Privacy Policy

This policy explains what MapPull collects and why. MapPull is operated by Zanevan Engineering, LLC, a company based in Missouri, United States, which is the "controller" (in the language of European and UK data-protection law) or "business" (in the language of California law) responsible for the personal information described here. Contact: chase@zanevan.com.

This policy applies to everyone who uses MapPull, wherever they are. Some sections describe rights that the law gives only to people in particular places; where that is the case, the section says so.

Account information: your email address, an account identifier, and whether you have confirmed your email. Authentication is handled by Google Firebase Authentication; we never see or store your password.

Billing information: if you subscribe, Stripe processes your payment and we store only your Stripe customer identifier, your plan, your subscription status, and the date your current period ends. Stripe collects your billing address (and, if you provide one, your business tax identification number) to calculate tax and to comply with its own legal obligations; we can see that information in Stripe but do not copy it into our own systems. We never receive or store your card number.

Usage: whether your free export has been used, and ordinary server logs (including IP address) kept for security and abuse prevention.

Country counts: to decide where to offer MapPull Pro next, we keep anonymous totals of how many people from each country create an account, tell us they are outside the United States when upgrading, or have a purchase refunded because their billing address is outside the United States. We record only the country, taken from your network connection or, for a refund, your billing address. The totals never include your name, email address, or IP address and are not linked to your account.

Visit counts: to see how many people use MapPull and how they found it, we count page views with Vercel Web Analytics. Each count records the page that was viewed, the site that linked to it, an approximate location (country, region, and city, worked out from your network connection), and your browser, operating system, and type of device. It uses no cookies and stores nothing in your browser. To tell one visitor from another within a single day it uses a short-lived code worked out from your request, which is discarded after 24 hours; the counts are not tied to your IP address, and they cannot be used to follow you from one site to another. They are not linked to your name, your email address, or your account. Before a page view is counted we remove everything after the "?" in the page address, which is where a map link you pasted would appear, and the pages you reach from our verification and password-reset emails are not counted at all.

If you are in the European Economic Area, the United Kingdom, or Switzerland, the law requires us to have a legal basis for each use of your personal information. Ours are: performance of our contract with you — creating your account, confirming your email, enforcing the free-tier limit, taking payment, and providing Pro; our legitimate interests in keeping the Service secure, preventing abuse of the free tier, understanding which countries want the Service, understanding how many people visit the Service and how they found it, and defending legal claims, which we have balanced against your interests and which we consider proportionate given how little we collect; and compliance with legal obligations, chiefly keeping tax and accounting records of payments.

We do not rely on consent for anything described in this policy, and we do not send marketing email. If we ever ask for your consent for something, we will do it separately and you will be able to withdraw it.

We do not store the map data you export. Conversion happens in your browser, and the resulting files are produced on your own device and never uploaded to us.

We do not sell or rent your personal information, we do not "share" it for cross-context behavioural advertising (as California law uses that term), and we do not use it for advertising or profiling of any kind. We have not done so in the preceding twelve months.

We do not use advertising trackers, and we do not use analytics that identify you or follow you from one site to another. The only analytics we use are the anonymous visit counts described in Section 2. See Section 11 on cookies.

We rely on Google (Firebase Authentication and Cloud Firestore) to hold account records, Stripe to process payments and calculate tax, and Vercel to host the Service and to count visits to it (Vercel Web Analytics, described in Section 2). Each processes data on our behalf under a data-processing agreement and its own terms, and none of them may use your information for their own purposes. The public mapping services you point MapPull at will see requests originating from your browser, and their own privacy practices apply. When the link you paste isn't a recognizable ArcGIS map, our server fetches that page itself to look for the data service behind it, so in that case the request comes from Zanevan's servers rather than your browser. Separately, some source ArcGIS servers allow the feature data itself to be fetched from a browser but refuse browser requests for the layer's own details (its name, fields, and similar metadata); when that happens, our server fetches that metadata on your behalf, while the feature data itself still downloads directly to your browser as usual.

The area map you draw a box on loads its background tiles from OpenStreetMap. Loading those tiles works like loading any image embedded in a page: OpenStreetMap's servers receive the request and see your IP address, under OpenStreetMap's own privacy policy, not ours.

We may use Upstash, a hosted database provider, to hold short-lived counters of export requests keyed to your IP address, solely to enforce rate limits and prevent abuse. Those counters expire automatically and are not tied to your account.

We disclose personal information beyond these providers only where the law requires it (for example, a valid legal demand or a tax authority), to protect the Service or the rights of others, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to it.

MapPull is operated from the United States, and your account records are stored on Google Cloud in the United States. Stripe and Vercel also process data in the United States. If you use MapPull from outside the United States, your personal information is transferred to the United States.

For people in the EEA, the UK, and Switzerland: the United States does not have a general adequacy decision. Our providers — Google, Stripe, and Vercel — are each certified under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions), and our agreements with them include the European Commission's Standard Contractual Clauses and the UK Addendum as a further safeguard. You can ask us at chase@zanevan.com for details of the safeguards that apply to your information.

We keep account records while your account is open and for as long as needed afterwards to meet tax, accounting, and legal obligations — payment records for the period tax law requires, which is generally seven years. Server logs are kept for a short, rolling period for security purposes. To delete your account, email chase@zanevan.com and we will action it, subject to those obligations.

Access to account records is restricted by server-enforced security rules, and transport is encrypted. No system is perfectly secure; we do not claim otherwise. If a breach affects your information we will notify you, and any regulator, as required by law.

Wherever you are, you can ask us what personal information we hold about you, ask us to correct it, or ask us to delete your account. Email chase@zanevan.com from the address on your account so that we can verify it is you; we may ask a follow-up question if we need to. We do not charge for these requests and will not treat you differently for making one. We will respond within the time the law allows — normally within one month.

If you are in the EEA, the UK, or Switzerland, you additionally have the rights to restrict or object to our processing, to receive the information you gave us in a portable format, and to lodge a complaint with your data-protection supervisory authority — for example, the ICO in the UK, or the authority in the EU member state where you live. We would appreciate the chance to address your concern first, but you do not have to come to us before going to them.

If you are a California resident, the rights to know, to correct, to delete, and to non-discrimination described above apply to you under the California Consumer Privacy Act. Because we do not sell or share personal information, there is nothing to opt out of; we honor that position for everyone, not only Californians. You may authorise someone to make a request on your behalf; we will ask for evidence of that authority. Residents of other U.S. states with similar laws have the same rights and can use the same address.

Automated decisions: we do not make decisions about you by automated means that have legal or similarly significant effects. The free-tier limit is a fixed rule applied to every account, not a judgement about you.

MapPull is a professional tool and is not directed to children. We do not knowingly collect personal information from anyone under 16 (or under the age at which a person can consent to an online service where they live, if higher). If you believe a child has created an account, email chase@zanevan.com and we will delete it.

MapPull sets no advertising cookies, no analytics cookies, and no third-party trackers. The only thing stored in your browser is what is strictly necessary for the Service to work: your sign-in state (kept by Firebase Authentication in your browser's local storage so you stay signed in between visits) and Stripe's own fraud-prevention cookie on Stripe's checkout pages, which is governed by Stripe's privacy policy. The visit counts described in Section 2 use no cookies and store nothing in your browser. Because none of this is optional or used for tracking, we do not show a cookie banner. Signing out clears your sign-in state.

We may update this policy. We will post the effective date at the top of this page, and for material changes we will tell you by email or by a notice in the Service before they take effect.

Questions, corrections, deletion requests, or anything else about your information: chase@zanevan.com. Post: Zanevan Engineering, LLC, Missouri, United States.