Privacy policy
As of 8 November 2026 (text version 2026-11-08-v2)
Controller
The controller is the operator of mapx, see the legal notice. Contact for all privacy matters: support@mapx.at.
What data we process and why
| Data | Purpose | Retention |
|---|---|---|
| Email address, sign-in method (email, Google, Microsoft) | Account, sign-in, contact about the service | until the account is deleted |
| Consents: kind (contact, optional newsletter), time, text version, IP address | Proof of consent | until the account is deleted |
| Login codes (hash only), failed attempts, IP address | Email-code sign-in, abuse protection | code valid for 15 minutes, record deleted at the latest one day after expiry |
| Sessions (cookie, session identifier) | Staying signed in, protection against form abuse (CSRF) | 60 minutes idle, 12 hours at most |
| API tokens: name, kind, prefix, hash of the token, allowed domains, Android package, IP ranges, timestamps | Providing the API, access restriction | until the token or the account is deleted |
| Usage counters per token, product, API, day, status class and rejection reason (no request content) | Showing usage, limits, abuse protection | until the token or the account is deleted |
| Gateway and service logs (IP address, time, path without token, status code) | Operation, security, troubleshooting | 30 days, then deleted automatically |
Plaintext login codes and API tokens are never stored; you see a token only once when it is created.
Legal bases
- Art. 6(1)(b) GDPR (contract or pre-contractual steps): account, sign-in and providing the service, including contact about the service and your account.
- Art. 6(1)(f) GDPR (legitimate interest): security, protection against abuse and overload, logs and proof of your consent. You may object on grounds relating to your particular situation.
- Art. 6(1)(a) GDPR (consent): only for the optional newsletter. Consent is voluntary and can be withdrawn at any time with effect for the future (email support@mapx.at).
Recipients and processors
- Email delivery: login codes and service messages are sent through the SMTP server of ProHosting24 (sender noreply@mapx.at).
- Hosting: our own servers in Austria.
- DNS: Cloudflare (name resolution of the domain mapx.at).
- Sign-in with Google or Microsoft (only if you choose it): we receive your verified email address from them; the provider's own privacy terms apply as well.
We do not pass data on to other third parties and do not process it for advertising other than the optional newsletter.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can export your data (JSON) and delete your account yourself under Account. For other requests write to support@mapx.at.
You also have the right to lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, dsb.gv.at.
Cookies
We only use strictly necessary cookies: the session cookie after sign-in and a language preference cookie (mapx_lang, one year). There are no tracking or advertising cookies.