Mapzio

Privacy Policy

Last updated July 2026

This Privacy Policy describes what data Mapzio ("we", "us") collects when you use the Service, why, and the choices you have over it.

1. Data we collect

Directly from you:

  • Account details - name, email address, and a hashed (never plaintext) password.
  • Content you create - event site plans, map elements, comments, notes, cover images, and exported images, plus organization names and member roles.
  • Support or billing communications you send us.

Automatically:

  • Session data - a session token, the IP address and browser user-agent used to sign in (used for security purposes such as detecting sign-ins from a new device).
  • Basic usage data inherent to operating the Service (e.g. rate-limit counters to prevent abuse).

From third parties:

  • Billing status from Stripe (plan, subscription status) if your organization subscribes to a paid plan. We do not receive or store your card number - Stripe handles payment details directly.

2. How we use it

  • To provide and operate the Service (authentication, collaboration, billing, email notifications);
  • To keep the Service secure (rate limiting, detecting suspicious sign-ins, sending security alerts);
  • To communicate with you about your account, security events, and (if applicable) billing;
  • To comply with legal obligations.

We do not sell your personal data, and we do not use your content to train any models.

3. Third-party services we rely on

  • Stripe - payment processing and subscription billing for paid plans.
  • Your organization's email provider (SMTP) - delivering verification, password-reset, invite, and security-notification emails.
  • Esri - satellite/street map tile imagery displayed in the map editor.
  • OpenStreetMap Nominatim - address search/geocoding when you search for a site location.

Each of these providers processes only what's needed to perform their function for the Service.

4. Cookies and local storage

We use a small number of essential cookies: a session cookie (keeps you signed in), and cookies that remember your language and which organization you're currently viewing. We also use your browser's local storage for interface preferences (light/dark theme, sidebar state, pinned tools). None of these are used for advertising or cross-site tracking.

5. Public share links

If you or someone in your organization enables a public share link for an event, anyone with that link can view the event's name, description, and map layout without signing in. Public share links and organization invite links are opt-in and can be disabled at any time by an event owner or org admin.

6. Data retention

We retain account and content data for as long as your account exists. Deleting your account (Settings → Danger Zone) permanently removes your profile, sessions, and - for any organization where you were the sole member - that organization's events, map data, and exported files. See the in-app deletion flow for exactly what's removed before you confirm.

7. Your rights

From Settings, you can update your account details, download a copy of your account and organization data ("Export my data"), and permanently delete your account ("Delete my account"). Depending on your location, you may have additional rights (access, correction, portability, objection) under laws such as the GDPR or CCPA - contact us if you'd like help exercising them.

8. Security

Passwords are hashed with bcrypt and never stored in plaintext. Two-factor authentication is available from Settings. We rate-limit authentication endpoints and send you an email whenever your password changes or your account is signed into from an unrecognized device.

9. Children's privacy

The Service is intended for business use and is not directed at children under 16.

10. Changes to this policy

We'll update the "Last updated" date above when this policy changes and, for material changes, notify you by email.

11. Contact

Questions about this policy or your data? Reach us at the support address listed in the app.

This page is a general template and is not a substitute for advice from a qualified lawyer familiar with your business and jurisdiction.