Privacy Policy.
No tracking cookies. No advertising. No profiles of your users. Our servers are in the EU. API logs keep a truncated IP address and are deleted after 30 days. We never use your data or your users’ data to train AI models. The rest of this page is the detailed version.
§ 01Who we are
The controller within the meaning of Art. 4(7) GDPR is:
Toursprung GmbH (“Maptoolkit”, “we”)
Mariahilfer Straße 93/20, 1060 Vienna, Austria
Commercial register: FN 432876h, Commercial Court Vienna
Privacy contact: privacy@maptoolkit.com
Our management and all data processing decisions are located in Vienna. The Austrian Data Protection Authority is therefore our lead supervisory authority. We are not required to appoint a Data Protection Officer (Art. 37 GDPR); all privacy questions go to the address above.
This policy has three parts. Read the one that applies to you:
- Part I · Website and business contacts – you visit www.maptoolkit.com, docs.maptoolkit.com or our status page, book a demo, email us, read our newsletter or follow us on social media.
- Part II · Customers – you or your organisation have a Maptoolkit account and use the admin backend at admin.maptoolkit.net.
- Part III · API Services – your application calls our APIs (maps, routing, geocoding, elevation and others), and your End Users’ devices send requests to us.
Our free community service at maptoolkit.org has its own privacy policy. Use of our API Services is also governed by our Terms of Service and, where we process data on your behalf, our Data Processing Agreement.
§ 02What we do not do
Across the website, the admin backend and the API Services, we do not:
- set tracking cookies, advertising cookies or any cookie that requires consent;
- use browser fingerprinting, or device or cross-site identifiers for tracking;
- build profiles of website visitors or of the End Users of your applications;
- sell, rent or share personal data with advertisers or data brokers;
- use API request data, Customer Data or End User data to train, fine-tune or evaluate machine-learning or AI models;
- buy contact lists;
- make automated decisions with legal or similarly significant effects (Art. 22 GDPR).
There is no consent banner on our website because there is nothing to consent to.
§ 03Where your data is processed
Our own infrastructure runs entirely in the EU: Hetzner in Germany and Finland, backups at Hetzner (Object Storage, Finland) and at Server4You in France.
Some of the service providers listed in § 16 are based in the USA or operate global networks (for example Cloudflare, Google, Mailchimp, Amazon Web Services, GitHub). Where personal data leaves the EU/EEA, the transfer is covered by the EU Commission’s adequacy decision for the EU-US Data Privacy Framework (for certified providers) or by the EU Standard Contractual Clauses (Art. 46 GDPR).
Part I · Website and business contacts
This part covers www.maptoolkit.com (including the map at /map), docs.maptoolkit.com, our status page, demo bookings, email, our newsletter and our social media pages.
§ 04Visiting our website
Server logs. Our website runs on our own servers at Hetzner in Germany, behind Cloudflare. For each request we log a truncated IP address (the last three digits are set to 000 before the entry is written), the time, the requested URL, the referrer and the browser’s user agent. We delete these logs after 30 days.
Cloudflare. Cloudflare (CDN, DDoS protection, DNS) sits in front of the website. It processes your full IP address and standard HTTP data transiently to deliver the page and block attacks. Cloudflare acts as our processor.
Analytics. We count page views with Plausible Analytics, hosted on our own servers (pls.maptoolkit.net). Plausible sets no cookies and stores no IP addresses or personal identifiers; it only gives us aggregate numbers.
No cookies, no third parties. The website sets no cookies. Fonts, scripts and map libraries are served from our own servers. The map at /map uses our own API Services (see Part III).
Legal basis: our legitimate interest in running a secure, working website and understanding how it is used in aggregate (Art. 6(1)(f) GDPR).
§ 05Status page
Our status page is operated by Site24x7 (Zoho Corporation). When you open it, your browser connects directly to Site24x7, which processes your IP address and standard HTTP data as an independent controller under its privacy policy.
§ 06Booking a demo or meeting
You can book a call through our scheduling page, which runs on Cal.com hosted on our own servers. We process your name, email address, company, the time you pick and anything you write in the booking form. The appointment is stored in our Google Workspace calendar; video calls take place in Google Meet.
