Privacy Policy

OSRMRoute is a trading name of MAMMADOFF AGENCY LLC. This Policy covers our marketing sites, developer APIs, dashboard and SDKs.

We are the controller of the personal data described in this Policy. For personal data of your end users that you send to our geocoding, routing, matrix, optimization or places endpoints, you are the controller and we act as your processor under our Data Processing Addendum (DPA).

Privacy contact: [email protected]. You may use this address for data-protection questions, including requests from the EEA or UK. No EEA or UK data-protection representative has been appointed.

We collect the following categories of data:

• Account data — the email address you register with and a securely hashed version of your password (never stored in plain text).
• Profile & billing data — optional name/company and billing details. Paddle handles full payment-card numbers and security codes. We retain transaction references, amounts, currency, payment status and credit-ledger records needed to provide and account for purchases.
• API keys and configuration — the keys you generate and their plan, limits and restriction settings.
• Preference and agreement records — marketing opt-in provenance, unsubscribe preferences, and the accepted legal-document version and acceptance time. Historical acceptance is not inferred from account creation.
• Request metadata — API usage records contain the API key ID, service name, source IP address, HTTP status, response latency and timestamp. Request coordinates, query text, referrer and user-agent are excluded from these usage and web-server logs. IP retention is described in Section 8.
• Query content — the coordinates, addresses and search terms you send, processed to return results (see Section 3).
• Cookies & similar — a strictly necessary authentication cookie and, with consent, analytics cookies (Section 5).
• We do not buy, rent or enrich personal data from data brokers.

When you call our geocoding, routing, matrix, optimization or places endpoints, the addresses, place names and coordinates you submit may contain personal data of your end users, and may reveal a person’s location, home or workplace. We treat such location data with elevated care.

For that query content you are the controller and we are your processor, processing it only to return results and to operate, secure and meter the Service, under our DPA. We do not sell query content, do not use it to build or maintain end-user profiles, and do not use it to train AI or machine-learning systems. Query content is processed transiently to produce a result and is not retained as a separate profile.

You are responsible for having a lawful basis to submit such data and for providing any required notices to your end users.

We process personal data for the purposes and on the legal bases below (Article 6 EU/UK GDPR, where it applies to you). Where we rely on legitimate interests, we balance them against your rights and freedoms. For query content, the legal basis for the underlying personal data is your responsibility as controller.

Cookie choices can be reopened using the Cookie preferences control. Declining withdraws website analytics/advertising measurement consent, removes accessible measurement cookies and reloads the page to stop initialized tags. Authentication remains independent. Marketing email requires a separate affirmative opt-in; old preselected preferences without current opt-in evidence do not qualify for consent-based sending.

With consent, we send Google the transaction ID, purchase value excluding tax, and currency to measure completed API purchases and attribute them to ads. We do not include your email, name or card details in these purchase events. We honor GPC and Do Not Track by disabling this measurement; advertising personalization is disabled.

Paddle acts as Merchant of Record and an independent controller for its purchase/tax processing. Brevo delivers account and service email. Apple/Google verify mobile applications; your browser requests basemap tiles from OpenFreeMap. These recipients are not all processors of API query content. A party is a sub-processor under our DPA only to the extent it processes covered personal data on our behalf.

• Contabo — infrastructure and self-managed database hosting in Germany. The hosting country is owner-confirmed; the precise contracting legal entity has not yet been verified from the provider account documents.
• Cloudflare — network delivery and security; OpenAI — prompts for optional AI requests. Provider processing locations and retention depend on the applicable service and arrangement.

We also disclose data to authorities or third parties where required by law, legal process, or to protect rights, safety and security, and to a successor in a merger, acquisition or asset sale (subject to this Policy).

Transfers of personal data from the EEA, the United Kingdom or Switzerland must meet applicable data-protection requirements. Where a transfer requires safeguards, the applicable mechanism and its required details must be in place before that transfer. Depending on the transfer, this may require completed Standard Contractual Clauses and annexes, a UK Addendum or IDTA, or another valid legal mechanism. This Policy and our published DPA do not themselves incorporate completed transfer clauses or confirm that a transfer agreement has been executed. Contact [email protected] about the arrangements applicable to your processing.

We keep personal data only as long as necessary for the purposes above. Indicative periods:

We use technical and organizational measures to protect personal data, including password hashing, encrypted transport (HTTPS/TLS), scoped access controls, per-key restriction controls, network isolation of our databases and least-privilege access for staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If the GDPR or UK GDPR applies to you, you have the rights to access, rectification, erasure, restriction, objection, portability, and to withdraw consent at any time without affecting prior processing. To exercise them, email [email protected]. You also have the right to lodge a complaint with your local supervisory authority (for example, your national data protection authority; UK residents may contact the ICO).

