Privacy policy

Who is responsible

The controller of your personal data is The Guest Map (theguestmap.com). Contact: legal@theguestmap.com.

What we collect

• For your guest map: the address you type, the places you choose, your notes on them and any photos you add.
• Your email address, when you start a guest map or ask for a sign-in link, and the consent boxes you ticked, with the date and the wording version.
• Order details Gumroad sends us when you buy: your email, the product, the currency, the licence key and whether it was refunded.
• Messages you send through the contact form.
• Your IP address, briefly, to apply rate limits and stop abuse. On a guest map whose host's plan has guest activity, for a guest whose phone is sharing how it uses the map: a random number for that phone and map, kept on the phone in a cookie and its browser storage; what the guest did on the map (places opened, time on a place, searches, filters, taps on directions, a ride, WhatsApp and Google Maps, offers seen, saves for offline), their language, whether they used a phone or a computer, and the country and city they were in; their hearts and Been here ticks; and a visit to a listed place when the phone stays within about 60 metres of it for five minutes with Near me on. The position itself never leaves the phone, and only the visit is sent. The IP address is not stored: only the country and city our hosting provider works out from it at that moment. The storage the map needs to work is always on. Guests in the EU and the UK are asked first, with Accept all and Essential only side by side, and the cookie that counts is set only after Accept all; everywhere else a guest can switch it off under Privacy at the foot of the map. Anyone can change their choice under Privacy at any time, and switching it off also deletes what was kept for their phone. A browser that sends the Global Privacy Control signal is treated as Essential only. A phone that says no is counted only in daily totals of taps, with no number, no cookie and nothing that identifies it. A guest tip keeps the tip, and the first name and country only if the guest gives them. When the guest's phone is sharing how it uses the map, the fact that it sent a tip on a place is also kept against its random number, so that one phone cannot send too many. Hidden tips are deleted after 90 days.

Why we use it

• To make and show your guest map, to run your plan, and to email you about them (performing our contract with you).
• To send host tips and occasional offers, only if you ticked the second box (your consent, which you can withdraw any time with the unsubscribe link).
• To keep the service secure and working, and to handle refunds and support (our legitimate interests and legal obligations).

How long we keep it

• A guest map's visitor, session, event and visit records, its hearts and Been here ticks and its daily totals: kept for 12 months, then deleted. The random number on a guest's phone also lasts 12 months.
• Email address and consent records: until you unsubscribe or ask us to delete them, and consent records as long as we need to show consent was given.
• Order records: as long as tax and accounting law requires.

Who processes it for us

• Plausible: cookieless website analytics. It counts visits without cookies and without personal data.
• Resend: sends the emails from this site (sign-in links, emails about your plan, and guest map tips if you asked for them).
• Kit: the marketing email list, only if you ticked the second box.
• Gumroad: the seller of record for every purchase. It takes payment and handles VAT. Its own privacy policy covers what you give it at checkout.
• Vercel: hosts the website and the private file storage (Vercel Blob). Your photos and your map's printed pieces are kept in a private store and reached only through short-lived signed links.
• Neon: hosts the database.
• Anthropic: our own engine uses Claude, Anthropic's AI, to choose which places suit a guest map from a list code has already checked, so the area of that map is processed by Anthropic. The free tools use no AI and send nothing to Anthropic. [Placeholder: the Claude account type and its model-training setting, confirmed before launch.]
• Stadia Maps: turns the address you type for a guest map into map coordinates, and works out drive times from it to the places on your map.
• Cloudflare Turnstile: checks forms for bots.

Some of these providers are in the United States. Transfers rely on the safeguards they offer, such as standard contractual clauses.

What we never do

• Sell your data, or anything else about you.
• Use AI in the free tools. They run on plain rules in code.
• Use ad trackers, a Meta pixel or Google Ads tags.
• Read or scrape anything from Airbnb, Booking.com or Vrbo.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable format, and withdraw consent at any time. Email legal@theguestmap.com. We reply within one month.

You can also complain to your data protection authority, for example the AEPD in Spain or the ICO in the UK.