Legal basis: steps prior to a contract at your request (Art. 6(1)(b) GDPR) or our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR). Retention: booking data is deleted once it is no longer needed for your enquiry, unless it becomes part of a business relationship (§ 08).
§ 07Emailing us
Our email, calendar and video calls run on Google Workspace (Google Cloud EMEA Ltd., Ireland, as our processor). When you email us, we process your address, name, signature details and the content of your message to answer you.
Legal basis: Art. 6(1)(b) GDPR where the email relates to a contract or a request for one, otherwise Art. 6(1)(f) GDPR. Retention: as long as needed for the enquiry; business correspondence is kept for the statutory retention period (generally 7 years under Austrian tax and commercial law).
§ 08Business contacts and CRM
We keep the contact details of customers, prospects and partners in Pipedrive (Pipedrive OÜ, Estonia, as our processor): name, company, role, business email and phone, and the history of our communication. These come from you directly, from meetings and events, or from public professional profiles. We never buy or scrape contact lists.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for customers; our legitimate interest in business development (Art. 6(1)(f) GDPR) for prospects and partners. Retention: for customers, the duration of the business relationship plus statutory retention; for prospects, as long as a business relationship is realistically in prospect. You can object at any time (§ 18).
§ 09Newsletter
We occasionally send a newsletter about product updates using Mailchimp (Intuit Inc., USA). We send it to:
- people who subscribed; and
- existing customers, about our own similar products, as permitted by § 174(4) of the Austrian Telecommunications Act 2021 and Art. 13(2) of the ePrivacy Directive.
We also use Mailchimp for email notices about changes to our sub-processors to customers who sign up for them (Art. 6(1)(b) GDPR).
Every newsletter contains an unsubscribe link, and you can object at any time by email at no cost. Mailchimp records whether an email was opened and which links were clicked; we use this only in aggregate.
Legal basis: consent (Art. 6(1)(a) GDPR) for subscribers; our legitimate interest in direct marketing to existing customers (Art. 6(1)(f) GDPR). Retention: until you unsubscribe; we then keep your address on a block list so we don’t email you again.
§ 10Social media
We have pages on LinkedIn, Facebook and GitHub. When you visit them, the platform processes your data under its own policy; we have no control over that. If you message or comment, we see what you post and your public profile and use it only to reply (Art. 6(1)(f) GDPR).
LinkedIn and Facebook give us aggregate page statistics (“Insights”). For these we are joint controllers with the platform (Art. 26 GDPR). The platform has taken on primary responsibility, including for data subject requests:
- LinkedIn – LinkedIn Ireland Unlimited Company · privacy policy · Page Insights joint controller addendum
- Facebook – Meta Platforms Ireland Ltd. · privacy policy · Page Insights controller addendum
- GitHub – GitHub, Inc., USA · privacy statement. GitHub does not give us visitor statistics; we only see your public activity, such as issues and comments on our repositories.
Part II · Customers
This part covers the people at our customers who have a Maptoolkit account: administrators, developers, billing contacts.
§ 11Your account and the admin backend
You manage API keys, usage and settings at admin.maptoolkit.net. Login runs on Zitadel, hosted on our own servers (id, account, auth and keys.maptoolkit.net); no third-party identity provider is involved.
We process your name, business email, company, role, login credentials (passwords are stored only as hashes), second-factor settings, login events, your API keys and account settings, and support requests you send us.
Cookies. The admin backend and our login service (Zitadel, on our own servers) set only strictly necessary cookies for login, session security and language, which need no consent (§ 165(3) Austrian Telecommunications Act 2021, Art. 5(3) ePrivacy Directive).
Usage data. From the API logs (Part III) we calculate how many requests each account and API key made, per product. We use these counts for billing, quota alerts and capacity planning, and show them to you in the admin backend.
