Privacy Policy
Last updated: June 2026
1. Who we are
MapLayer ("we", "us", "our") is a B2B SaaS product providing map-based tools for corporate field teams. This Privacy Policy explains how we collect, use, store, and protect information when you use our service at app.maplayer.io.
2. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email, full name, password (hashed) | Authentication, communication |
| Organization data | Company name, subscription plan | Billing, access control |
| Usage data | Layer configs, map points, visit statuses | Core product functionality |
| Technical data | IP address, browser type, timestamps | Security, debugging |
We do not collect location data from your device in the background. Map coordinates are only those you manually import or enter.
3. How we use your data
- To provide, operate, and improve the MapLayer service
- To send transactional emails (invite links, password resets, billing receipts)
- To manage subscriptions and enforce plan limits
- To respond to support requests
- To comply with legal obligations
We do not sell your data to third parties. We do not use your data for advertising.
4. Data storage & security
All data is stored in Supabase (PostgreSQL) hosted on AWS in the EU (eu-central-1) region. Data is encrypted at rest and in transit (TLS 1.2+). Row-level security (RLS) policies ensure each user can only access their authorized data.
We take industry-standard precautions: no service role keys are exposed to the frontend, all secrets are stored in environment variables, and access is logged.
5. Data sharing
We share data only with trusted sub-processors necessary to operate the service:
- Supabase — database and authentication
- Google Maps Platform — map rendering and geocoding
- Stripe — payment processing
- Vercel — frontend hosting
All sub-processors are contractually bound to process data only as instructed and maintain appropriate security standards.
6. Your rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Object to processing or request restriction
- Data portability (export your data)
To exercise any of these rights, email us at privacy@maplayer.io. We will respond within 30 days.
7. Data retention
We retain your data for as long as your account is active. If you cancel, we retain data for 90 days to allow reactivation, then delete it. Billing records are retained for 7 years as required by law.
8. Cookies
MapLayer uses only technically necessary cookies (session token). We do not use tracking or advertising cookies. No cookie consent banner is shown.
9. Changes to this policy
We may update this policy. If changes are material, we will notify you by email at least 14 days before they take effect.
10. Contact
Questions about privacy? Contact us at privacy@maplayer.io.