Last updated: 2 October 2026
MAPROUTE ("we", "us") makes animated travel-route videos at maproute.app. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).
Who we are
The data controller is F1 Communications I.K.E., Gythiou 3-5, 151 22 Marousi, Athens, Greece. VAT number (ΑΦΜ): 998405988 (EU VAT ID: EL998405988). ΓΕΜΗ number: 008328201000
Contact for privacy questions: info@f1com.gr
The short version
- Your videos render on your own device. Route data, photos and music are not uploaded unless you save a project to your account.
- You can make watermarked videos without an account.
- We never sell your data. We don't use advertising trackers.
- Card details go straight to Stripe; we never see or store them.
What we collect and why
| Data | When | Why | Legal basis |
|---|---|---|---|
| Email address | You sign in | To send sign-in links and run your account | Contract (Art. 6(1)(b)) |
| Name, email, profile picture from Google | You sign in with Google | To create and run your account | Contract |
| Saved projects (stops, labels, styles, photos, logo) | You save a project or brand kit | To store and reopen your work | Contract |
| Purchases, credits, subscription status, export records | You buy or export | To deliver what you paid for and prevent abuse | Contract; legitimate interest (Art. 6(1)(f)) |
| Billing name, billing address, country, VAT ID (if given) | You check out | To charge the correct VAT and keep tax records | Legal obligation (Art. 6(1)(c)) |
| Marketing emails | Only if you tick the box | To send product news and offers | Consent (Art. 6(1)(a)) |
| "How did you find us?" answer | Only if you answer | To understand which channels work | Consent |
| IP address, browser type, request logs | Every visit | Security, rate-limiting, keeping the service running | Legitimate interest |
| Anonymous usage statistics | Every visit | To understand how the site is used | Legitimate interest |
We do not collect special categories of data, and we do not make automated decisions about you that have legal or similarly significant effects.
Data stored only in your browser
Your current draft is saved in your browser's local storage (IndexedDB) so it survives a reload. Uploaded music is held in memory only and is not saved. This data stays on your device until you clear it.
Cookies
We use one essential cookie to keep you signed in. Our analytics (Plausible Analytics) is cookieless and does not track you across sites. We use no advertising or social media cookies, so we don't show a cookie banner. If this changes, we will ask for your consent first.
Who we share data with
We use these service providers (processors) to run MAPROUTE. They may only use your data to provide their service to us.
| Provider | Purpose |
|---|---|
| Vercel Inc. | Website hosting |
| Neon Inc. | Database |
| Resend | Sign-in emails |
| Stripe Payments Europe Ltd. | Payments and tax calculation |
| Plausible Analytics | Anonymous, cookieless statistics |
| Sign-in with Google (only if you choose it) | |
| OpenFreeMap | Map tiles (receives your IP address when the map loads) |
| Photon (komoot) and OpenStreetMap Nominatim | Place search (receives your search text and IP address) |
Stripe also processes payment data as an independent controller under its own privacy policy.
We may disclose data where the law requires it, for example to tax authorities.
Transfers outside the EU
Some providers are in the USA. Where they are certified under the EU–US Data Privacy Framework, or we rely on the European Commission's Standard Contractual Clauses, your data is protected to EU standards.
How long we keep data
- Account and saved projects: until you delete them or your account.
- Purchase and invoice records: for as long as Greek tax law requires, even after account deletion.
- Server logs: up to 30 days.
- Marketing consent: until you withdraw it.
Your rights
You can ask us to:
- give you a copy of your data (access and portability)
- correct it (rectification)
- delete it (erasure)
- limit or stop how we use it (restriction and objection)
- withdraw consent at any time, for example by using the unsubscribe link in any marketing email
You can delete your account and saved projects in Account settings, or email info@f1com.gr. We reply within one month.
If you think we have mishandled your data, you can complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority in your own EU country.
Children
MAPROUTE is not intended for children under 15. We do not knowingly collect their data.
Security
All traffic is encrypted (HTTPS with HSTS). Sign-in uses one-time email links or Google, so we store no passwords. Access to production data is limited to people who need it.
Changes
If we change this policy in a way that matters, we will update the date above and tell signed-in users by email or on the site.