Privacy
Last updated 6 August 2026.
We sell custom map artwork. To print something and post it to you we need your name, your address and the design you chose — and very little else. This page says exactly what we hold, why, who else sees it, and how to have it removed.
Who we are
Maps & Son is the data controller for the information described here. You can reach us at orders@mapsandson.com.
What we collect
From Etsy, when you place an order
Your order number, your name, and the delivery address you gave Etsy (street, city, county or state, postcode and country). Your email address, where Etsy makes it available to us.
From you, when you design your artwork
The place you choose and its coordinates, the style, size, orientation and framing, any title, subtitle or date you type, and the position of any pin you drop. If you upload a GPX route file we keep the track and the distance, duration and elevation derived from it. You may optionally give us an email address so we can tell you before your artwork goes to print — this is never required, and leaving it blank does not affect your order.
If something arrives damaged
What you tell us went wrong, and any photograph you send. Photographs are stored in a private location, never a public one, because a photograph of a damaged parcel routinely shows a doorstep, an address label or a person.
Automatically
When you look up an order we record a one-way cryptographic hash of your IP address and whether the attempt succeeded, so nobody can guess their way into someone else’s order. We keep the hash, never the address itself. We also use privacy-preserving website analytics that set no cookies and identify nobody; the page address of your design link is stripped of its access code before anything is recorded.
Why, and on what legal basis
- To fulfil your order — name, address, design choices. Necessary to perform our contract with you.
- To email you about your order — the grace period before printing, and problems. Contract, and your consent where you gave us an address voluntarily.
- To stop abuse of the order lookup — the hashed IP address. Our legitimate interest in protecting your order from a stranger.
- To keep accounting records — order details. Legal obligation.
- To connect Strava, if you choose to. Consent, which you can withdraw by disconnecting.
Who else sees it
We do not sell your information and we do not use it for advertising. It is shared only where a service is needed to complete your order:
- Prodigi — printing and delivery. Receives your name, delivery address, and a temporary link to your artwork.
- Etsy — receives the tracking number so Etsy can tell you your parcel is on its way.
- Resend — delivers our emails.
- Supabase — stores our database and files.
- Hetzner (Germany) and Vercel — run the servers that draw your artwork and serve this website.
- Cloudflare — our domain names and email forwarding.
- MapTiler — receives the place name you type into the search box, so it can find it. Nothing identifying you goes with it.
- Strava — only if you connect it. We do not keep your Strava login: the permission lives in your browser for the few minutes it takes to pick a route, and is then discarded.
Some of these operate outside the UK. Where they do, transfers are covered by the supplier’s standard contractual clauses or an adequacy decision.
Your maps
Map data is © OpenStreetMap contributors, with cartography from Protomaps and elevation from Mapzen. Choosing a place on the map does not send your location anywhere — the map is drawn on our own servers.
How long we keep it
- Order and design records — six years, to meet UK tax record-keeping rules.
- Print files and preview images — twelve months after your order ships.
- Damage photographs — twelve months after the claim is settled.
- Order-lookup records — thirty days.
- Email delivery records — twelve months.
Your rights
You can ask for a copy of what we hold, have it corrected, have it deleted, restrict or object to how we use it, or ask for it in a portable format. Email orders@mapsandson.com and we will respond within one month.
Deleting order records before six years may not be possible where we are legally required to keep them — we will tell you if that applies and delete everything else.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk.