Privacy policy
Last updated 20 October 2026
This policy explains what DeltaBreen Limited collects when you use Maps by DeltaBreen, why, and what we do with it. We are the controller for account, billing and usage data. For the people who view maps on your site ("end users") you are the controller and we are a processor that serves tiles to their browsers.
What we store, and for how long
| Data | Why (lawful basis) | How long |
|---|---|---|
| Account: email address, session token versions, admin flag, and which version of the terms you accepted and when | To run your account (contract) | Until you delete the account; the row is anonymised then |
| Sign-in codes: a keyed hash of each code and of the IP address that asked for it, never the code itself | To sign you in, and to stop guessing (contract, legitimate interest) | Deleted a day after the code expires |
| The bot check on the sign-in form (Cloudflare Turnstile): Cloudflare sees your IP address and browser signals to tell a person from a script | Abuse prevention (legitimate interest) | Nothing kept by us |
| Workspace: name, members, invitations, roles | Team workspaces (contract) | Until removed |
| Keys: names, allowed origins, a hash of each secret key, publishable keys | To issue tokens (contract) | Until revoked; revoked rows kept for the audit trail |
| Usage: tokens issued per key per day, month totals, which threshold notices were sent | To enforce plans and show you usage (contract) | 730 days for daily rows; month totals with the account |
| Styles: names, palettes, style JSON, published versions | The designer and the served styles (contract) | Until deleted; published versions until 30 days after the account is deleted |
| Data layers and icons you upload, whatever they contain, and the logs of their conversion | To host them for your maps (contract) | Until you delete them, or 30 days after the account is deleted |
| Maps you build in the dashboard: their names and settings, their pins as you enter them (titles, addresses, phone numbers, links, photo addresses, opening hours, notes), and the last 20 saves of each, kept so one can be brought back | To show them on your sites (contract) | Until you delete them, when they and their saves are removed at once; when the account is deleted they stop showing at once and are removed 30 days later |
| A sheet you link to a map (Lite and above): its link, what each read found, and the place each address in it was looked up to | To keep the map's pins as the sheet has them, read every 15 minutes, with each new address looked up once (contract) | Until you stop reading the sheet or delete the map; a looked-up address no longer in the sheet is forgotten 30 days after it was looked up |
| Visitor stats (Lite and above): for each map and day, how many times it was viewed, which places were opened (by the place's title) and which of their buttons pressed, and the towns searched (the town a visitor picked, never what they typed); no address, IP address or cookie | To show you what visitors do with your maps (contract) | 13 months; a deleted map's at once |
| Account API keys (a hash of each) and assistants you connect: their names, scopes and hashed access tokens | To let your servers and assistants act for your workspace (contract) | Until revoked; an assistant's tokens 30 days after they expire |
| Billing: Paddle customer, subscription and transaction identifiers and net amounts | Plan entitlement (contract, legal obligation) | Seven years (accounting) |
| Audit log: who changed what in a workspace, with a truncated hash of the actor's IP address | Security and the Business audit feature (legitimate interest, contract) | 400 days |
| Rate-limit counters keyed by hashed IP address, email address or key | Abuse prevention (legitimate interest) | About a day |
| A deleted account: a keyed hash of its email address and that month's usage totals, no address | So deleting and re-creating an account cannot reset a month's allowance (legitimate interest) | Sixty days after deletion |
| The busiest sites showing our maps each day: each site's name, its tile and visitor counts, and which keys its tiles carried; end users' addresses are only counted, never stored | To spot one token shared by a whole site, which the Terms do not allow (legitimate interest) | 31 days |
| For each map token, keyed hashes of the addresses its tiles reached our server from, only to count them | To stop one token serving a whole site (legitimate interest) | About a day |
| Tokens that look shared: which key and workspace, and whether stopped or flagged | The same, and to contact the customer (legitimate interest) | 31 days |
| Support messages and any files you attach, kept in Help by DeltaBreen, our own helpdesk; from the Contact page without an account, your email address too | Helping you (contract, or legitimate interest when you have no account) | A year after the conversation is closed |
| A discount request sent from the pricing page's own form before 20 October 2026 (since then they are support messages, above): whether you are a charity, school or university, your organisation's name, your email address and your message | To answer your request (legitimate interest) | A year after you send it |
| Emails we send you: the address, only until our email provider has accepted the email (then its first letter and domain), the subject and the kind of email, never the body | To know what was sent and whether it arrived (legitimate interest) | One to two months; monthly counts after that |
| Notices to our own team in Slack: new accounts, support tickets, discount requests and usage warnings, with your address shortened to its first letter and domain | Running the service (legitimate interest) | As long as the team's message history |
End users of your maps
When someone views a map on your site, their browser requests a token from us (with your key and the page's origin) and then tiles from our tile host. We count the token; we do not store which tiles were requested, and we keep no record of end users' addresses beyond our own servers' logs, kept at most 30 days for security. Cloudflare, our edge provider, handles the requests that pass through it as our sub-processor under its data processing addendum, which governs its own logs; map tiles on a plan without the worldwide cache may come straight from our tile server and not through Cloudflare. When a visitor searches your map, the text they type and the map's position are sent to us with your key, and so is their location if they choose to share it (for example with "Use my location" in a store locator); the same goes for an elevation request, the points of a route, distance table or travel-time area, and a static map image's points. We answer and count the request and do not store what was searched for or where anyone was; a static image's settings are kept a week so the same picture is counted once. Once a day we count, from our edge provider's analytics, how many different addresses the busiest sites' tiles went to, and our server counts, as keyed hashes kept about a day, how many different addresses each token is used from; both only to spot one token shared by a whole site, and no address is stored. On plans with visitor stats, the map counts in the visitor's browser what they do with it (that it was shown, which places they opened, which buttons they pressed, the town they picked in a search) and sends only those counts when they leave the page, with no cookie, no address and nothing they typed; we keep the counts per map and day, and nothing in them tells one visitor from another. We set no cookies on the tile host and use no third-party analytics scripts.
Where and with whom
The API, database and tile origin run on servers in the EU. Sub-processors we use, and where they process data, are listed in the data processing agreement; where a sub-processor is outside the EU we rely on an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses. We do not sell data. We disclose data to authorities only under a lawful order.
Your rights
Under the GDPR you can ask for access to, correction of, deletion of, or a copy of the data we hold about you, object to processing based on legitimate interest, and complain to a supervisory authority; in Ireland that is the Data Protection Commission. Most of this you can do yourself in the app, including deleting your account (Settings, Delete account). For anything else, email [email protected]; we answer within one month.
Security
Secret keys are stored as hashes; the tile token secret and other server secrets are kept outside the database. Transport is TLS only. Access to production is limited to the operator, over a private network, with every administrative action logged. If a breach affects personal data we hold we will notify the Data Protection Commission within 72 hours and affected users without undue delay.
Cookies and storage
The app keeps a session token in browser storage so you stay signed in. Nothing is set for tracking. Clearing site data signs you out. On a site whose maps ask before they load, a visitor who ticks "Always show maps on this site" has that choice kept in their browser's storage for that site, and nothing else; no cookie is set.
Aggregated data
We may create and keep aggregated or anonymised statistics — such as total loads, error rates or capacity trends — that do not identify anyone, and use them to run, secure and improve the service. Because these cannot be linked back to a person, we may keep and use them without time limit.
Children
The service is a tool for businesses and developers and is not directed at children. We do not knowingly collect personal data from a child under 16; if you believe a child has given us data, contact us and we will delete it.
Changes to this policy
We may update this policy as the service changes. For a material change we will give notice by email or in the app before it takes effect; the "last updated" date above always shows the current version.