Privacy Policy
This Privacy Policy explains how MapLark ("we", "us", "our") handles personal data when you use the MapLark website, OSM Features API, and dashboard. MapLark is GDPR compliant. We collect as little personal data as we need to run the service. We do not sell it, and we do not build advertising profiles from map queries.
Who we are
The controller for personal data collected through this service is Joel Stenkvist, trading as MapLark, operator of maplark.com. Postal address: Malmskillnadsgatan 36, 111 57 Stockholm. Privacy requests: [email protected].
We have not appointed a data protection officer. Send access, deletion, and other privacy requests to the email above.
What we collect
Depending on how you use MapLark, we may collect:
- Account data: name and email (from your profile, or from Google or GitHub if you sign in with those providers), and a provider user ID
- API usage: request counts, endpoints, timestamps, response outcomes, API key metadata, and plan or tier. Queries describe map filters (for example a bounding box), not who your end users are
- Security and operations logs: IP address, user agent, and similar request metadata used to run, secure, and debug the service
- Site analytics: anonymous page views (page URL, approximate country, device and browser type) without cookies; and if you accept, a client identifier plus product events such as sign-up, login, and API key creation
We do not sell personal data. Querying the API does not require us to know who your end users are.
Cookies
Necessary cookies keep you signed in. Analytics cookies (_ga, _ga_*) are set only if you click Accept. We do not use advertising cookies. Change this anytime from Cookie settings in the footer.
We also collect anonymous page views and country of origin with cookieless pings, including after Necessary only (legitimate interest, GDPR Art. 6(1)(f)). Email us to object. Cookie settings only turns off analytics cookies.
How we use this information
- Provide account access and API key management
- Operate, secure, and improve the API service
- Enforce plan limits and prevent abuse
- Respond to support and account requests
- Measure how the website is used (anonymous page views by default; fuller analytics if you accept cookies)
We do not use personal data for automated decisions that produce legal or similarly significant effects. We do not build advertising profiles.
Legal bases
- Contract (GDPR Art. 6(1)(b)): creating an account, issuing API keys, and delivering the API. Name and email are required for an account
- Consent (GDPR Art. 6(1)(a) and ePrivacy): analytics cookies and identified events, only after you accept. You can withdraw cookie consent from Cookie settings
- Legitimate interests (GDPR Art. 6(1)(f)): securing the service, enforcing plan limits, preventing abuse, keeping operations logs, and cookieless site measurement (page views and country). You can object to this processing, including cookieless measurement, by email
- Legal obligation (GDPR Art. 6(1)(c)): keeping limited billing or tax records where the law requires it
Who we share data with
We use service providers to run MapLark:
- Hosting: DigitalOcean
- Accounts and site analytics: Google
- Sign-in providers you choose, such as Google or GitHub
Some providers are outside the EEA. They process data under the EU-US Data Privacy Framework where they are certified, or under standard contractual clauses.
Retention
- Account data: while your account is active. After you ask us to delete it, we remove or anonymise it within 30 days unless a legal duty requires a longer hold
- API usage records: while the account is active, and up to 12 months after closure, for security, billing disputes, and abuse prevention
- Security logs (including IP address): up to 90 days, unless we need a longer hold to investigate an incident
- Analytics: cookieless measurement in Google Analytics for up to 14 months; if you accepted cookies, until you withdraw cookie consent
Your rights
If you are in the EEA, UK, or a similar jurisdiction, you can request access, correction, deletion, restriction, portability, or objection to processing of your personal data. Where we rely on consent, you can withdraw it at any time from Cookie settings in the footer, without affecting processing that was lawful before you withdrew. Cookie settings withdraws cookie consent only; to object to cookieless measurement, email us. You may also lodge a complaint with your local data protection authority.
To exercise these rights, email [email protected].
Children
MapLark is a developer product. It is not directed at children under 16, and we do not knowingly collect personal data from them.
OpenStreetMap data and policy requirements
MapLark serves data derived from OpenStreetMap. OpenStreetMap data is © OpenStreetMap contributors and available under the ODbL 1.0 license.
You are responsible for meeting any downstream obligations that apply to your use case, including attribution and ODbL requirements where applicable.
- Attribution guidance: OpenStreetMap copyright and attribution
- ODbL legal text: ODbL 1.0
Security
We use reasonable technical and organizational safeguards to protect account information and usage statistics.
Changes to this policy
We may update this Privacy Policy from time to time. Material updates will be posted on this page with a revised effective date.