CLAIM
← Map

LEGAL · UPDATED SEP 2026

PrivacyPolicy

This Privacy Policy explains how SpotMyMap processes personal data. Controller: BinkyCode OÜ, an Estonian private limited company (OÜ), registry code 17575236, registered 2026-08-13, Sõle tn 27d-28, 10614 Tallinn, Estonia (not VAT registered). Postal address: Sõle tn 27d-28, 10614 Tallinn, Estonia. Contact: support@spotmymap.com.

Controller and contact

The controller is BinkyCode OÜ, an Estonian private limited company (OÜ), registry code 17575236, registered 2026-08-13, Sõle tn 27d-28, 10614 Tallinn, Estonia (not VAT registered) (registry code 17575236). Privacy questions and data-subject requests: support@spotmymap.com, or the data deletion form / contact form.

Processing activities

  • Checkout and placement records - name/brand, abbrev, country, contribution amount and currency, listing stance, optional logo and links, optional confirmation-email override, claim status, and Stripe session/payment references. Purpose: perform the placement contract and show the listing. Lawful basis: contract / steps prior to contract. Stored in D1 and with Stripe as payment processor. Required to complete paid checkout.
  • Post-purchase confirmation email - manage link and placement summary to the Stripe Checkout email or your confirmation override. Purpose: deliver access to manage the listing. Lawful basis: contract. Sent via Cloudflare Email Sending.
  • Manage tokens and sessions - signed manage link (HMAC) exchanged for an HttpOnly wo_manage session cookie. Purpose: let you edit your listing without a password account. Lawful basis: contract. Manage-link token lifetime: 60 days from mint unless exchanged earlier. Session cookie: 4 hours.
  • Logos and placement assets - uploaded images stored in object storage (Cloudflare R2) and served via the CDN / image pipeline. Purpose: display your listing. Lawful basis: contract. Retention follows the placement record while the listing remains stored for service and dispute handling.
  • Complaints - name (optional), email, subject, message, locale, hashed IP, case timestamps. Purpose: handle written consumer complaints and respond within 15 days. Lawful basis: legal obligation and/or legitimate interests in handling trader complaints. Stored in D1 until the case is closed and thereafter while needed to demonstrate how the complaint was handled.
  • Withdrawal requests - name, email, optional purchase identifiers and identifying hints, optional message, hashed IP, submission timestamp. Purpose: process consumer withdrawal from the distance contract and send immediate confirmation. Lawful basis: legal obligation / contract. Stored in D1 for the time needed to process the withdrawal and related accounting or dispute follow-up.
  • Content reports - optional reporter name/email, content URL, reason, detail, hashed IP. Purpose: review illegal or policy-breaking content. Lawful basis: legitimate interests and legal obligations for notice handling. Stored in D1 until resolved and while needed for enforcement records.
  • Contact / support messages - email and message text. Purpose: reply to support. Lawful basis: legitimate interests / steps prior to contract. Delivered to the support inbox via Cloudflare Email Sending.
  • Charity votes / suggestions and feature requests - text and optional contact when the live forms collect them. Purpose: run product feedback and charity-cause selection. Lawful basis: legitimate interests / consent where a contact email is optional. Stored in D1 while the poll or request remains relevant to product operations.
  • Bot protection (Turnstile) - Cloudflare Turnstile tokens on public forms. Purpose: abuse prevention. Lawful basis: legitimate interests. Processed by Cloudflare; SpotMyMap stores success/failure only as needed to accept or reject the submission.
  • Security and edge logs - IP, user-agent, path, timing, error traces via Cloudflare. Purpose: security, reliability, abuse detection. Lawful basis: legitimate interests. Retention follows Cloudflare's standard edge-log retention for the account configuration.
  • Optional analytics / RUM - only if you opt in via cookie settings and the corresponding first-party beacons are enabled. Purpose: understand performance and usage. Lawful basis: consent. Stored in D1 and deleted on a rolling 90-day window when those tables are in use. Withdrawing analytics consent stops further collection and clears queued client samples.
  • Browser preferences - consent record, theme, sound, currency display preference, and similar UX keys in localStorage / sessionStorage. Purpose: keep the site usable and remember choices. Lawful basis: essential storage for consent / display; preferences otherwise on consent. Retention: until you clear site data or turn Preferences off in cookie settings.

Payments

Live charges use a payment provider. Map activation waits on a signed webhook, not the success page alone.

Card and wallet payment data is processed by Stripe. SpotMyMap does not store card numbers. Stripe's privacy notice applies to payment-provider processing. SpotMyMap keeps payment references and amounts needed to activate, support, refund, and account for placements.

Recipients and international transfers

Processors used to run the service include Cloudflare (hosting, D1, R2, Images, Email Sending, Turnstile, Access for admin) and Stripe (payments). Data may be processed in the EEA and in other regions where those providers operate, under their contractual safeguards (including Standard Contractual Clauses where applicable). We do not sell personal data.

Cookies and similar tech

Essential storage keeps the site usable (consent record and display theme). Optional preference storage is off unless you allow it. Optional analytics stay off until you consent. Details: Cookies.

Retention criteria

  • Active placements - kept while the listing remains on the service and thereafter for as long as needed to handle disputes, chargebacks, accounting, and legal claims related to that purchase.
  • Manage session cookie - 4 hours.
  • Manage magic-link token - 60 days from mint, or until exchanged for a session.
  • Complaint and withdrawal cases - kept while open and afterward for as long as needed to demonstrate handling and meet applicable legal/accounting obligations.
  • Optional analytics / RUM rows - rolling 90 days when those tables are used.
  • Browser preference keys - until cleared or consent withdrawn.
  • Payment and accounting records - retained for as long as required to meet bookkeeping, tax, and consumer-dispute obligations applicable to BinkyCode OÜ.

Your rights (GDPR)

Where the GDPR applies, you may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent where processing is consent-based. We respond to data-subject requests without undue delay and within one month of receipt (extendable as allowed by law for complex requests). That timeline is separate from the 15-day written consumer-complaint response clock on Complaints.

Start with the data deletion form, your manage link for a specific placement, or email support@spotmymap.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

Children

SpotMyMap is aimed at businesses, creators and communities - not at children. Do not submit personal data about anyone under 16.

Changes

We update this page when collection, payments or hosting change. The date at the top shows the latest revision.

Related: Terms · Cookies · Withdrawal · Info eesti keeles