Legal basis: performance of our contract with your organisation (Art. 6(1)(b) GDPR); for login security, our legitimate interest (Art. 6(1)(f) GDPR). Retention: for the lifetime of the account. After the account is closed we delete account data, except what we must keep for billing and tax (§ 12). Aggregated usage counts are kept for the duration of the contract plus 7 years because invoices are based on them.
§ 12Billing
We issue invoices with FastBill (FastBill GmbH, Frankfurt, Germany, as our processor). We process the billing contact’s name and email, company address, VAT ID, invoices, payments and bank details for incoming payments. Our tax advisor and our bank receive this data where needed.
Legal basis: performance of the contract and our legal obligations under Austrian tax and commercial law (Art. 6(1)(b) and (c) GDPR). Retention: 7 years after the end of the year concerned (§ 132 Austrian Federal Fiscal Code, § 212 Austrian Commercial Code).
§ 13Service emails and support
We send transactional emails – account verification, password resets, security notices, invitations, support replies, quota warnings, invoice notifications and service changes – through Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg, as our processor; servers in Stockholm, Sweden). They go only to people with a Maptoolkit account or an invitation to one, never to the End Users of your applications. Amazon processes the recipient’s name and email address, the message and delivery metadata. Open and click tracking is off. Addresses that bounce or report spam are put on a suppression list; you can ask us to remove yours.
You cannot unsubscribe from security and billing notices; you can switch off optional notifications in the admin backend.
Support requests reach us by email (Google Workspace, § 07) or through the admin backend, where they are stored on our own servers. To help answer them, we may process their content with an AI assistant (Anthropic, § 16), which does not use it to train its models.
Legal basis: performance of the contract with your organisation (Art. 6(1)(b) GDPR); for invitations, security notices and the suppression list, our legitimate interest in secure accounts and reliable email delivery (Art. 6(1)(f) GDPR). Retention: support requests for the lifetime of the account; delivery events at Amazon SES for 30 days; suppression list entries until removed.
Part III · API Services
This part covers requests to our API Services. These requests usually come from the devices of the End Users of our customers’ websites and apps.
| Hostname | Service |
|---|---|
tiles.maptoolkit.net | Vector tiles |
styles.maptoolkit.net, styles-cdn.maptoolkit.net | Map styles |
staticmap.maptoolkit.net | Static maps |
routing.maptoolkit.net | Routing, map matching, isochrones |
geocoder.maptoolkit.net | Geocoding |
elevation.maptoolkit.net | Elevation and terrain |
weather.maptoolkit.net | Weather |
rtc.maptoolkit.net, rtc-cdn.maptoolkit.net | Raster tiles |
dataconnector.maptoolkit.net | Maptoolkit Connectors |
enhance.maptoolkit.net | Data enhancement |
Our services also load resources from icons, fonts, utils and pmtiles.maptoolkit.net (and their -cdn variants), for example from map styles. The same logging rules apply to them.
§ 14What our API logs contain
Each request passes through two layers that write logs. Neither layer stores a full IP address.
| Field | Proxy access log | Service log |
|---|---|---|
| API key, account ID | yes | yes |
| Full URL including query parameters | yes | yes |
| Referer, Origin | yes | – |
| User agent | yes | yes |
| Route, HTTP status, duration, response size | – | yes |
| IP address | not logged | truncated (last three digits set to 000) |
| Retention | 30 days | 30 days |
Query parameters can contain personal data. A geocoding search may contain an address, a routing request start and end coordinates. We do not link these to an identifiable person, but we treat them as personal data and delete them with the logs after 30 days.
Backups of our systems are overwritten after at most 90 days.
Cloudflare sits in front of our API endpoints as CDN and DDoS protection (unless agreed otherwise in your contract). It processes the End User’s full IP address and HTTP data transiently to deliver the response.
Monitoring (metrics, logs, alerting) runs on our own servers.
We use the logs only to deliver the service, bill our customers, detect and block abuse, debug errors and plan capacity – never to profile End Users or to train AI models.
§ 15Who is responsible for End User data
Our customers are the controllers for the personal data of their End Users. If you embed our API Services in your application, you decide why and how your End Users’ data is processed, and you are responsible for your own privacy notice and any consent your application needs.
