Draft. This page is being prepared and has not been legally reviewed yet.
Privacy policy
Last updated: 12 November 2026
We collect as little about you as we can. This is our personal data policy (política de tratamiento de datos personales): what we collect, why, who helps us process it, how long we keep it, and how you can use your rights.
1. Who is responsible for your data
The person responsible for your data (responsable del tratamiento, or data controller) is Sergio Alejandro Franco Forero, an individual (persona natural), based in Bogotá, Colombia, trading as MapVivid. For anything about your data, write to mapvivid@gmail.com. We answer privacy requests ourselves; there is no separate department.
We follow Colombian data protection law (Ley 1581 de 2012 and Decreto 1377 de 2013, now in Decreto 1074 de 2015). Because MapVivid is also offered to people in the European Union, we also follow the EU General Data Protection Regulation (GDPR) for them.
By creating an account, building an AI trip or ticking a consent box, you authorise us to process your data as explained here. You can withdraw that authorisation at any time (section 6), unless we must keep the data by law or to fulfil a contract with you.
2. What we collect and why
| What | Why | Legal basis (GDPR, for EU visitors) |
|---|---|---|
| Account: email, name (optional), password (stored only as an encrypted hash) | Create your account, sign you in, keep your saved cities, trips and itineraries | Contract (art. 6.1.b) |
| Email for an AI trip, and whether you already used your free trip | Send you your trip link and give one free AI trip per person | Contract (art. 6.1.b) and our legitimate interest in preventing abuse (art. 6.1.f) |
| Trip details you give us: destination, dates, interests, pace, and anything you write in the description box | Build your AI trip and keep it at its link | Contract (art. 6.1.b) |
| Purchases: plan, amount, date, country, and a customer number from Paddle | Give you what you paid for, handle refunds and keep accounting records | Contract (art. 6.1.b) and legal obligation (art. 6.1.c) |
| Messages you send us | Answer you | Legitimate interest (art. 6.1.f), or contract if it is about your account |
| Technical data: IP address, browser, pages requested, errors | Keep the site secure and working, block abuse | Legitimate interest (art. 6.1.f) |
| Visit statistics through Google Analytics (only if you accept analytics cookies) | Understand which pages and cities are used so we can improve them | Consent (art. 6.1.a), which you can withdraw at any time in Cookie settings |
| Visit statistics through Umami (no cookies, no IP address or other personal data stored) | Count visits and measure page speed | Legitimate interest (art. 6.1.f) |
| Marketing emails (only if you tick the box) | Tell you about new cities, features and offers | Consent (art. 6.1.a); every email has an unsubscribe link |
We do not need sensitive data (such as health, religion or ethnic origin), so please do not include it in the trip description box. We do not sell your data, and we do not use your data to make decisions that have legal or similarly significant effects on you. The AI only plans your trip.
3. Who helps us run MapVivid
We use the providers below. Those marked as processors only act on our instructions under a data processing agreement.
- Supabase (processor): database and sign-in. Your account and trips are stored in the United States (North Virginia).
- Cloudflare (processor): hosting and security. Requests pass through its worldwide network.
- Umami Software, Inc. (processor): visit statistics without cookies. It receives page views and actions such as "signed up", but does not store your IP address or anything that identifies you. Its data is stored in the EU.
- Anthropic (processor): the AI model that writes AI trips. It receives your trip details, not your email or name, and does not use them to train its models.
- Google: Google Maps shows maps and place information on our pages. When a map loads, your browser connects to Google, which receives your IP address and may set its own cookies, under the Google privacy policy. If you accept analytics cookies, Google Analytics (processor) also receives visit data; it does not store IP addresses, we keep this data for 14 months, and advertising features are switched off.
- Paddle (independent controller): Paddle is the Merchant of Record for our sales. It collects your payment details, name, email, address and tax data directly, under the Paddle privacy notice. We never see your card details.
We may also disclose data when the law requires it, for example to tax authorities or a court.
4. International transfers
Your data is processed outside Colombia: our database is in the United States (North Virginia), and some providers (Cloudflare, Anthropic, Google and possibly Paddle) are based in or process data in the United States or the United Kingdom. We only use providers that protect data to the standard Colombian law requires, under contracts that bind them to it, and by giving your authorisation you accept these transfers.
For visitors in the EU, data sent outside the EU is protected by the EU–US Data Privacy Framework where the provider is certified, by an adequacy decision (UK), or by the European Commission's Standard Contractual Clauses. Data sent to us in Colombia is protected by Standard Contractual Clauses or the GDPR exceptions for providing a service you asked for. You can ask us for a copy of the safeguards.
5. How long we keep your data
- Account and saved items: until you delete your account. We delete accounts unused for 3 years after warning you by email.
- Free AI trips: 15 days after they are made, then the trip and its link are deleted.
- Paid and PRO trips: while your account exists, or until you delete them.
- Purchase records: as long as tax and accounting law requires (in Colombia, generally 10 years).
- Record of who used a free AI trip: up to 2 years, to keep the one-free-trip limit fair.
- Server and security logs: up to 30 days unless needed to investigate an incident.
- Marketing consent: until you unsubscribe, then we keep only a record that you did.
6. Your rights
Free of charge, you can:
- know, see and get a copy of the data we hold about you;
- update or correct it;
- ask for proof of the authorisation you gave us, and be told how we have used your data;
- withdraw your authorisation, or ask us to delete your data, when we have no legal duty to keep it;
- if you are in the EU, also restrict or object to its use and receive it in a portable format.
How to ask. Write to mapvivid@gmail.com from the email linked to your account, saying what you want. If we need to check who you are, we will ask for the minimum information.
- Questions about your data (consultas): we answer within 10 working days. If we can't, we tell you why and answer within 5 more working days.
- Requests to correct, update or delete data, or complaints (reclamos): we answer within 15 working days. If we can't, we tell you why and answer within 8 more working days. If your request is incomplete, we ask you to complete it within 5 days.
- For visitors in the EU we never take longer than one month, as the GDPR requires.
If you are not happy with our answer, you can complain to Colombia's data protection authority, the Superintendencia de Industria y Comercio (SIC), after first writing to us. If you are in the EU, you can complain to the data protection authority of the country where you live.
7. Children
MapVivid accounts are for adults. Anyone under 18 needs the authorisation of a parent or legal guardian, who should create the account or approve it. If you think a child has given us their data without that, write to us and we will delete it.
8. Security
Data travels encrypted (HTTPS), passwords are stored as hashes, and database access is limited by per-user security rules. No system is perfect: if a breach puts your data at risk we will tell you, the SIC and, for EU visitors, the relevant EU authority, as the law requires.
9. Cookies
We use a few necessary cookies and, only if you accept, analytics cookies. See our cookie policy.
10. Changes and effective date
This policy applies from 12 November 2026. We will update this page when what we do with data changes. If a change is important, we will tell you by email or on the site before it applies. Your data is kept for as long as section 5 says.