Privacy Policy

GeoMaps ("GeoMaps", "we", "us" or "our") is a web mapping platform that lets you turn spreadsheets, CRM data and databases into interactive maps. GeoMaps is operated by Erik Galstian, a sole trader based in Spain.

For the purposes of the EU General Data Protection Regulation (GDPR) and Spanish data-protection law, GeoMaps is the data controller of the personal data we collect about you as a user of the Service. For the data you import or connect about your own contacts ("Customer Data"), you are the controller and we act as your processor — see section 7.

You can reach us about privacy at [email protected].

This Privacy Policy explains what personal data we collect, why, how we use and share it, and the rights you have. It applies to our website at https://geomaps.co and the GeoMaps application at https://app.geomaps.co (together, the "Service").

Account information

When you create an account we collect your name, email address and a securely hashed password. If you sign in with Google, we receive your name, email address and Google account identifier. We also store your role and the team or account you belong to.

Billing information

If you subscribe to a paid plan, payments are handled by our payment processor, Stripe. We do not see or store your full card details — Stripe does. We store your subscription status, plan, and the customer and subscription identifiers Stripe gives us so we can manage your billing.

Data you import or connect (Customer Data)

The core of the Service is mapping your data. When you upload a file (CSV, Excel) or connect a source (Google Sheets, a CRM such as Close, Copper or LeadConnector, or your own PostgreSQL/MySQL database), we receive and store the records you choose to map. These records may include personal data about your own customers, leads or contacts — such as names, addresses, locations, emails or phone numbers. You decide what to import. To connect a source we securely store the access tokens needed to keep it in sync.

Content you create

We store the maps, layers, routes, widgets and settings you build, including any maps you publish and any password you set on a published map.

Usage and technical data

Like most online services, our servers automatically record basic log data needed to operate and secure the Service, such as the requests made, timestamps and error information. We use your IP address transiently to handle requests and prevent abuse.

Published-map analytics

When someone opens a map you have published, we record an approximate visitor count. We do not store the visitor's raw IP address — instead we store a one-way SHA-256 hash of the IP combined with the day, which lets us estimate unique visitors without identifying anyone.

Cookies and local storage

The application uses strictly necessary browser local storage to keep you signed in and remember preferences (for example your session token and selected map style). Payment pages use cookies set by Stripe to process payments securely. On our public website we use Google Analytics to understand aggregate traffic and improve the site; we do not use it for advertising and we do not sell your data. Whether it sets first-party analytics cookies (such as _ga) depends on where you are. If you are in the EEA, the United Kingdom or Switzerland, analytics runs in a cookieless mode that sets no such cookies until you accept via our cookie banner — and stays cookieless if you decline. Elsewhere, analytics cookies are set by default to measure visits, and you can switch them off at any time by choosing Decline in the cookie banner. To change an earlier choice, clear this site's storage in your browser to bring the banner back, or opt out globally with Google's Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout).

Under the GDPR we must have a legal basis for each use of your personal data. We use your data to:

• Provide the Service — create and run your account, store and map your data, build routes, generate maps and sync your sources (legal basis: performance of our contract with you).
• Process payments — manage subscriptions, charges and invoices (performance of contract; and legal obligation for tax and accounting records).
• Communicate with you — send service, security and account emails such as email verification and password resets (performance of contract and our legitimate interests).
• Keep the Service secure and reliable — prevent fraud and abuse, debug, and protect our users and systems (our legitimate interests).
• Improve the Service — understand how features are used at an aggregate level and fix problems (our legitimate interests).
• Comply with the law — meet legal, tax and regulatory obligations (legal obligation).

Where we rely on consent (for example, optional integrations you choose to connect, or any future marketing emails), you can withdraw it at any time.

When you use GeoMaps' AI map-generation features, the prompt and the relevant data needed to produce the result are sent to our AI provider, OpenAI, which returns the generated output. We do not use your Customer Data to train AI models, and OpenAI does not train its models on data sent through its API. If you would rather not use AI processing, simply don't use the AI features.

If you connect Google Sheets, GeoMaps requests only the single narrow Google permission it needs: per-file access to the specific spreadsheet you select in Google's file picker (the drive.file scope), which lets us read that one file's contents. We never request access to all of your Google Drive.

We use this Google data for a single purpose: to read the rows of the spreadsheet you choose so we can geocode them and plot them on your map, and to keep that map in sync when the sheet changes. We do not use it for advertising, we do not sell it or transfer it to third parties, and we do not use it to train artificial-intelligence or machine-learning models. No human at GeoMaps reads your Google data except where you give us specific consent (for example, to help with a support request you raise), where it is necessary for security or to comply with the law, or in an aggregated and anonymized form for internal operations.

GeoMaps' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can disconnect a Google source at any time from Data Sources in the app, or revoke GeoMaps' access to your Google account entirely at https://myaccount.google.com/connections.

