Privacy policy

Controller

PlotMyMap, the controller of the website plotmymap.com. For any question about your data: info@plotmymap.com.

What data is processed

Your IP address. It arrives with every request, as on any website. It is used on the spot, in the server's memory, to apply usage limits (number of requests and of simultaneous maps) and is discarded within minutes. In the server's technical log it is recorded shortened, without its last segment, so it does not identify a specific device.

What you ask for in order to make the map. The place, paper, scale and style are sent to the server so it can draw the map. Maps already computed are kept for a while in a shared cache so the work is not repeated if someone asks for the same one. If you add a route (a GPX file), the file is read in your browser and is not sent: only the route's coordinates travel, simplified and, if you leave it ticked, without its start and end; they go with the rest of the map's options.

The maps you share. When you press “Share this map”, the options of that map (not who shares it) and a small image are stored on the server, so the link shows a preview. Anyone with the link can open that map. The email, WhatsApp and social buttons only open that service with the link already filled in: the site loads nothing from them.

Our own statistics, without cookies. The server counts the pages viewed, the maps made and downloaded, the links shared and the account sign-ups, with just enough to know how the site is used: which site you come from (its domain only), the country (as reported by Cloudflare), the device type, the language, the map's type, paper and scale, and its area rounded to about 10 km. Neither your IP address nor your browser is stored: to count visitors, a fingerprint computed from them and a random value that changes every day and is then deleted is kept, so it cannot tell who you are or follow you from one day to the next.

If you create an account (it is optional: the site can be used without one): your email, the username you choose, your password encrypted (never the password itself), the identifier Google gives your account if you sign in with Google, the styles and maps you save, and your plan (if we give it to you as a courtesy, until when and why).

If you publish a map in the community (it is optional): the map, its title and its description are shown on the site with your username (never your email), as are the area the map shows and its route, if you choose to publish it. We store the likes you give (who gives them is not shown), how many people make each map their own, and reports (from someone with an account, their account; from someone without, a daily fingerprint, as in the statistics). We email you when a map of yours is published or not; you can turn those notices off in your account.

If you write to us with the contact form: your email, your name if you give it, and your message. They reach us by email so we can reply; the site does not keep them.

Cookies and what is stored in your browser

The site keeps your preferences in your browser's local storage: the options of your last map, the language and the light or dark mode. That stays on your device and you can delete it at any time from your browser settings. While the tab is open, it also keeps a random number that identifies the map being prepared, so that reloading the page does not start it again; it is deleted when you close the tab.

Technical cookies, always: the one that remembers your choice in the cookie notice and, if you sign in, the session cookie.

Analytics cookies (and advertising ones, when there are ads), only if you accept them in the notice. You can change your choice at any time. Each cookie is listed on the cookies page.

Usage statistics: Google Analytics

If you accept, we use Google Analytics 4, by Google Ireland Limited, to know how many people use the site and how (which pages are viewed, whether a map is made or downloaded) so we can improve it. It collects usage data with a random identifier stored in a cookie, the type of device and browser and the approximate location (country or city). Google Analytics 4 does not store your IP address. The data is kept for 14 months at most.

Without your permission nothing from Google is loaded. If you withdraw it, its cookies are deleted.

Advertising

The site may show Google AdSense ads, by Google Ireland Limited. Google, as a third-party vendor, uses cookies to serve ads based on your previous visits to this site and other sites, and its partners may do the same. That only happens if you accept it in the cookie notice; otherwise, any ads you see will not be personalised.

You can turn off personalised advertising in Google's ad settings and see how Google uses data at policies.google.com/technologies/partner-sites. For other vendors: youronlinechoices.com.

If you are signed in to your account no ads are shown and nothing from Google is loaded for them.

Purpose and legal basis

To provide the service you ask for (drawing, sharing and downloading maps), to keep it safe from abuse and to know how it is used through our own statistics: the owner's legitimate interest in the site working and improving.

Your account: performance of the contract you accept when creating it.

What you publish in the community: the rules you accept when publishing. Reports: the legitimate interest in removing what should not be there.

Contact messages: your consent, when you write to us, so that we can reply.

Analytics and personalised advertising: your consent, which you can withdraw at any time.

We build no profiles of our own, make no automated decisions about people, and sell no data.

Who else is involved

Cloudflare, Inc. The site is served through its network, which sits between your browser and the server to protect it and speed up responses. It processes your IP address and technical connection data. Its policy: cloudflare.com/privacypolicy.

The server where maps are computed and data is stored is a server run by the owner.

Google Ireland Limited, for analytics and advertising, only with your permission. Its policy: policies.google.com/privacy.

Google, if you choose to sign in with your Google account: it tells us your email and that it is you.

Brevo (Sendinblue SAS, France), which sends account emails (confirming your address, resetting your password, community notices) and delivers the contact form messages to us.

Some of these providers may process data outside the European Economic Area, under the EU-US Data Privacy Framework or standard contractual clauses.

To prepare the maps the server downloads data from OpenStreetMap (via Geofabrik), the Spanish Cadastre and the Instituto Geográfico Nacional. Those organisations receive nothing of yours. No data is shared with anyone else, unless required by law.

How long

The full IP address, only for the minutes needed to apply usage limits. The technical log, with the shortened address, as long as needed to diagnose faults; it is deleted by rotation.

Shared maps, until 6 months after someone last opens the link.

Our own statistics, 13 months.

What you publish in the community, until you remove it or delete your account. Reports, until the map is reviewed.

Account data, until you delete the account (you can do it from the account page, and everything goes, saved maps included).

Contact messages, in our mailbox, as long as needed to deal with them.

What is in your browser, until you delete it.

Your rights

You may request access to, rectification, erasure or portability of your data, restriction of its processing, or object to it, by writing to info@plotmymap.com.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Changes

If what the site does with data changes, this page will be updated beforehand.