Privacy Policy

In short

We collect what we need to run your account, save your maps and process purchases.
Stripe handles payment – we never see or store your card number.
Your maps are private until you share them.
We use a few small cookies: sign-in, an anonymous visitor id, and how you first found us.
We don't sell your personal information or share it for advertising.

This policy explains how XTO Pty Ltd (ACN 702 801 410), trading as mapbow ("we", "us"), handles personal information. We handle it in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and – where they apply to you – the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws such as the California Consumer Privacy Act (CCPA).

1. What we collect

Your account

Your name and email address, and optionally your organisation.
Your password, stored only as a one-way cryptographic hash – we cannot see it.
Your email preferences.

Your maps and uploads

The maps you create: titles, descriptions, drawings, labels, styles, layer choices and settings.
Files you import and images you upload. These may contain personal information if you put it there – please only upload what you have the right to share.
Whether a map is private, shared or listed in the gallery, and basic view counts.

If you start a map before creating an account, it is linked to an anonymous visitor id (see cookies below) so your work isn't lost; it moves to your account when you sign up.

Purchases

Payments are processed by Stripe through Stripe Checkout; for these sales Stripe may act as merchant of record. You enter card details directly with Stripe – we never receive or store your full card number or security code. From Stripe we receive your name, email, billing country or address, any tax id you give, what you bought, the amount, date and payment status, and limited card details such as brand and last four digits.

Website use

Standard server logs: IP address, browser type, pages requested, date and time.
Simple usage events (for example which tools are used) to improve the product.
Place searches you type into the map, which are sent to our search provider to find results.

Support

If you contact us, we keep your message, your email address and our reply.

2. Cookies and local storage

Name	Purpose	Lasts
`User`	Keeps you signed in (encrypted and signed)	6 months
`vid`	An anonymous visitor id that keeps maps you make before signing up, and protects free limits	1 year
`src`	How you first found us (for example a search engine or a link), so we know which channels work	90 days
Local storage	Your light/dark theme, studio preferences and unsaved drafts, kept only in your browser	Until cleared

If we enable Google Analytics or Google Ads conversion measurement, Google sets its own cookies to measure visits and purchases in aggregate. You can block these with your browser settings or Google's opt-out tools without affecting the site.

3. How we use it

To provide the service: your account, saving and showing your maps, unlocking purchases, exports.
To send transactional emails: welcome, password resets, receipts and important service notices.
To answer support requests.
To keep the service secure and prevent fraud and abuse.
To understand and improve the product, using aggregated usage information.
To comply with law, including tax and accounting obligations.

Under the GDPR our legal bases are: performing our contract with you; our legitimate interests in running, securing and improving the service; your consent where we ask for it; and legal obligations.

4. Who we share it with

We share personal information only with service providers who help us run mapbow, under contracts that protect it:

Stripe – payments, tax and receipts.
Hosting and email providers – to run the website and send email.
Map tile and place search providers – your browser requests map tiles and search results directly from them; they see your IP address and the area of the map you view.
Google – analytics, only if enabled.

We may disclose information if required by law, or to protect rights, property or safety. If mapbow is sold or merged, information may transfer to the new owner under this policy. We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as defined by the CCPA.

Maps you share are visible to anyone with the link; gallery maps are public. Shared and public maps do not show your email address.

5. Overseas storage

Our service providers may store or process information outside Australia, including in the United States and Europe. We take reasonable steps to make sure they protect it to a standard comparable to the Australian Privacy Principles and, for EU/UK users, use appropriate safeguards such as standard contractual clauses.

6. How long we keep it

Account information and maps: while your account is open. When you close it, we delete your maps and uploads within 30 days (backups roll off within a further 30 days).
Anonymous maps never claimed by an account: deleted after 12 months without activity.
Order records: 7 years, as required for tax and accounting.
Server logs and usage events: up to 180 days.
Support messages: up to 2 years.

7. Security

We use HTTPS everywhere, hash passwords, encrypt and sign the sign-in cookie, and restrict access to our systems. No system is perfectly secure; if a data breach is likely to cause serious harm, we will notify you and the regulator as the law requires.

8. Your rights

You can ask to access, correct or delete your personal information, to receive a copy of your data, or to object to or restrict certain processing. EU/UK residents may also withdraw consent and complain to their data protection authority; California residents may request to know, delete and correct, and will not be discriminated against for doing so. Email [email protected]; we respond within 30 days and may need to verify your identity. Many details can be changed directly in your account.

9. Children

mapbow is not directed at children under 16, and we don't knowingly collect their personal information without a parent or guardian's consent.

10. Complaints

If you have a concern, contact us first at [email protected] and we will try to resolve it. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au) or your local data protection authority.

11. Changes

We may update this policy. The current version is always on this page, and we will email account holders about significant changes.

12. Contact

XTO Pty Ltd (ACN 702 801 410), L1 457 Elizabeth Street, Surry Hills, NSW 2010, Australia. Email [email protected].