Data Processing Addendum

For account, billing and website data we are an independent controller (see the Privacy Policy). For end-user personal data contained in the requests you send to the Service, you are the controller and we are your processor. This DPA governs that processing. You are responsible for the lawfulness of the data you submit and for any required notices or consents.

Subject-matter: processing of the query content you submit. Duration: for the term of your use of the Service. Nature and purpose: receiving requests and returning geocoding, routing, distance-matrix, map-matching, optimization and places results, plus operating, securing and metering the Service. Type of personal data: addresses, place names, coordinates and any personal data you choose to include in a query. Data subjects: your end users and other individuals whose data you submit.

Ordinary synchronous API query content is processed to return a response; it is not saved as a customer profile or in usage logs. Explicitly requested encrypted asynchronous inputs/results expire after 24 hours, with scheduled cleanup. Saved Studio designs/datasets and history are separate optional features, not retention of every API request.

We process end-user personal data only to provide the Service and on your documented instructions (including through your configuration and API calls), unless required otherwise by law, in which case we will inform you where legally permitted. We do not sell such data or use it for our own purposes, advertising or profiling.

We will inform you immediately if, in our opinion, an instruction infringes applicable data-protection law and will not carry out that instruction while the issue remains unresolved.

We ensure that personnel authorized to process the data are bound by appropriate confidentiality obligations.

We implement appropriate technical and organizational measures, including encrypted transport (TLS), access controls, API-key restrictions, network isolation of databases, and transient processing of query content (we do not retain it as a separate profile). Measures are described in the Privacy Policy and may evolve as the Service improves, provided protection is not materially reduced.

Paddle acts as Merchant of Record and an independent controller for its purchase/tax processing. Brevo delivers account and service email. Apple/Google verify mobile applications; your browser requests basemap tiles from OpenFreeMap. These recipients are not all processors of API query content. A party is a sub-processor under our DPA only to the extent it processes covered personal data on our behalf.

Before a sub-processor receives covered personal data, we must require an applicable written agreement with data-protection obligations no less protective than this DPA. We remain responsible for sub-processor performance. This published DPA does not certify that provider agreements have been executed; contact [email protected] for the evidence applicable to your processing. We will give at least 30 days’ prior notice by email before a new or replacement sub-processor begins processing your personal data. You may object during that notice period at [email protected] on reasonable data-protection grounds. We will work with you to resolve the objection; if it cannot be resolved, either party may end the affected processing before the proposed sub-processor receives that data. Mandatory refund rights remain unaffected.

• Contabo — infrastructure and self-managed database hosting in Germany. The hosting country is owner-confirmed; the precise contracting legal entity has not yet been verified from the provider account documents.
• Cloudflare — network delivery and security; OpenAI — prompts for optional AI requests. Provider processing locations and retention depend on the applicable service and arrangement.

Taking into account the nature of the processing and the information available to us, we will assist you with data-subject requests, security of processing, personal-data-breach notifications, data protection impact assessments and prior consultation with supervisory authorities, as required by applicable data-protection law. We will promptly forward requests concerning data we process on your behalf and will not respond on your behalf except on your instructions or as required by law.

We will notify you without undue delay after becoming aware of a personal data breach affecting end-user data processed under this DPA, and provide information reasonably available to help you meet your notification obligations.

Transfers of personal data from the EEA, the United Kingdom or Switzerland must meet applicable data-protection requirements. Where a transfer requires safeguards, the applicable mechanism and its required details must be in place before that transfer. Depending on the transfer, this may require completed Standard Contractual Clauses and annexes, a UK Addendum or IDTA, or another valid legal mechanism. This Policy and our published DPA do not themselves incorporate completed transfer clauses or confirm that a transfer agreement has been executed. Contact [email protected] about the arrangements applicable to your processing.

We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to reasonable audits, subject to confidentiality and reasonable notice, scope and frequency.

At the end of the relevant processing services, at your choice, we will delete or return the personal data we process on your behalf and delete existing copies without undue delay, unless applicable law requires retention. If retention is legally required, we will explain the basis and protect the retained data, using it only for that legal requirement. Where immediate deletion from restricted backups is not technically possible, we will isolate the data from ordinary use, delete it through the applicable backup cycle and reapply the deletion after any restoration. Contact [email protected] to arrange return or deletion. Account and billing records that we process as an independent controller remain subject to the Privacy Policy and applicable legal retention requirements.

Each party’s liability under this DPA is subject to the limitations in the Terms of Service. In case of conflict on data-processing matters, this DPA prevails over the Terms and Privacy Policy. This DPA is governed by the law and forum stated in the Terms.

Data protection contact: [email protected] — MAMMADOFF AGENCY LLC.

Registered in the Republic of Azerbaijan. Tax identification number (VÖEN): 7200653321. Registered address: AZERBAIJAN TARTAR REGION, TARTAR CITY, Nariman Narimanov str, 36.

Map Studio stores saved designs, uploaded geographic datasets and version/publication history. Drafts are private to the workspace; publication exposes the selected map and attached visible data to anyone with its URL. Unpublishing revokes that publication URL but cannot recall downloaded copies. You must have the rights and lawful basis to upload and publish the content. Removing a publication does not by itself delete its saved history.

AI is optional. When requested, the prompt and supported style attributes are sent to OpenAI to interpret intent or propose a style. Our integration does not attach API keys, dataset overlays or coordinate fields to the model request, but your prompt may contain personal data. Do not submit unnecessary personal or confidential information. We do not store prompt/response content in AI operation records. The provider may retain data under its applicable terms; store:false is not a zero-retention promise. Verify AI output before using it. AI allowance and ordinary API credits are separate; exhausting AI allowance does not disable ordinary API access.

Mobile Access processes application/package identifiers, signing identity, installation key identifiers, attestations and assertion counters to verify an application and issue short-lived access tokens. Apple App Attest and Google Play Integrity participate in platform verification; the flow and provider depend on the platform. This is application security, not a promise of anonymity or proof that the person using a device has consented to location processing. The application developer remains responsible for end-user notices and lawful collection.

Public geographic coordinates are not automatically personal data; coordinates or addresses linked to an identifiable person or trip may be. Our DPA applies only where we process personal data on your behalf, including covered saved map content or submitted prompts. Account, payment and service-security processing in our own controller role remains governed by the Privacy Policy.