Privacy Notice

1. Data we collect and why

• Account data (email address, display name, hashed login credentials or Google sign-in identifier) — to create and secure your account and authenticate you. Legal basis: performance of our contract with you.
• Subscription and entitlement data (plan, status, renewal date, payment provider subscription and customer identifiers) — to grant and maintain paid access. Legal basis: contract performance. Card and billing details are collected and stored by Paddle, not by us.
• Content you submit (venue notes, ratings, error flags with cited sources, city requests, saved tour routes) — to operate the Service and publish notes to other signed-in users. Legal basis: contract performance and our legitimate interest in maintaining an accurate, community-reviewed dataset.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Usage and technical data (pages viewed, searches and lookups performed, device and browser type, IP address, timestamps, error logs) — to keep the Service secure, prevent abuse and fraud, diagnose faults, and improve features. Legal basis: legitimate interests.
• Legal and accounting records — where we must keep them. Legal basis: legal obligation.

We do not sell personal data, and we do not send marketing email unless you have asked us to (legal basis: consent, withdrawable at any time).

2. Who we share data with

• Merchant of Record — Paddle.com, which sells the subscription on our behalf and handles payments, subscription management, tax compliance, invoicing and refunds.
• Service providers / subprocessors — our hosting, database and authentication platform, and the AI provider used for live lookups of uncatalogued cities (search terms are sent; account identifiers are not).
• Other users — venue notes you post are visible to other signed-in subscribers together with the display name you choose.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to establish or defend legal claims.

3. International transfers

The Service is hosted in the United States. If you access it from the UK or EEA, your data will be transferred outside your region. Where required, such transfers rely on appropriate safeguards, such as Standard Contractual Clauses or an adequacy decision.

4. Retention

Account, subscription and content data is kept while your account is active. If you close your account, we delete or anonymise personal data within 90 days, except records we must keep longer for tax, accounting, fraud-prevention or legal-claim purposes (typically up to seven years). Venue notes may be retained in anonymised form so the community record stays intact. Technical logs are kept for a short period, normally under 12 months.

5. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and opt out of any sale or sharing of personal information. To exercise a right, email support@ordinance-map-quest.lovable.app. We respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority.

6. Security

We use appropriate technical and organisational measures, including encryption in transit, encryption at rest at our hosting provider, row-level database access controls that scope records to the signed-in user, and least-privilege administrative access. No system is perfectly secure, but we review these measures as the Service changes.

7. Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in, hold your session, and remember your tour route and interface preferences. Paddle sets cookies needed to process checkout. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser, but sign-in and checkout will not work without the essential ones.

8. Children

The Service is not directed to children under 16 and we do not knowingly collect their data.

9. Changes and contact

We will update this notice as the Service changes; the "last updated" date above reflects the current version. Contact: Mercer M Aplin, support@ordinance-map-quest.lovable.app.