Privacy Policy

Last updated: September 13, 2026

This notice explains how PolyMapper handles personal information when you visit the website, use the editor or API, pay for a subscription, or contact support.

Information we process

• Account and sign-in: your email address, account identifiers, sign-in and session information, and profile details supplied by a sign-in provider if you choose one. Supabase handles authentication. Passwords are stored as hashes, not as readable passwords.
• Your workspace: layer and polygon names, coordinates, properties, and creation/update timestamps. Imported data may contain personal or confidential information. Only upload information you are entitled to use, and avoid unnecessary personal data.
• Billing: Stripe customer and subscription identifiers, subscription status, trial and billing dates, and cancellation information. Stripe processes payment details; PolyMapper does not store full card numbers.
• API access: API-key names, prefixes, hashes, creation dates, last-use timestamps, and revocation status. Keep the full key secret.
• Technical and support information: requests, device/browser details, IP addresses and error diagnostics needed to operate and protect the service, plus messages and attachments you send to support.

Why we use it

We process account, workspace, and subscription information to provide the service and perform our agreement with you. We use necessary security and diagnostic information for our legitimate interests in preventing abuse and maintaining a reliable service. Billing records may also be retained to meet legal obligations. Optional website analytics runs only after your consent, which you can withdraw.

Service providers and map requests

• Supabase provides authentication and database infrastructure.
• Stripe handles checkout, payment processing, subscriptions, and billing management.
• Mapbox supplies maps and related assets. Opening the editor makes requests to Mapbox, which can receive your IP address, browser information, and requested map areas. These necessary map requests are separate from optional website analytics.
• Vercel provides website services and the optional public-page analytics integration.
• Proton Mail handles email sent to our support address.

Service providers may process information outside your country. Applicable provider agreements and transfer safeguards govern that processing. Contact us for information about the arrangements relevant to your request. We may also disclose information where required by law or necessary to protect the service and its users.

Cookies, local storage, and analytics choices

Essential cookies support authentication and sessions. Browser storage may remember preferences. The optional analytics choice is stored locally for up to 180 days. Rejecting analytics does not prevent you from using the service.

When allowed, Vercel Analytics measures visits to public pages. This integration excludes private account and editor pages, strips URL queries and fragments, and does not send your polygon contents. You can change your choice through Privacy settings in the footer. Security and service-operation logs are separate from optional analytics.

Retention and deletion

Workspace and account records are kept while needed to provide your account. Completing account deletion removes the active account and its workspace records and closes linked subscriptions. Backup copies, security records, support correspondence, and provider billing records may remain for recovery, dispute handling, or legal requirements. Their retention depends on purpose and provider settings; contact us for details. Cancellation of renewal alone does not delete your account or workspace.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. You can withdraw optional analytics consent without affecting earlier lawful processing. You may also complain to the data-protection authority where you live or work.

Use account settings for password changes and account deletion. GeoJSON exports are available with an active subscription or trial. You can also request a copy of your personal information by email, including after a subscription expires. We may verify ownership before fulfilling a request.

Security

We use authenticated access, database row-level policies, restricted server credentials, and encrypted connections to help protect information. No online service can guarantee absolute security. Never share passwords or API keys in support messages.

Children and policy changes

The service is not designed for children. Contact us if you believe a child has provided personal information. Material policy updates will be published here with a new revision date; additional notice will be provided where required.

Contact

For support, privacy requests, or questions about these terms, email polymapper@protonmail.com.