Privacy Policy

Optional location

Only when you press “Near me” and grant browser permission, your location is used in browser memory to follow your position and estimate nearby walking times; we do not save it or send your coordinates to our server or a routing API, and you can continue using the map if permission is declined.

Who is responsible

The operator and controller for Map This City's purchase-access records is Judit Forintos, a sole proprietor in Hungary. Address: Hungary, 1121 Budapest, Rácz Aladár street 16. Privacy contact email: mapthiscitycom@gmail.com. See the Legal notice / Impresszum.

Information we use

No user account is required. To provide purchased access, we store your purchase email address, personal access code, Paddle transaction reference, code creation date, first-use date and revocation status. If you contact support, we use the information you provide to handle your request. You do not need to disclose a medical diagnosis to use the map.

Paddle collects and processes payment and billing information during checkout under its own privacy notice. Map This City does not store your full payment-card details. Hosting and security services may process technical request information such as IP addresses and timestamps.

Purposes and legal bases

Purchase and access information is used to fulfil your contract: issue your personal link, verify access, enforce the one-year access period and provide support. We use limited technical information for our legitimate interest in preventing abuse and keeping the service secure, and retain records where required by applicable legal obligations.

Browser storage

After you open your personal link, your access code is saved in local storage on that browser so the map can open without registration or a password. It is sent to our server to check whether access is valid. Clearing browser storage or choosing “Forget this code” removes the saved code from that browser, but does not delete the purchase record or extend the access period.

Someone using the same browser may be able to use your map access. Keep your purchase link private. Map data may be held temporarily in memory while the page is open.

Recipients and service providers

Lovable Cloud provides the application's hosting and database services; the hosting provider is Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden (privacy contact: privacy@lovable.dev). The mapthiscity.com domain name is registered through Rackhost Zrt., registered seat 6722 Szeged, Tisza Lajos körút 41., company registration number 06-10-000489, tax number 25333572-2-06, contact info@rackhost.hu; Rackhost does not receive your purchase data. Paddle.com is the reseller and Merchant of Record and processes purchases under its own responsibilities. Automated purchase-access emails are delivered through Lovable's managed email service using our verified notify.mapthiscity.com sending domain. Replies and support correspondence use the operator's Gmail account, mapthiscitycom@gmail.com, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Mapbox provides map rendering when the Mapbox map is enabled and may receive technical request data, such as your IP address and map requests; it is not loaded when the schematic fallback is used. The map provider is Mapbox, Inc., a Delaware corporation, 1133 15th Street N.W., Suite 825, Washington, DC 20005, USA (privacy contact: privacy@mapbox.com).

We do not sell your personal information. Where personal data is processed outside the EU/EEA, transfers rely on the provider's certification under the EU-U.S. Data Privacy Framework (Mapbox, Inc. and Google LLC are certified participants) or, where required, standard contractual clauses approved by the European Commission. Lovable Cloud hosting is provided within the EU (Sweden); Paddle processes payment data under its own privacy notice as Merchant of Record.

Optional analytics and marketing cookies

We use Google Tag Manager to manage consent-based measurement for Google Analytics and Meta Pixel. These services may process page visits, interactions, device and browser information, IP addresses and cookie identifiers for visit measurement, advertising measurement and advertising optimization, only after you choose “Accept all”. Google Tag Manager and the measurement tags are blocked before acceptance and after rejection. Google Analytics and Meta Pixel must also be configured in the Google Tag Manager container; installing the container alone does not activate those services. We do not share purchase emails, personal access codes or location coordinates with these measurement services.

Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Meta services are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and Meta Platforms, Inc., USA. See Google's Privacy Policy and Meta's Privacy Policy for provider processing and retention. Where relevant, international transfers rely on applicable Data Privacy Framework certification or standard contractual clauses.

“Accept all” and “Reject all” are equally available. Rejection does not affect access to the purchased map. Choose “Cookie settings” in the footer at any time to change or withdraw permission. Opening settings does not change your existing choice; choosing “Reject all” stops future optional tracking and reloads the page to unload previously loaded tags. Changes are applied to other open tabs in the same browser. Withdrawal does not undo data already received by a provider; contact us or the provider to exercise your rights.

Your choice is stored in this browser with a random consent reference, the decision time, notice version and text, purposes, recipients and choices presented. Earlier acceptance evidence is retained when you withdraw. Clearing browser storage removes this local record and you will be asked again. Analytics retention should be configured to 14 months in Google Analytics; provider-side settings and Meta retention have not yet been verified.

Checkout measurement

After explicit acceptance, Paddle checkout callbacks may record checkout opening and a completed purchase, with transaction reference, actual amount and currency, in the site's measurement layer. Rejection or withdrawal blocks these optional events. A browser-stored transaction marker prevents repeated purchase callbacks in that browser from reporting the same transaction again. Paddle receives the advertising choice and consent notice reference in checkout custom data; this does not subscribe you to marketing emails. We do not send Safe Dining Kit Purchase events to Meta Conversions API or Meta Pixel, because the product context may imply sensitive health information; consent does not remove that restriction. Any Google Tag Manager tags must respect this exclusion and must not transmit health information.

Retention

Map access expires one year from purchase (or creation for manually issued codes). The access code itself is erased within 30 days after that access period ends, so an expired link stops working and cannot be reused. The purchase identity needed for accounting — purchase email address, Paddle transaction reference, amount and purchase date — is kept for 8 years from the end of the tax year in which the purchase was made, as required by Hungarian accounting and VAT law; Paddle keeps its own payment records as Merchant of Record. Support, refund and complaint correspondence is kept for 5 years from the last message, matching the general limitation period for civil claims. Proof of cookie consent, if analytics are enabled later, is kept until you withdraw it and for up to 24 months afterwards as evidence. Backups containing deleted data are purged within 30 days. Deletion and other rights requests are answered within 30 days.

Your rights

Where applicable, you may request access, correction, erasure, restriction or portability of your personal data, or object to processing based on legitimate interests. To request deletion or exercise another right, email mapthiscitycom@gmail.com from your purchase email address. Do not include your payment-card details or access code. We may need to verify your identity, and legal retention duties may limit deletion. For Paddle's payment records, contact Paddle directly.

You may lodge a complaint with your local data protection authority, including Hungary's National Authority for Data Protection and Freedom of Information (NAIH). This policy will be updated when missing operator and provider information is supplied.