Privacy Policy

Spatial Map (“Spatial Map”, “we”, “us”) is an independently operated browser-based 3D facility-mapping service reachable at spatialmap.io. This Privacy Policy explains what information we collect when you use our website and product, how we use it, and the choices you have. We do not sell your personal information.

For payment processing, our payment service provider is Stripe. When you buy a Subscription, Stripe acts as an independent controller for the billing data you provide at checkout — see How we share information below for the split of responsibilities.

Account information. Name, work email, password hash, profile metadata you provide (display name, bio, location, job title, avatar).

Workspace content. Facility layouts, shapes, linked bin and sensor data, custom attribute fields, share tokens, and team-member metadata.

Usage data. Pages visited, features used, browser type, IP address, timestamps. We use this to improve the product and identify bugs.

Communications. Messages you send us — support tickets, sales inquiries, contact-form submissions.

We use the information we collect to:

• Provide, maintain, and improve the Spatial Map platform.
• Authenticate you and protect your workspace from unauthorised access.
• Communicate with you about your account, new features, and security updates.
• Diagnose problems and prevent fraud or abuse.
• Comply with legal obligations and enforce our Terms.

We do not sell personal information. We share information only with:

• Stripe, Inc.— our payment service provider for all paid Subscriptions. Stripe receives the billing information you enter at checkout (name, email, billing address, payment method, purchase history) and processes it under its own Privacy Policy. We receive from Stripe only the metadata needed to grant your Subscription (customer id, subscription id, plan, status, next-bill-date).
• Other service providers that host, monitor, and secure the platform (hosting, email delivery, map tiles, error tracking). See our DPA for the current subprocessor list.
• Members of your workspace — content you create is visible to your teammates per their role.
• Authorities when required by law or to respond to a valid legal request.

We retain workspace content for as long as your account is active. When you delete an account, we erase or anonymise associated data within 30 days, except where retention is required by law (for example, billing records).

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase data we no longer need to keep.
• Restrict or object to certain processing.
• Receive a portable copy of your data.
• Withdraw consent where processing is based on it.

To exercise these rights, contact [email protected].

We use a small number of first-party cookies to keep you signed in and to remember your theme and language preferences. We do not use third-party advertising cookies. Detailed cookie controls are available in your browser settings.

Application data is hosted in the European Union. Some sub-processors (email delivery, DNS/CDN, error monitoring, and Stripe for payments) may process data outside the EU. Where transfers occur, we rely on Standard Contractual Clauses (or an equivalent transfer mechanism) to ensure your data receives an adequate level of protection.

Spatial Map is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

If you are in the EU, EEA, UK, or Switzerland, we rely on the following legal bases:

• Contract — to provide the Platform to you under our Terms.
• Legitimate interests — to secure the Platform, prevent abuse, improve the product, and communicate about your account.
• Consent — for optional marketing emails and non-essential cookies. You can withdraw consent at any time.
• Legal obligation — to comply with tax, accounting, and other statutory requirements.

We host the Platform in ISO 27001 / SOC 2 certified cloud regions, encrypt data in transit (TLS 1.2+) and at rest (AES-256), enforce least-privilege access, log every administrative action, and run continuous vulnerability scans and quarterly penetration tests. See our Security page for the full picture.

If we become aware of a personal-data breach affecting you, we'll notify you and the relevant supervisory authorities within 72 hours as required by GDPR.

California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, to opt out of “sale” or “sharing” of personal information, and to limit use of sensitive personal information. Spatial Map does not sell or share your personal information for cross-context behavioural advertising.

To exercise CCPA/CPRA rights, email [email protected]. We will verify your identity before responding.

Our Data Protection Officer can be reached at [email protected]. EU-based customers can also lodge a complaint with their local supervisory authority.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and, for material changes, notify you by email and an in-product banner at least 30 days before the change takes effect.