We act as your processor (or sub-processor, if you in turn act for a client) for the request data described in § 14. That processing is governed by our Data Processing Agreement. It refers to our sub-processor list, and we announce new or replaced sub-processors there 30 days in advance.
We act as an independent controller only for the data we need for our own purposes: account administration, billing, aggregated usage statistics, security and abuse prevention, and legal compliance (Parts II and III). Legal basis: Art. 6(1)(b), (c) and (f) GDPR.
If an End User contacts us with a privacy request about your application, we forward it to you and tell the End User that we have done so.
Legal and contact
§ 16Service providers
We work with a small number of providers. Processors act only on our instructions under a data processing agreement (Art. 28 GDPR).
| Provider | Purpose | Role | Location | Safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting of all systems, database backups | Processor | Germany, Finland | EU |
| Server4You GmbH | Backups | Processor | France | EU |
| Cloudflare, Inc. | CDN, DDoS protection, DNS | Processor | Global network, USA | DPF / SCC |
| Google Cloud EMEA Ltd. | Email, calendar, video calls | Processor | EU, USA | DPF / SCC |
| Pipedrive OÜ | CRM | Processor | Germany (Frankfurt), USA (Pipedrive, Inc.) | EU; DPF / SCC |
| Intuit Inc. (Mailchimp) | Newsletter | Processor | USA | DPF / SCC |
| FastBill GmbH | Invoicing | Processor | Germany | EU |
| Amazon Web Services EMEA SARL | Transactional emails (Amazon SES) | Processor | Sweden | EU; DPF / SCC for the US parent |
| Anthropic Ireland, Limited | AI assistance in handling support requests from customers (no End User data) | Processor | USA (Anthropic, PBC) | Standard Contractual Clauses |
| Zoho Corporation (Site24x7) | Status page | Independent controller | USA [after migration: EU (Netherlands, Ireland)] | SCC |
| LinkedIn, Meta, GitHub | Social media pages | Joint or independent controller (§ 10) | EU, USA | DPF / SCC |
We also disclose data to our tax advisor, auditors, lawyers, courts or authorities where the law requires it or where it is needed to establish, exercise or defend legal claims. If Maptoolkit is merged or sold, data may pass to the successor under this policy.
§ 17Retention at a glance
| Data | Retention |
|---|---|
| Website and API logs (truncated IP) | 30 days |
| Backups | at most 90 days |
| Demo bookings | as long as needed for the enquiry |
| Prospect contacts in the CRM | as long as a business relationship is realistically in prospect |
| Account data | lifetime of the account, then deleted |
| Geodata uploaded by customers | until deleted by the customer or the end of the contract (DPA § 10) |
| Invoices and business correspondence | 7 years |
| Newsletter address | until you unsubscribe (then on a block list) |
| Email delivery events (Amazon SES) | 30 days; suppression list until removed |
§ 18Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3)).
You can object at any time to processing based on our legitimate interest (Art. 21), and always to direct marketing.
Write to privacy@maptoolkit.com. We answer within one month and may ask you to confirm your identity. Our API and website logs contain only truncated IP addresses, so we usually cannot match a log entry to you; we will tell you honestly if that is the case.
You can complain to a supervisory authority. Ours is:
Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria · dsb.gv.at
§ 19Security
All traffic to the website, the admin backend and the API Services is encrypted (TLS 1.2 or higher). Access to production systems is limited to a few administrators, protected by passphrase-protected SSH keys and client certificates. Production and staging run on physically separate clusters; customer data is never used for development. Code changes go through pull requests. Backups are stored in separate data centres.
If a data breach affects your data, we inform affected customers without undue delay and notify the supervisory authority as required by law. Report security issues to security@maptoolkit.com (see our security.txt).
§ 20Changes to this policy
We update this policy when our services, providers or the law change. The date at the top shows the current version; previous versions are available on request from privacy@maptoolkit.com. We inform customers by email about material changes.
§ 21Contact
Toursprung GmbH · Mariahilfer Straße 93/20, 1060 Vienna, Austria
Email: privacy@maptoolkit.com · Imprint