1. Who is responsible
MapAPlace is operated by Creative Shed Agency Ltd, company number 06660990, registered at 4 Lidgett Lane, Garforth, Leeds, England, LS25 1EQ. We are the controller where we decide how and why personal data is processed.
Customers are responsible for ensuring that personal data they add to a map or send through a connected WordPress website may lawfully be processed and published.
2. Data we process
- Account data including email address, identifiers, authentication records, password hashes and account status.
- Map content including names, markers, categories, settings and uploaded image assets.
- WordPress connection data including site addresses, credential identifiers, permissions and connection status. Secret credentials are protected and are not displayed after creation.
- Subscription and transaction references. Stripe collects full payment-card details on its hosted pages; MapAPlace does not store complete card numbers.
- Technical and security data including IP address, request details, browser information, diagnostic logs and security events.
- Information you send in support, complaint, account or legal correspondence.
3. How and why we use data
We process data to provide and secure accounts, save and publish maps, operate APIs and WordPress connections, administer subscriptions, provide support, prevent abuse, diagnose reliability problems, enforce our terms and comply with law.
Our lawful bases include performance of a contract, legitimate interests in operating and securing the service, legal obligations, and consent where a feature specifically requests it.
4. WordPress connections
An authorised WordPress administrator must approve a connection. The connection exchanges the site address, secure callback information, plugin version and credentials required for authenticated map-management requests.
Disconnecting or revoking a WordPress connection prevents new authenticated requests but does not automatically delete the MapAPlace account or maps stored by the service.
5. External providers
- Stripe provides hosted checkout, the billing portal and subscription processing.
- OpenFreeMap supplies standard map styles and tiles. A visitor's browser requests those resources and normally sends its IP address and request information.
- Optional location suggestions use Photon, a third-party location search service. Before consent, the location field shows an inline enable control instead of the search input. Photon is contacted only after the visitor enables location search. The browser then sends the search text and basic connection details to Photon.
- Hosting, email and infrastructure providers process the limited data needed to operate and secure the service.
6. Public and password-protected maps
A map published without password protection is public and may be linked to, embedded, cached, copied or redistributed. Customers are responsible for the notices and permissions relating to their content.
When a visitor unlocks a password-protected map, MapAPlace issues a signed token bound to that map for up to eight hours. Password protection limits access but does not guarantee confidentiality.
7. Retention and deletion
We keep account, map, integration and billing records only as long as needed to provide the service, meet legal obligations, handle disputes, prevent abuse and maintain proportionate backups. Backups may retain deleted data temporarily until they rotate out.
Account deletion follows the confirmation process shown in the account area. Some billing, security or legal records may need to be retained after deletion.
8. Your rights and contact
Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent and complain to a supervisory authority.
Send privacy questions or requests to hello@mapaplace.com. You may also complain to the UK Information Commissioner's Office or another competent supervisory authority.