Restrict or object to processing (Art. 18, 21);
  • Receive your data in a portable format (Art. 20);
  • Withdraw consent at any time, where processing is based on consent.

From Settings, you can update your account details, download a copy of your account and organization data ("Export my data"), and permanently delete your account ("Delete my account"). For anything else, contact us at hello@mapzio.de.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (as our registered address is in Hesse), or the supervisory authority in your own EU member state.

9. Security

Passwords are hashed with bcrypt and never stored in plaintext. Two-factor authentication is available from Settings. We rate-limit authentication endpoints and send you an email whenever your password changes or your account is signed into from an unrecognized device.

10. Children's privacy

The Service is not directed at children under 16, and we do not knowingly collect their data.

11. Changes to this policy

We'll update the "Last updated" date above when this policy changes and, for material changes, notify you by email.

12. Contact

Questions about this policy or your data? Reach us at hello@mapzio.de.

This page is a general template and is not a substitute for advice from a qualified lawyer familiar with your business and jurisdiction.