Privacy Policy
Privacy Policy
Last updated: 5 August 2026
MapVectorizer is a tool for making maps, not for collecting people. We ask for as little personal data as the service can run on, we do not sell it, and we do not run advertising or third-party tracking. This page sets out exactly what we hold and what you can do about it.
The short version: we store your name and email address, your credit balance, and a log of your exports so the service works and you can be billed. Payments go through Stripe; we never see your card number. We do not store the maps you make. There are no advertising or analytics trackers on this site or in the app. You can delete your account and data yourself from your profile at any time.
1. Who is responsible for your data
The controller of the personal data described here is MapVectorizer, a service operated under Chamber of Commerce (KvK) registration number 66656990 in the Netherlands. For any privacy question or request, contact contact@mapvectorizer.com or use the contact form.
2. What we collect, why, and on what legal basis
| Data | Why we have it | Legal basis (GDPR Art. 6) |
|---|---|---|
| Name, email address and account identifier | To create and secure your account, sign you in, address you in the app, and send receipts and essential service notices | Performance of a contract |
| If you sign in with Google: your Google account email, name and profile picture | To authenticate you without a separate password | Contract, at your choice — email sign-up is the alternative |
| Credit balance and credit history (timestamp, whether an export was SVG or PNG, credits spent, top-ups) | To run the pay-per-export model, show your balance, handle refunds and keep accurate books | Contract; legal obligation for tax records |
| A one-way hash of your email address in our sign-up bonus ledger | To grant free starting credits once per person and stop the same address claiming them repeatedly | Legitimate interest in preventing abuse of free credits |
| Billing address, country and any VAT number you enter at checkout, held at Stripe | To charge the correct VAT and issue valid invoices — Stripe requires a billing address | Legal obligation |
| Payment records held at Stripe (card brand and last four digits, status, amount) | To take payment and reconcile it; we never receive full card details | Contract |
| Your newsletter opt-in, if you tick the box at sign-up or in your profile | To send product news you asked for | Consent — withdrawable at any time |
| Messages you send us through the contact form or by email | To answer you and keep a record of the conversation | Legitimate interest in supporting our users |
| Server logs (IP address, request time, user agent, errors) | Security, abuse prevention, rate limiting and debugging | Legitimate interest in keeping the service secure and working |
| Map area selections and style settings during a session | To render your preview and generate the export you asked for | Contract |
We do not ask for a phone number or any special-category data, we do not build behavioural profiles, and we make no automated decisions with legal effects about you. We do not keep the maps you make: the area you select, your style settings and any shapes or labels you add are processed to render your preview and build your export, and are not stored on our servers afterwards.
3. What we do not do
- We do not sell, rent, or trade personal data.
- We do not run advertising networks, ad pixels, or third-party analytics on this website or in the app.
- We do not track you across other websites.
- We do not use your map selections or exports to build a product for anyone else.
4. Cookies and local storage
We use no advertising or analytics cookies, so there is no consent banner to click away. What we do use is strictly functional:
- Session token — your sign-in session is kept in your browser's local storage by our authentication provider. Without it you would have to log in again on every page.
- Local preferences — small values stored in your own browser, such as your light/dark theme choice and whether you have seen the first-run walkthrough or dismissed a notice. These never leave your device.
- Stripe sets its own cookies on its checkout page for fraud prevention; see Stripe's privacy policy.
- Google sets cookies on its own sign-in page if you choose "continue with Google".
5. Processors and third parties
We use a small number of providers to run the service. Each acts as a processor on our instructions under a data processing agreement, or as an independent controller where noted.
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database, authentication and hosting of account data | Email, account record, credits, export history |
| Stripe | Payment processing and invoicing (independent controller for payment data) | Payment and billing details |
| Railway | Application and website hosting | Server logs |
| Google (Sign in with Google) | Optional authentication, if you choose it | Your Google account email, name and profile picture |
| FormSubmit | Delivery of contact-form messages to our inbox | Name, email and message you type |
| Google Fonts & Fontshare | Web fonts used by the site and app | Your IP address, as an unavoidable part of requesting the font files |
| OpenFreeMap and OpenMapTiles | Base map tiles and map fonts in the editor | The map area you are viewing and your IP address |
| Photon (Komoot) | Place search in the editor | What you type in the search box and your IP address |
| OSRM routing hosted by FOSSGIS (routing.openstreetmap.de) | Route overlays, if you draw one | The start and end points you pick and your IP address |
The last four are requested by your browser directly while you use the editor, so those services see your IP address as any website request would. We do not send them your account details.
6. International transfers
Some of these providers are established outside the European Economic Area, or use infrastructure there. Where personal data is transferred outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism. You can ask us which mechanism applies to a specific provider.
7. How long we keep things
- Account data — for as long as your account exists, and deleted when you close it, except where we must keep records longer.
- Invoices and payment records — seven years, as Dutch tax law requires. These sit with Stripe and in our books and survive account deletion.
- Credit history — kept with the account, so we can resolve billing questions.
- Generated files and map selections — not retained. Nothing you draw or export is stored on our servers.
- Sign-up bonus ledger — the one-way hash of your email stays after account deletion. It is what stops the free starting credits being claimed again with the same address, and it cannot be turned back into your email.
- Newsletter opt-in — until you unsubscribe or delete your account.
- Server logs — a short rolling window, typically no more than 90 days.
- Support messages — up to two years after the conversation ends.
8. Security
Data is transmitted over HTTPS and stored on managed infrastructure with access restricted to what is needed to operate the service. Passwords are handled by our authentication provider and stored only as salted hashes. No system is perfectly secure, but if a breach affects your personal data and poses a risk to you, we will notify you and the Dutch Data Protection Authority as the GDPR requires.
9. Your rights
Under the GDPR you have the right to:
- Access a copy of the personal data we hold about you.
- Rectify data that is wrong or incomplete.
- Erase your data ("right to be forgotten"), subject to records we must keep by law.
- Restrict or object to processing based on legitimate interest.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time, where processing rests on consent.
You can delete your account yourself: open your profile in the app and choose "Delete account". That removes your profile, credit history and login. To unsubscribe from the newsletter, use the link in any newsletter email or untick the option in your profile. For anything else, email contact@mapvectorizer.com from your account address and we will respond within one month. There is no charge for a reasonable request. If you are not satisfied with how we handle it, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.
10. Children
The service is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will remove it.
11. Changes to this policy
If we add a provider, a feature that collects new data, or change a retention period, we will update this page and the date above. Material changes affecting account holders will be announced by email or in the app.
12. Contact
Privacy questions, access and deletion requests: contact@mapvectorizer.com, or use the contact form.