Privacy Policy

1. What we collect

• Account details: email, name, password (hashed by our auth provider).
• Usage and technical data: IP address, device/browser info, product events needed to run and secure the service.
• Content metadata: project names, layer names, share settings, storage usage.
• Billing data if you subscribe (handled by Stripe; we store subscription status).
• Messages you send via help or feedback forms.

2. Why we use it

To create and manage accounts, host and display your scenes, enforce invites and quotas, send transactional email (invites, support), process payments, improve reliability and security, and meet legal obligations.

3. Where data is hosted and who processes it

Application data, meaning our database and the files you upload, is hosted in Australia. The database and file storage run on Supabase in its Sydney region. Large uploads are held and converted on our own servers in Australia.

We use these processors to run MapShare:

• Supabase: sign-in, database, file storage and rate limiting (Sydney).
• Vercel: hosts the website. Requests are handled in Sydney; static files are served from its global network.
• Stripe: payments, if you subscribe.
• Resend: email, such as invites and sign-in links.
• Google or Microsoft: only if you connect a calendar (see section 5).

Vercel, Stripe, Resend, Google and Microsoft may process data outside Australia under their own terms.

4. Sharing

We do not sell personal information. We share it with processors as needed to run the service, when you publish a share or embed link (recipients can see the shared scene), or when required by law. Public share links expose the content you choose to publish — treat them carefully.

5. Connected calendars and contacts (Google and Microsoft)

Connecting a calendar is optional and only happens when you choose Connect in Account → Calendar & contacts. MapShare never asks for this access when you sign in.

• What we access. Your account’s name and email address; the calendar events MapShare creates for meetings you schedule, and the attendees’ responses to them; and the names and email addresses of your contacts (Google Contacts and “Other contacts”, or Outlook People).
• Why. To create, update and cancel the meetings you schedule in MapShare from your own calendar, so the invites come from you, and to show their replies; and to suggest people as you type in Add people when you share a scene. We do not read or list your other calendar events or free/busy time, and we do not use this data for advertising, profiling or training AI models.
• Storage. Access tokens are encrypted (AES-256-GCM) and stored in our database in Australia. Contact suggestions are looked up as you type and are not stored, apart from a short in-memory cache of up to a minute. Meeting details you enter (title, time, invitees) are stored with the meeting.
• Sharing. We do not sell or share this data. It is only sent back to Google or Microsoft to carry out the actions you ask for.
• Disconnecting. Account → Calendar & contacts → Disconnect deletes the stored tokens and revokes our access with Google. You can also remove MapShare at any time from your Google Account (Security → Third-party access) or your Microsoft account (My Apps / account.live.com).

MapShare’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention

We keep account and content data while your account is active and for a reasonable period afterward for backups, dispute resolution, and legal compliance. You may request deletion of your account; residual copies in backups may persist for a limited time.

7. Security

We use industry-standard controls (HTTPS, access controls, row-level security where applicable). No method of transmission or storage is perfectly secure; please use a strong password and protect your share links.

8. Your rights

You may request access to, correction of, or deletion of personal information we hold about you, subject to legal exceptions. Contact info@mirrormapper.com.au. If you are unsatisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

9. Cookies

We use cookies and similar technologies required for authentication and session security. We do not currently run third-party advertising trackers on the marketing site.

10. Changes

We may update this policy; the version date above will change when we do. See also our Terms of Service.