1. Who we are
This policy explains how Foodmap, LLC ("Foodmap," "we," "us") collects, uses and shares personal information when you use www.foodmap.build and the maps we host (the "Service"). For the purposes of the GDPR and UK GDPR, Foodmap, LLC is the controller of that information.
Contact: support@foodmap.build · Foodmap, LLC, 2614 4th Street, Santa Monica, CA 90405, USA
2. Short version
We collect your email address so you can sign in, the maps you build and edit, and basic technical logs.
Payments go through Stripe. We never see your full card number.
Maps you build are reachable by anyone holding the map's link.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We do not run advertising, analytics or third-party tracking on the Service. The only cookies we set are the ones required for sign-in. We also keep a few small settings in your own browser (see Section 5).
We use AI to generate descriptions of venues. We do not send your personal information to AI providers, and your content is not used to train third-party models.
If you use the "locate me" control, your location stays in your browser and is never sent to us.
3. Information we collect
3.1 Information you give us
| What | Why we have it |
|---|---|
| Email address | To create your account, sign you in by emailed link and code, and send you receipts and build notifications. We do not send marketing email. |
| Account identifier and sign-in tokens | To keep you signed in and to link your maps to you |
| Maps you build: destination, sources selected, build options, map titles, and any edits, notes or places you add | To produce and host your map |
| Access codes you redeem or transfer | To apply your entitlements |
| Messages you send us (support, feedback, legal notices) | To respond and keep records |
3.2 Information we collect automatically
Application logs — our web server does not record an access log. Our application servers write operational log lines, which can include IP address, requested path, timestamps and response status, to the system journal on our server. These are used to diagnose faults and investigate abuse.
Service activity — builds you start and their status, maps you own, sign-in events, entitlement and code usage.
Map view counts — we count how many times each hosted map is viewed in a month in order to enforce per-map view limits. These counts are recorded against the map. We do not store the IP address or any identifier of the person viewing a map. Views by automated link-preview crawlers, and views by a map's own owner, are not counted.
Cookies — see Section 5.
3.3 Location information
If you use the "locate me" control on a map, your browser will ask for permission and provide your device's location to the page. That location is used in your browser to centre the map. It is never transmitted to or stored by Foodmap. If you allow it, your browser remembers only the fact that you allowed it (a yes/no setting kept on your device), so the map can find you next time without asking again; the location itself is not stored. You can refuse, and you can revoke the permission at any time in your browser or device settings.
Your approximate location may also be inferred from your IP address in our server logs, as it is for any website.
3.4 Information from third parties
Stripe gives us your subscription and payment status, customer and subscription identifiers, and limited card metadata such as brand, last four digits, expiry and country. Stripe does not give us your full card number.
Resend, our email delivery provider, processes your email address to deliver the emails we send you and keeps its own delivery records under its own privacy policy.
3.5 Venue information is not about you
Most of the data in the Service describes businesses — their names, addresses, coordinates, opening hours, published ratings, and the publications that have recommended them — together with descriptions generated automatically. That is business information, not information about you. Where a chef, writer or other individual is named in a published citation, that name comes from the publication cited.
4. How we use information, and our legal bases
| Purpose | Legal basis (EEA/UK) |
|---|---|
| Create and operate your account and sign you in | Performance of a contract |
| Build, host, display and let you edit your maps | Performance of a contract |
| Take payment, manage subscriptions, apply codes and enforce limits | Performance of a contract; legal obligation (tax and accounting) |
| Send service emails (sign-in links, receipts, build outcomes, changes to terms) | Performance of a contract |
| Keep the Service secure, prevent fraud and abuse, enforce caps and terms | Legitimate interests in protecting the Service |
| Diagnose faults and improve performance, quality and features | Legitimate interests in operating and improving our product |
| Send marketing or product-update emails (we do not currently send any) | Consent (you may unsubscribe at any time) |
| Respond to legal requests and establish or defend legal claims | Legal obligation; legitimate interests |
We do not use your personal information to make automated decisions about you that produce legal or similarly significant effects.
5. Cookies
We use only what the Service needs in order to work. We do not use advertising, retargeting, analytics or cross-site tracking cookies, and we do not operate any analytics tool.
| What is stored | Purpose | Type |
|---|---|---|
| Session cookie (signed token) | Keeps you signed in | Strictly necessary |
| Sign-in security cookies | Protect the sign-in form against cross-site request forgery, and return you to the page you started from | Strictly necessary |
| Sign-in verification token | Validates your emailed link or code | Strictly necessary |
| Browser local storage (stays on your device) | Holds an unfinished map draft so you do not lose your work, and remembers whether you have turned on the “locate me” control. This is stored by your browser on your own device and is not transmitted to us. | Strictly necessary |
| Stripe cookies (on Stripe’s checkout pages) | Payment processing and fraud prevention | Strictly necessary (Stripe) |
Everything in the table above is required for the Service to work. We set no advertising, retargeting, analytics or cross-site tracking storage of any kind, and we operate no analytics tool. Google Maps may set cookies or use local storage when a map is displayed; that use is governed by the Google Privacy Policy. You can block or delete cookies and site data in your browser, but doing so will stop sign-in from working. If we ever store anything on your device that is not necessary to run the Service, we will ask for your consent first where the law requires it.
