Privacy Policy

Last updated: October 2, 2026

What personal information Maps MCP ("we", "us") collects when you use mapsmcp.com, the Maps MCP API and dashboard, and published reports; how we use it; who we share it with; and the choices you have. We don't sell personal information, and our pages carry no advertising or analytics trackers.

What we collect

Account information

Your email address and full name, and your workspace's name. If you create child workspaces, the owner email address you give for each one.

Signup details

The optional details you give when signing up: company, role, what you're building, industry, and how you heard about us. We also record when you agreed to the Terms of Service, and the IP address and browser user agent your signup came from.

Sign-in and security records

When we send you a sign-in link or you start a dashboard session, we store the time, the IP address and browser user agent involved, and a hashed copy of the link or session token. API keys are stored only as SHA-256 hashes plus a short prefix so you can tell them apart, along with when each key was last used.

Usage and billing records

For each metered tool call we record the workspace, the tool name, whether it was a standard or premium call, the number of units, the time, and an error message if the call failed. These records don't include the arguments you passed. On paid plans, Stripe collects your payment details directly, and we never see or store your card number. We store your Stripe customer and subscription IDs, your plan, whether a payment method is on file, and references to your checkout sessions. The billing email we give Stripe is your account email.

Your customer content

The datasets, records, files, shapes, reports, and other content you upload or create, plus workspace settings such as stored secrets (for example a third-party API key), webhook endpoints, and scheduled workflows. This content can include personal information about other people, such as addresses in a contact or donor list. You control that information, and we process it on your behalf to provide the service. If your information is in a Maps MCP customer's workspace, please contact that customer; we will help them respond.

Support tickets

The subject, message, priority, and any context you attach to a ticket, plus the replies and the email address of each person who writes one. Tickets are shared with our team by default. If you mark a ticket private, our support tools hide it from our team.

Email activity

Our email provider reports delivery events for the emails we send, such as delivered, bounced, and marked-as-spam, and opens and clicks where those are reported. We store these events with the recipient's address.

Server logs

Our servers and hosting providers keep operational logs, which can include IP addresses, the URLs and endpoints requested, timestamps, and error details. Some entries include the email address involved in a signup or sign-in, or the coordinates sent to a drive-time tool.

Cookies and browser storage

mapsmcp_session: set when you sign in to the dashboard with an email link, and keeps you signed in for up to 30 days. It is HttpOnly, so page scripts can't read it, and it is sent only over HTTPS.
__cf_bm: set by Cloudflare, which protects our site from automated abuse, to help tell people from bots. It expires after 30 minutes.
The dashboard saves one preference in your browser's local storage: whether you've dismissed the setup guide.

We don't use advertising or analytics cookies or run third-party tracking scripts. Public report pages and some dashboard and documentation pages load open-source map code and fonts from public content-delivery networks (unpkg.com, esm.sh, cdn.redoc.ly, and demotiles.maplibre.org), and reports whose owner chose a Mapbox basemap load map tiles from Mapbox. As with any web content, those services receive your IP address and browser details.

The homepage address demo

If you try the address demo on our homepage without signing in, the address you type is sent to the U.S. Census Bureau's geocoder, the result is kept in server memory for up to 24 hours so repeat lookups are fast, and your IP address is logged and used to rate-limit requests.

How we use it

To provide the service: create and secure your workspace, sign you in, run the tools you call, publish what you choose to publish, and deliver the webhooks you set up.
To meter usage, enforce plan limits, bill you, and keep tax and accounting records.
To keep the service secure and reliable: prevent abuse, rate-limit traffic, debug problems, and audit access.
To support you: answer tickets and emails.
To communicate with you: sign-in links, messages about your account, a short onboarding series after you sign up (five emails over your first two weeks), and occasional product updates. You can opt out of onboarding and product emails at any time.
To understand who uses Maps MCP and improve it, using the optional signup details and usage records.
To comply with the law and enforce our terms.

Where laws such as the GDPR apply, we rely on performing our contract with you; our legitimate interests in running, securing, and improving the service and in telling business users about it; your consent where we ask for it; and our legal obligations.

Who we share it with

We share personal information with the service providers below, who help us run Maps MCP, and with destinations you direct us to. We don't sell personal information or share it for targeted advertising.

