Privacy Policy

Last updated: September 2026

1. Who we are

Viajes Fotográficos PhotoWorldTours, S.L. (Unipersonal) ("we", "us"), Calle Los Cubos, 25, 22300 Barbastro (Huesca), Spain, tax ID B10657419, is the data controller for the personal data described in this Privacy Policy, collected through maps.photography (the "Service").

For any question about this Policy or to exercise your rights, contact us at support@maps.photography.

2. What data we collect

• Account data: email address, and name if you provide one.
• Purchase data: which Photo Maps you have bought and when. Payment details themselves (card numbers, billing address) are collected and processed directly by Paddle, our payment processor and Merchant of Record — we never see or store your full payment card details.
• Usage data: your favorites, visited/marked locations, and which Photo Maps you have access to (your entitlements), so your library works across sessions and devices.
• Technical data: your login session (via a strictly necessary cookie — see our Cookie Policy), and standard server logs (e.g. IP address, timestamp, requested page) kept for security and abuse prevention.
• Newsletter consent: if you unlock our free lead-magnet map, we record that you opted in to receive marketing email — your email address, the date, which version of the opt-in wording you agreed to, and whether you are still subscribed. This is captured separately from, and never combined with, your acceptance of our Terms or Refund Policy.
• Support messages: if you contact us through our support form, we keep your email address, the type of request, your message, and — if you are reporting a problem with a specific map location — which location and map that relates to. We do not include exact coordinates or other sensitive scouting details in these records. We also keep a hashed version of the IP address a message was sent from, only to prevent spam and abuse of the form.

We do not run advertising or analytics trackers, and we do not knowingly collect any special category of data.

Our free map is offered in exchange for two things, asked separately: creating an account, and explicitly opting in to receive our newsletter. We do not currently send any newsletter emails — the wording you agree to is recorded so that if and when we do start sending them, we send them only to people who actually said yes, and can prove it. Unsubscribing at any time does not remove the free map you already unlocked.

3. Why we use it, and on what legal basis

• To provide the Service (create your account, grant access to what you buy, show your library) — performance of a contract with you.
• To process payments and comply with tax/accounting obligations — performance of a contract, and legal obligation.
• To respond to support and refund requests — performance of a contract, and our legitimate interest in resolving issues.
• To keep the Service secure and prevent abuse (e.g. detecting credential sharing in breach of our Terms) — our legitimate interest.
• To send you transactional emails about your account or purchases — performance of a contract.
• To send you our newsletter, if and when we start sending one — your explicit consent, given separately from any purchase, which you can withdraw at any time without affecting a free map you already unlocked.

We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

4. Who we share it with

We share personal data only with the service providers that actually run the Service on our behalf, each acting under its own data processing terms:

• Supabase — hosts our database, authentication and file storage.
• Vercel — hosts and serves the Service.
• Paddle — processes your payment. For payment processing, tax compliance, fraud prevention and related buyer support, Paddle acts as an independent data controller in its own right (as Merchant of Record), under its own privacy notice — see Paddle's Privacy Policy. We do not control how Paddle uses data in that capacity.
• OpenAI — used only on the admin side, to help draft editorial text for Photo Maps (place names, categories, general descriptions). We do not send any customer/buyer personal data to OpenAI.
• Resend — delivers the email notification generated when you submit our support form, and any reply you receive from us. We do not send your data to Resend for any other purpose.
• Cloudflare — provides the anti-spam check (Turnstile) on our support form, which runs in your browser and verifies your submission is not automated.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

5. International transfers

Supabase (database, authentication, file storage) runs in our own project's EU region (Frankfurt, Germany), so this data does not leave the European Economic Area.

Vercel (hosting) runs the parts of the Service that touch your personal data — such as checkout and account requests — from the United States. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) for exactly this kind of transfer, and its Data Processing Agreement additionally provides for the Standard Contractual Clauses approved by the European Commission (2021/914) as a fallback safeguard.

OpenAI is used only by our own team, to help draft editorial text for Photo Maps — never with any buyer or customer personal data (see section 4). Where this does involve personal data of our own staff, OpenAI processes it in the United States under the EU Standard Contractual Clauses referenced in its Data Processing Addendum.

Paddle (payment processing) is contracted through Paddle.com Market Ltd, registered in the United Kingdom. Transfers to the UK are covered by the European Commission's UK adequacy decision (last reaffirmed 19 December 2025, valid until 27 December 2031), which lets personal data flow to the UK without any additional safeguard being required. For any further processing Paddle carries out through its other group entities or infrastructure outside the UK/EEA, Paddle applies its own safeguards (including Standard Contractual Clauses) under Paddle's Privacy Policy, which we do not control.

Resend (email delivery for support messages) is operated by Plus Five Five, Inc., which processes data in the United States. Resend's own Privacy Policy does not name the EU-U.S. Data Privacy Framework or Standard Contractual Clauses as a specific safeguard — it commits only to taking reasonable steps to ensure adequate controls wherever your data is processed. We only send Resend the minimum needed to deliver a support message (see section 2).

These are the safeguards in place as of the "Last updated" date above, verified directly against each provider's own current legal documentation; a provider can change its certifications or infrastructure over time, so we treat this section as one to revisit whenever a provider, or its published safeguards, changes.

6. How long we keep it

We keep account and purchase data for as long as your account is active, and afterwards for as long as needed to comply with tax, accounting, contractual and anti-fraud/compliance obligations (which can require keeping invoicing-related records, and evidence of consents given at checkout or for our newsletter, for several years under Spanish law). You can request deletion of your account at any time from Account Settings, subject to those retention obligations — we cannot promise immediate deletion of anything we are legally required to keep. Any newsletter subscription is cancelled immediately either way, your map access is revoked, and data kept only for the reasons above is never used for marketing.

7. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data, once any legal retention obligation has passed;
• request restriction of, or object to, certain processing;
• receive a copy of your data in a portable format;
• lodge a complaint with your local data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD).

To exercise any of these rights, contact us at support@maps.photography.

8. Security

We apply reasonable technical and organizational measures to protect your data, including encrypted connections and database-level access controls that restrict who and what can read or write your data based on their role. No method of transmission or storage is completely secure, but we work to protect your information appropriately for what it is.

9. Children

The Service is not directed at, and we do not knowingly collect personal data from, individuals below the minimum age of digital consent in their country of residence.

10. Changes to this Policy

We may update this Privacy Policy from time to time, for example to reflect a new provider or a change in applicable law. We will update the "Last updated" date above when we do.