MapAware Privacy Policy (v2)
1. Overview
MapAware is a web application for creating and collaborating on Wardley Maps.
We process personal data only as necessary to run, secure, and improve the service. We do not sell personal data and do not use personal data for advertising.
2. Data We Process
| Data category | Examples | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account and authentication data | Email, user ID, auth metadata, sign-in provider (for example Google) | Account creation, login, account security | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Map and collaboration content | Maps, map metadata, sharing/collaboration records, access-request details you submit | Provide core product functionality and collaboration | Contract (Art. 6(1)(b)) |
| Technical and security data | IP-derived rate-limit/security data, login events, error logs, load/performance metrics | Security, abuse prevention, reliability, troubleshooting, product operations | Legitimate interests (Art. 6(1)(f)); contract where needed (Art. 6(1)(b)) |
| Local device storage data | Data stored in localStorage, sessionStorage, cookies, and browser IndexedDB caches | Session continuity, UI preferences, performance, offline/local behavior | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
If you choose Google sign-in, Google provides authentication data to us (such as your email address).
Google Sign-In Data (Google User Data)
If you choose Google sign-in, we receive limited Google user data through OAuth, including:
- your Google account email address
- account identifier/subject and basic authentication metadata (for example provider and sign-in timestamps)
We use Google user data only to:
- create and authenticate your MapAware account
- secure login sessions and prevent abuse
- operate user-facing account features (for example account access and sharing permissions)
- improve authentication reliability and security
We do not use Google user data for:
- targeted, personalized, interest-based, or retargeted advertising
- selling to data brokers or information resellers
- credit-worthiness or lending purposes
- training generalized AI/ML models
If you choose to view embedded third-party media (for example YouTube content), that provider may process data under its own privacy terms.
3. Recipients and Processors
We share data only with providers needed to operate MapAware, including:
- Supabase (authentication, database, serverless functions)
- Liveblocks (real-time collaboration)
- Google (OAuth sign-in, when selected by the user)
- YouTube (embedded video content, when selected by the user)
We may also disclose data where required by law, court order, or legal process.
We do not sell Google user data. We do not transfer or disclose Google user data to third parties except:
- to processors/service providers required to provide or secure MapAware functionality
- where required by applicable law, court order, or legal process
We do not transfer Google user data for advertising, data brokerage, profiling, credit/lending decisions, or AI model training.
4. International Transfers
Our providers may process data in multiple regions, including outside the EU/EEA.
Where required, we rely on lawful transfer mechanisms such as:
- Adequacy decisions under GDPR Article 45
- Standard Contractual Clauses (SCCs) under GDPR Article 46
- Other valid GDPR transfer mechanisms where applicable
You can contact us at info@mapaware.io to request more information about transfer safeguards.
5. Retention
We retain personal data only for as long as needed for the purposes above.
Current operational retention behavior includes:
- Account and map content: generally while your account is active, unless deletion is requested
- Google sign-in authentication metadata: generally while your account is active, unless deletion is requested
- Login logs: short operational window
- Error logs: short operational window
- Activation analytics events: short operational window
- Performance/load metrics: retained for service reliability and performance improvements
Backups may retain deleted data for a limited period before overwrite/removal.
You may request deletion of your account data by contacting info@mapaware.io. After a verified deletion request, we delete or anonymize data from active systems within a reasonable period, except where retention is required by law.
6. Your Rights (EU/EEA)
If GDPR applies to you, you may have the right to:
- Access your personal data
- Correct inaccurate personal data
- Delete personal data
- Restrict processing
- Object to certain processing
- Data portability
- Withdraw consent where processing is based on consent
- Lodge a complaint with a supervisory authority
To exercise rights, contact info@mapaware.io. We may need to verify your identity before fulfilling a request.
You may also lodge a complaint with your local authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY).
7. Security
We use reasonable technical and organizational measures to protect personal data, including:
- encryption in transit (HTTPS/TLS)
- access controls and least-privilege access to production systems
- logging/monitoring for security and abuse prevention
- vetted third-party infrastructure and authentication providers
No method of transmission or storage is guaranteed to be completely secure.
8. Children
MapAware is not intended for children under 13, and we do not knowingly collect personal data from children under 13.
9. Changes to This Policy
We may update this policy from time to time. If changes are material, we will provide notice in the app or by email.
10. Contact
Aurana AB
Sweden
info@mapaware.io