Supabase (United States): hosts our primary database, which holds account data, usage records, and your customer content.
DigitalOcean (United States): runs our application servers and keeps application logs. Its object storage holds files you upload with the workspace-file tools and cached copies of public source data.
Cloudflare (United States, with servers worldwide): sits in front of our site and API to deliver content and block attacks and bots, so it handles all web and API traffic, including IP addresses.
Stripe (United States): processes subscription payments. Receives your account email, workspace name and ID, and the payment details you enter on Stripe's pages.
Resend (United States): sends our emails. Receives your email address and name and the contents of the emails we send you.
Anthropic (United States): provides the Claude model behind our AI-assisted tools (describe_report, interpret_hotspot, compare_versions_narrative, nl_query, characterize_place, suggest_neighborhood_polygon, auto_caption, and generate_district_brief). Only when you call one of these tools do we send Anthropic what it needs, such as your question, report titles and descriptions, place names, and summary statistics from your data.
U.S. Census Bureau (United States): its geocoder turns addresses into coordinates for lookup_district_for_address, bulk_match_addresses, and other address-based tools, so the addresses you submit are sent to it. Our queries to its data API contain only geography and table codes.
Mapbox (United States): the default provider for drive-, walk-, and bike-time areas (geo_isochrone, evaluate_site). Receives the coordinates and travel settings of each request. Also serves basemap tiles to people viewing reports whose owners chose a Mapbox basemap.
openrouteservice, run by HeiGIT (Germany): an alternative routing provider, used only when you choose it. Receives the coordinates and travel settings of each request.

We also share information in these cases:

Your own keys. If you store your own API key for a provider as a workspace secret (for example an Anthropic or Mapbox key), we make those calls with your key, and your agreement with that provider governs how it handles the data.
Destinations you choose. Webhooks and scheduled deliveries go to the endpoints you configure, and tools that fetch a URL fetch the one you give them. Webhook deliveries carry event details about your workspace.
Legal and safety. We may disclose information when the law or legal process requires it, or when needed to protect the rights, property, or safety of our users, the public, or Maps MCP.
Business transfers. If Maps MCP is part of a merger, acquisition, or sale of assets, personal information may transfer with it, and this policy will keep applying to it.

To build system data, our servers also download public datasets from government and research publishers. Those requests don't include your personal information.

Public reports are public

When you publish a report, anyone with its link can see it and download its images and underlying data. It can be embedded on other websites, cached by content-delivery networks and browsers, and indexed by search engines. Copies may linger in caches after you unpublish or delete it, and people who already downloaded it may keep their copies. Don't publish personal information unless you intend it to be public. Privacy locks (lock_dataset, lock_report) help prevent accidental publication.

How long we keep it

Account information, signup details, sign-in records, support tickets, email events, and customer content: as long as your account is open, plus a 30-day grace period after it closes, after which we delete them. Deleted data can stay in database backups for up to seven more days, until the backups roll over.
Usage and billing records: as long as we need them for billing, tax, and accounting, which can be longer than your account. Stripe keeps its own records under its own policies.
Rendered map images from the render tools: deleted 24 hours after they're created.
Server logs: 7 days.
Homepage demo lookups: up to 24 hours, in memory only.

How we protect it

Connections to mapsmcp.com are encrypted with HTTPS (TLS).
API keys, sign-in links, and session tokens are stored only as SHA-256 hashes, so a copy of our database doesn't reveal working credentials.
Our database provider encrypts stored data. On top of that, workspace secrets (such as third-party API keys you store) and webhook signing secrets are encrypted with AES-256-GCM by the application before they are saved.
Every API request is tied to one workspace, and our application limits every workspace query to it. As a second layer, row-level security is enabled on our database tables so that database roles other than our application's can't read them.
Privacy locks keep chosen datasets and reports from being published until you remove the lock.
When our team uses our admin tools to view resources in your workspace, the access is recorded, and you can review it with the list_admin_access_log tool.
Outbound webhooks are signed with HMAC-SHA256 so you can verify they came from us.

No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

Your choices and rights

Access and export. Export your workspace's datasets, records, reports, and support tickets at any time with the export_workspace tool, or a single dataset with export_dataset. For account information that the export doesn't include, such as your signup details or usage records, email us.
Correction. Email us to correct your account information.
Deletion. You can delete reports in the dashboard, and workspace files, secrets, and webhooks with their delete tools. To delete datasets, other content, or your whole account, email us.
Email. To stop onboarding and product-update emails, reply to one of them or email us, and we'll opt you out. A hard bounce or a spam complaint also opts you out automatically. We'll still send the emails you need to use the service, such as sign-in links and messages about your account.
Cookies. You can block or delete cookies in your browser, but the dashboard needs the mapsmcp_session cookie to keep you signed in.
Privacy rights. Depending on where you live (for example under the GDPR in Europe or the CCPA in California), you may have the right to access, correct, delete, or port your personal information, and to object to or restrict how we use it. We honor these requests from all users, wherever they live, and won't treat you differently for making one. Email requests from your account address so we can verify them; we aim to respond within 30 days. If you're in the EEA or the UK, you can also complain to your local data protection authority.

Send any of these requests to [email protected].

Children

Maps MCP is not directed to anyone under 18, and we don't knowingly collect personal information from children. If you believe a child has given us personal information, email us and we will delete it.

International users

We store and process data in the United States. Some providers handle data elsewhere: Cloudflare serves traffic from data centers around the world, and openrouteservice, used only if you choose it, is in Germany. If you use Maps MCP from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

Changes to this policy

We will post any changes on this page and update the date at the top. For material changes we will also tell you by email or with a notice on the site before they take effect.

Contact

Questions or requests about privacy: [email protected].