For personal data contained in the Customer Data you import or connect (data about your own contacts), you are the data controller and GeoMaps is your data processor. We process that data only to provide the Service and on your instructions — we do not use it for our own purposes and we never sell it.

If you are subject to the GDPR and need a Data Processing Agreement (DPA), we will make one available — contact us at [email protected]. You are responsible for having a lawful basis and any required notices or consents to upload and map personal data about other people.

The GeoMaps mobile apps for iOS and Android are companions to the web app: you sign in with an existing GeoMaps account and view the lists, records, layers and routes you already have. Everything else in this policy applies to the apps as well; this section covers what is specific to them.

Device location

If you tap the locate control, the app asks permission to use your device location while the app is open. We use it only to centre the map on where you are and to offer your position as a route start point. Your location is processed on your device — it is not uploaded to our servers, not stored by us, and not sold or shared. The apps never request background or "always" location and do not track you when closed. You can revoke the permission at any time in your device settings and the rest of the app keeps working.

What the apps send to us

• Your sign-in details — email and password, or an Apple or Google sign-in identifier — so we can authenticate you.
• Requests for your own account data (lists, records, layers, routes), which we return to your device.
• Addresses and route stops you look up, so we can geocode them and calculate routes.

Stored on your device

Your session token is held in the operating system's secure storage (iOS Keychain or Android Keystore) so you stay signed in. Small preferences — your chosen map style, distance units and which lists are visible — are stored only on the device. Signing out or deleting your account clears the token.

Map and routing providers

Map tiles, address search and place suggestions come from Mapbox, and route calculation from HERE. When you search or look for nearby places, your search text and the map's centre coordinates are sent to those providers so they can return results. Mapbox's own usage telemetry is switched off in our apps.

App updates

The apps check for over-the-air updates on launch via Expo's update service, which receives a random installation identifier together with basic app and platform version information. It is not linked to your identity and is never used for advertising.

No advertising or tracking

The apps contain no advertising, no analytics SDKs and no third-party trackers. We do not use your device's advertising identifier and we do not track you across other apps or websites.

Deleting your account from the app

You can delete your account in the app under Settings. If you own or administer a workspace this permanently deletes the workspace and all of its data and cancels any subscription; if you are a member it removes your own login and access. Deletion cannot be undone.

We do not sell your personal data. We share it only with the service providers ("subprocessors") that help us run GeoMaps, and only as needed to deliver the Service. Each is bound by contract to protect your data and to process it only on our instructions:

We may also disclose data if required by law, to enforce our terms, or to protect the rights, safety and security of our users or others. If GeoMaps is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction, and we will notify you of any change in control.

GeoMaps is hosted on Railway's infrastructure in the United States, and some of our subprocessors are also located in the United States. This means your data — including Customer Data — is transferred to and processed in the United States and potentially other countries outside the European Economic Area (EEA).

Where we transfer personal data outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified. You can ask us for more detail about these safeguards.

• Account and Customer Data: kept while your account is active. After you delete your account, we delete or anonymise this data within 30 days, except where we must keep it longer by law.
• Inactive free accounts: if you are on a free plan and have not signed in for 60 days, we email the account owner and then delete the account's Customer Data if nobody signs in within the following 7 days. See below.
• Billing and invoice records: kept for as long as required by Spanish tax and accounting law (generally several years).
• Security and operational logs: kept for a limited period needed to secure and operate the Service.
• Short-lived tokens (email verification, password reset, OAuth handoff): expire automatically and are deleted shortly after use.
• Residual copies in encrypted backups are removed in the ordinary backup-rotation cycle.

Inactive free accounts in more detail: we do not keep imported data indefinitely for accounts that have been abandoned. If your account is on a free plan and nobody has signed in for 60 days, we send the account owner an email telling them exactly when the data will be deleted. Signing in at any point before that date cancels the deletion automatically — you do not need to reply or contact us. If nobody signs in, we delete the account's data sources, imported records and lists. This cannot be undone, so please export anything you want to keep before the date in the email.

This applies to free plans only. Paid accounts are never deleted for inactivity, and accounts with a published shared map are excluded while that map exists. Your login, workspace and settings are not removed by this process — only the data described above.

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), hashing of account passwords with bcrypt, encrypted storage of integration access tokens, access controls, and hosting with a reputable cloud provider. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

If you are in the EEA or UK, you have the following rights over your personal data:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format, or have it sent to another provider.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — where we rely on your consent, withdraw it at any time.

To exercise any of these rights, email us at [email protected]. You can access, edit, export or delete much of your data directly in the app at any time. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), https://www.aepd.es, though we'd appreciate the chance to help first.

GeoMaps is a business tool intended for users aged 18 and over. It is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top and, where appropriate, notify you by email or in the app. Your continued use of the Service after an update means you accept the revised policy.

Questions about this policy or your data? Email [email protected].