6. Artificial intelligence
We use third-party AI models (currently Anthropic's Claude) to generate short descriptions of venues and to help categorise them. These calls are about venues, not about you: we do not send your email address, account identifier or other personal information to AI providers, and under our provider’s commercial terms, what we send is not used to train its models.
AI-generated text can be wrong. See Section 4 of our Terms of Service.
7. How we share information
We do not sell your personal information. We share it only as follows.
Service providers, who may act only on our instructions:
| Provider | Role | Location |
|---|---|---|
| Google (Maps Platform) | Map display and place data | United States / global |
| Stripe | Payments and subscriptions | United States / global |
| DigitalOcean | Hosting and infrastructure | San Francisco, United States |
| Resend | Sending sign-in and service emails | United States |
| Anthropic | Generating venue descriptions (no personal data sent) | United States |
Other people. Anyone holding the link to a map you built can view that map, including its title, destination, places and any notes you add. Your email address and account identity are not shown on the map.
Legal and safety. We may disclose information if required by law, subpoena or court order, or where we reasonably believe disclosure is necessary to protect our rights, to investigate fraud or abuse, or to protect the safety of any person.
Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.
8. What other people can see
Hosted maps are addressed by an unguessable link and require no sign-in to view. Treat a map link as public. Do not put home addresses, private notes about identifiable people, or other sensitive content into a map. You can delete a map at any time from your account. Deleting a map first moves it to your Deleted section, where its link keeps working; the link stops working only when you choose Delete forever. Copies may still persist in third-party caches or in our backups for a period.
9. How long we keep information
| Data | Retention |
|---|---|
| Account and email address | Until you ask us to delete your account |
| Maps you built | Until you delete them forever, or your account is deleted |
| Preview maps | Access ends 60 minutes after the map is built. A nightly process marks expired previews as deleted about 24 hours later, after which they are no longer accessible. |
| Sign-in tokens | Short-lived; expire automatically (sign-in codes and links after 30 minutes) |
| Payment and tax records | 7 years, as required by tax and accounting law |
| Application logs | Kept in our server’s system journal and removed automatically as the journal reaches its storage limit, rather than after a fixed period |
| Backups | Copies of our database are made before maintenance and kept on our server. They are deleted periodically rather than on a fixed schedule, so deleted information can remain in a backup for some time |
| Support correspondence | As long as needed to handle the matter and keep reasonable records |
We may keep information longer where needed to comply with law or to establish, exercise or defend legal claims.
10. Security
We use transport encryption (HTTPS), signed and time-limited sign-in tokens, access controls on our infrastructure, and separation of payment data to Stripe. No system is perfectly secure, and we cannot guarantee the security of information transmitted to or from the Service. Because sign-in uses your email address, the security of your account depends on the security of your inbox.
11. International transfers
We are based in the United States and our infrastructure and providers are in the United States. If you are in the EEA, the UK or Switzerland, your information will be transferred to the United States. We rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) with our providers, and on our providers' certifications under the EU–US Data Privacy Framework where available. You may request details of the relevant safeguards at support@foodmap.build.
12. Your rights
12.1 If you are in the EEA, UK or Switzerland
You have the right to access your personal information; to rectify it; to erase it; to restrict or object to processing (including processing based on our legitimate interests); to data portability; and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).
12.2 If you are a US state resident
Subject to your state's law and its thresholds, you may have the right to know what personal information we collect, use and disclose; to access it and obtain a portable copy; to correct inaccuracies; to delete it; to opt out of sale, of sharing for cross-context behavioural advertising, and of profiling; and to limit the use of sensitive personal information.
We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use it for profiling in furtherance of decisions producing legal or similarly significant effects — and have not done so in the preceding 12 months. We will not discriminate against you for exercising your rights. If we deny a request, you may appeal by replying to our decision, and we will respond within the period your state's law requires.
Categories collected in the last 12 months (California Civil Code §1798.110): identifiers (email address, account identifier, IP address); commercial information (subscriptions, purchases, codes redeemed); internet or network activity (pages viewed, builds run, maps owned); coarse geolocation inferred from IP address; and content you create. We collect these from you directly, from your device automatically, and from Stripe. We disclose them for business purposes only to the providers listed in Section 7. We do not collect sensitive personal information as that term is defined in California law.
California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing purposes.
12.3 How to exercise your rights
Email support@foodmap.build from the address on your account, or write to us at the address in Section 1. We will verify your request by confirming control of that email address, and may ask for more information if we cannot. An authorised agent may act for you with written permission. We respond within the time your law allows — generally 30 days (EEA/UK) or 45 days (US states), extendable where permitted.
13. Children
The Service is not directed to children. You must be 18 to create an account. We do not knowingly collect personal information from anyone under 13, or under 16 in the EEA and UK. If you believe a child has provided us with information, email support@foodmap.build and we will delete it.
14. Global Privacy Control and Do Not Track
Because we do not sell personal information or share it for advertising, an opt-out preference signal has no effect on what we do. We honour Global Privacy Control signals where applicable law requires. We do not respond to browser "Do Not Track" signals, as there is no common standard for them.
15. Changes to this policy
We may update this policy. We will post the new version with an updated date and, for material changes, notify you by email or in the Service before the change takes effect.
16. Contact
Foodmap, LLC
2614 4th Street, Santa Monica, CA 90405, USA
support@foodmap.build