Notice at collection: Section 2 describes the categories collected, Section 4 the purposes, and Section 8 retention. We do not sell API query content. Website analytics and advertising measurement involve Google as described in Section 5; these disclosures may fall within statutory sale/sharing or targeted-advertising definitions depending on applicable law and processing. Decline or withdraw measurement through Cookie preferences; we also honor Global Privacy Control and Do Not Track. Precise location linked to an identifiable person is handled only for the requested service.

If you are a resident of California (CCPA/CPRA) or a state with a comparable law (including Virginia, Colorado, Connecticut, Texas, Utah and Oregon), you may have the rights to know/access, delete, correct, opt out of sale/sharing and targeted advertising, limit the use of sensitive personal information, and to non-discrimination for exercising your rights. Where a request is denied, you may appeal by replying to our response; we will respond within the period required by your state’s law.

To exercise these rights, email [email protected]. We may need to verify your identity, and you may use an authorized agent with proof of authorization.

We do not carry out automated decision-making that produces legal or similarly significant effects on individuals within the meaning of Article 22 GDPR, and we do not profile your end users.

The Service is a developer/business product not directed to children. We do not knowingly collect personal data from children under 16 (EEA) or under 13 (US/COPPA, UK). If you believe a child has provided us data, contact us and we will delete it.

If a personal data breach affects data for which we are the controller, we will notify the relevant supervisory authority and affected individuals as and where required by law (including the GDPR’s 72-hour authority-notification standard and applicable US state breach-notification laws). Our obligations as a processor are set out in the DPA.

Our results derive from open datasets, principally OpenStreetMap (ODbL) and Overture Maps. Reverse geocoding and places search can return public source information, such as a business name or building address, that we did not receive from you. Contact [email protected] about our processing or your rights. Corrections to an upstream map feature may also require an update through the relevant open-data project, for example https://www.openstreetmap.org.

We may update this Policy from time to time. We will post the updated version with a new “last updated” date and, for material changes, provide advance notice by email or in the dashboard before they take effect.

Data controller: MAMMADOFF AGENCY LLC. Privacy contact: [email protected]. No EEA or UK data-protection representative has been appointed. You may complain to your competent supervisory authority. See also our Data Processing Addendum.

Registered in the Republic of Azerbaijan. Tax identification number (VÖEN): 7200653321. Registered address: AZERBAIJAN TARTAR REGION, TARTAR CITY, Nariman Narimanov str, 36.

Map Studio stores saved designs, uploaded geographic datasets and version/publication history. Drafts are private to the workspace; publication exposes the selected map and attached visible data to anyone with its URL. Unpublishing revokes that publication URL but cannot recall downloaded copies. You must have the rights and lawful basis to upload and publish the content. Removing a publication does not by itself delete its saved history.

AI is optional. When requested, the prompt and supported style attributes are sent to OpenAI to interpret intent or propose a style. Our integration does not attach API keys, dataset overlays or coordinate fields to the model request, but your prompt may contain personal data. Do not submit unnecessary personal or confidential information. We do not store prompt/response content in AI operation records. The provider may retain data under its applicable terms; store:false is not a zero-retention promise. Verify AI output before using it. AI allowance and ordinary API credits are separate; exhausting AI allowance does not disable ordinary API access.

Mobile Access processes application/package identifiers, signing identity, installation key identifiers, attestations and assertion counters to verify an application and issue short-lived access tokens. Apple App Attest and Google Play Integrity participate in platform verification; the flow and provider depend on the platform. This is application security, not a promise of anonymity or proof that the person using a device has consented to location processing. The application developer remains responsible for end-user notices and lawful collection.

Public geographic coordinates are not automatically personal data; coordinates or addresses linked to an identifiable person or trip may be. Our DPA applies only where we process personal data on your behalf, including covered saved map content or submitted prompts. Account, payment and service-security processing in our own controller role remains governed by the Privacy Policy.

Cookie choices can be reopened using the Cookie preferences control. Declining withdraws website analytics/advertising measurement consent, removes accessible measurement cookies and reloads the page to stop initialized tags. Authentication remains independent. Marketing email requires a separate affirmative opt-in; old preselected preferences without current opt-in evidence do not qualify for consent-based sending.

Ordinary synchronous API query content is processed to return a response; it is not saved as a customer profile or in usage logs. Explicitly requested encrypted asynchronous inputs/results expire after 24 hours, with scheduled cleanup. Saved Studio designs/datasets and history are separate optional features, not retention of every API request.