Privacy policy
Last updated: 31 October 2026
Who we are
Mapdirector (mapdirector.com) is run by Boomklever CommV, Margarethalaan 75, 3600 Genk, Belgium, enterprise and VAT number BE0749.457.137.
We are the controller of the personal data described here. For anything about your data, email info@mapdirector.com. We answer within a month.
The short version
- We use your data to run Mapdirector: your account, your trips, your maps and videos.
- What you publish is public. Everything else is private to you.
- We do not sell your personal data and we do not show ads.
- We may feature published trips in our marketing, and build anonymous heatmaps from many people's routes.
- We use a few services to run the app (hosting, database, maps, analytics). They are listed below.
- You can correct and delete your data yourself, ask us for a copy of it, and stop any emails.
What we collect, and why
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Account details | Email address, name, handle, profile picture (from Google if you sign in with Google), units and display settings | To create and run your account | Contract (Art. 6(1)(b) GDPR) |
| Trips you create | Titles, descriptions, story text, waypoints, styles, flyover settings | To store, edit and show your trips | Contract |
| Track files | GPX and similar files: locations, times, elevations, speed. ⚠ Sometimes heart rate, cadence, power and temperature | To draw your route, compute statistics and make videos | Contract; heart rate only with your explicit consent (see below) |
| Photos | The image and its metadata (time taken, GPS position, camera) | To place photos on your route and show them in your trip | Contract |
| Activities from connected services | If you connect Garmin, COROS, Suunto, Polar or a similar service: the activities you choose to import (route, times, sensor data such as heart rate), and the access that lets us fetch them | To import those activities as tracks | Contract; heart rate only with your explicit consent |
| Planned routes | Points you place on the map | To calculate a route along paths and roads | Contract |
| Trips started without an account | The trip and its files, linked to a temporary anonymous account | So you can try Mapdirector before signing up | Contract (pre-contractual steps) |
| Combined statistics | Heatmaps of where people go, popular paths and viewpoints, trips per region | To build features such as heatmaps and route suggestions, to understand how Mapdirector is used, and to share anonymous statistics with partners | Legitimate interest (Art. 6(1)(f)); you can opt out (see below) |
| Messages to us | What you write in the contact form, your email | To answer you | Legitimate interest (Art. 6(1)(f)) |
| Visit counts | Pages visited, actions such as starting a trip or exporting a video, errors, browser and device type. Without cookies: your IP address and browser are turned into a code that changes every day, and the IP address is then discarded | To count visits, see which features are used and find bugs | Legitimate interest (Art. 6(1)(f)) |
| Usage and error data | The same, linked over time by a cookie, plus buttons clicked, session recordings with all typed text masked, approximate location from IP | To find bugs and improve the app | Consent (via the cookie banner) |
| Technical logs | IP address, request logs kept by our hosting and database providers | Security and keeping the service running | Legitimate interest |
| Emails | Whether you opened or unsubscribed from our emails | To send the emails you asked for | Consent / legitimate interest for service messages |
Heart rate. Heart rate is health data under the GDPR. When you upload a file that contains it, we ask whether you want to keep it. If you agree, we store it with the track and use it only for the statistics you choose to show. If you do not, we remove it before storing the file. You can withdraw that consent at any time in Account → Privacy & data, which removes the stored heart rate from all your tracks. Legal basis: explicit consent (Art. 9(2)(a) GDPR).
We do not use your data for automated decisions about you, and we do not build advertising profiles.
What is public
Trips you publish, your public profile (name, handle, picture) and the trips listed on it can be seen by anyone with the link, and may be indexed by search engines. This includes the route, photos and anything you wrote. Making a trip private again removes it from the public page; copies other people or search engines already made are outside our control.
Your route shows where you were and when, including where it started and ended. Think about this before publishing a trip that starts at your home.
Published trips may also appear on discovery pages in Mapdirector, and we may feature them in our marketing: on our website, social media, newsletters and in videos about Mapdirector, credited to you. If you do not want a trip featured, keep it private, or ask us and we will stop using it in anything new.
Heatmaps and other combined statistics
We may combine the routes of many people, from private and published trips, into statistics such as heatmaps, popular paths and suggested viewpoints, and show these publicly in Mapdirector. We protect you by:
- cutting the ends of every route (the first and last 200 metres), so where you start and finish, often your home, never shows;
- showing a place only where at least 5 different people passed;
- never using heart rate or any other health data;
- using aggregates only: never your individual route or your times.
Before we build any of these, we will add a setting under Account → Privacy & data to keep your routes out of them.
We may share such aggregated, anonymous statistics with partners, for example tourism organisations or researchers. We never share your own trips or anything that identifies you, and we never sell your personal data.
Features that use AI
We may offer features that use an AI provider, for example to suggest a title, write a first draft of your story, or pick photos. Only the content you choose to use with such a feature is sent, the provider acts as our processor, and it may not use your data to train its models. We will name the provider in the table below before such a feature launches.
Connected services
If you connect an account you have with another service (for example Garmin, COROS, Suunto or Polar), that service sends us the activities you choose to import. We store the access it gives us securely and use it only to fetch what you ask for. These services are not our processors: they share your data with us because you asked them to, under their own privacy policies.
- We only import the activities you pick, never your whole history.
- Heart rate they send is kept only if you agreed to keep heart rate (see above); otherwise we remove it before storing anything.
- Data from a connected service is used only as that service's terms allow, which can keep it out of heatmaps, partner statistics, AI features or our marketing.
- When you disconnect, we delete our access to that service. Tracks you already imported stay until you delete them.
Who processes data for us
We use these providers to run Mapdirector. Each only gets what it needs and is bound by a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | EU (Ireland) |
| Vercel | Website hosting; visit counts without cookies (Vercel Analytics) | Global edge network; server functions in the EU (Dublin) |
| PostHog | Product analytics and error tracking; session recordings only after you accept analytics | EU (Frankfurt) |
| MapTiler | Map imagery, place names, place search | Switzerland / EU |
| Mapterhorn | Elevation data (an open data project; your browser loads its tiles directly) | Not published |
| Stadia Maps | Route planning (receives the points you place, from our server, not your browser) | EU (Frankfurt, Paris) |
| Sign in with Google (if you choose it) | Global | |
| Web3Forms | Contact form delivery | Amazon Web Services, region not published |
| Brevo | Sending all our emails, sign-in emails included | EU (France) |
| An AI provider (when an AI feature launches) | Features you choose to use, see above | Named here before launch |
When we use providers outside the EU/EEA, we rely on an adequacy decision (for example the EU–US Data Privacy Framework or Switzerland's adequacy) or on the European Commission's standard contractual clauses.
The map tile providers receive your IP address and the area of the map you are looking at, because your browser downloads map images from them directly.
Cookies and similar technologies
We use:
- Strictly necessary storage to keep you signed in, remember settings such as light or dark mode, and remember your cookie choice (
md_consent, kept for 6 months, after which we ask again). These need no consent. - Visit counts without cookies (PostHog and Vercel Analytics), for every visitor. Nothing is stored on your device: your IP address and browser are turned into a code that changes every day, so we cannot tell who you are and visits on different days cannot be linked. This counts pages, actions such as starting a trip or exporting a video, and errors.
- Analytics cookies (PostHog), only if you press Accept on the cookie card. They link your visits over time and add the buttons you click and session recordings in which everything you type is hidden. None of this is stored or sent before you accept, and none of it if you decline.
You can change your choice at any time with Cookie settings in the footer or under Account → Privacy & data. Declining after accepting stops the analytics cookies straight away and removes their identifiers from your browser; your visits are then counted without cookies only.
How long we keep it
| Data | Kept for |
|---|---|
| Account and trips | Until you delete them or your account |
| Trips made without an account | Deleted automatically after 14 days, if not used for 7 days |
| Analytics and session recordings | Up to 12 months |
| Contact form messages | Up to 2 years |
| Email preferences and consent records | As long as you are subscribed, then 3 years as proof of consent |
| Backups | Up to 30 days after deletion |
Your rights
You can ask us to:
- see the data we hold about you, and get a copy you can take elsewhere (we send it within a month of your request);
- correct it;
- delete it. You can delete your account yourself under Account → Privacy & data, which deletes your trips, files and photos;
- restrict or object to processing, including any processing based on legitimate interest, such as including your routes in heatmaps or featuring a published trip in our marketing;
- withdraw consent at any time (analytics, emails), without affecting what happened before.
Email info@mapdirector.com. If you are unhappy with our answer, you can complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be / autoriteprotectiondonnees.be) or the authority in your own country.
Emails
- Service emails (sign-in links, account and security notices, important changes to the service or these terms) are sent to every account holder.
- Product updates (about once a month) are only sent if you said yes: when you signed up, in a card in the app that asks you once, or under Account → Privacy & data. Every one has a link to your email preferences and an unsubscribe link. If you joined our ambassador or early-access list before, that sign-up counts as your yes, and you can change it the same way.
Children
Mapdirector is not meant for children under 16. We do not knowingly collect their data.
Security
Data is encrypted in transit, access is restricted per account, and files are stored in private storage unless you publish them. We only open a private trip to fix a problem you reported or to keep the service secure. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Changes
If we change this policy in a way that matters, we will tell you by email or in the app before it applies.