This policy explains what personal data Maprix collects, why we collect it, who we share it with, how long we keep it, and what you can do about it. It is written to be read, not to be survived: where something is genuinely uncertain we say so rather than filling the gap with reassuring language.
We have not described any practice we do not have. If a section sounds narrow, that is because the underlying processing is narrow.
Who we are and how to reach us
Maprix is a web application that measures where a business ranks in Google Maps local search, across a grid of coordinates around a chosen location, and presents the result as a visibility map.
For the processing described in this policy, the data controller is:
- Controller: Maprix, a product of MAPS SEO LIMITED
- Contact: info@maprix.io, or the in-app support channel at app.maprix.io
What this policy covers
This policy covers both of the addresses we operate:
- maprix.io — the marketing site.
- app.maprix.io — the application, where you hold an account and run scans.
It does not cover websites we link to, or the sites of businesses whose public map listings appear in a scan result.
Cookies and similar storage technologies are described in a separate document, the Cookie Policy, which forms part of this policy.
The personal data we collect
Data you give us
- Account details. Your email address, and your name if you choose to enter one. If you use “Sign in with Google”, we receive only basic profile information — your name and email address — from that sign-in.
- What you ask us to measure. The name and location of the business whose ranking you want to track, and the search terms and scan settings you choose.
- Support messages. Anything you write to us.
Data generated by using the service
- Scan results. The rankings we measure for you, kept in your account history so you can compare over time. These are compiled from publicly available map search results.
- Subscription and transaction records. Your plan, billing period, trial and renewal dates, payment amounts and your customer reference at our payment provider. To stop the free trial being repeated with the same card, we keep a one-way hash (SHA-256) derived from the card fingerprint our payment provider gives us; card details cannot be recovered from it. Card details never reach Maprix systems — the payment is taken on the provider’s own secure page.
- Technical and security records. IP address, sign-in and sign-out times, which scan ran when, and security telemetry used to detect abuse.
Data about third parties that appears in results
A scan result, and the profile analysis built from it, contain publicly available information about businesses — including competing businesses you did not name — and, where reviews are analysed, the text of public reviews and the display names of their authors. We did not collect this from those individuals directly, and we describe how we handle it under Information about people who are not our users.
We do not collect special category data (health, religion, political opinions and the like) and we ask you not to enter it.
Why we use it, and our legal basis
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and secure your account, keep you signed in | You asked for an account | Performance of a contract — Art. 6(1)(b) |
| Run the scans you request, show and store the results | It is the service | Performance of a contract — Art. 6(1)(b) |
| Run your subscription and free trial, take payments and refunds, allocate plan credits, track your balance, send trial-ending and annual renewal reminders | You subscribed | Performance of a contract — Art. 6(1)(b) |
| Stop the free trial being repeated with the same card (hashed card fingerprint) | Preventing abuse of the free trial | Legitimate interests — Art. 6(1)(f) |
| Keep accounting and tax records of those payments | We are required to | Legal obligation — Art. 6(1)(c) |
| Protect the service against bots, fraud and abuse | Keeping the service standing up for everyone | Legitimate interests — Art. 6(1)(f) |
| Answer support requests and send service emails (sign-in, password reset, payment confirmation, trial and renewal reminders) | Running the relationship you asked for | Performance of a contract — Art. 6(1)(b) |
| Analytics and advertising measurement | Understanding whether the site and our advertising work | Consent — Art. 6(1)(a), given through the cookie banner and withdrawable at any time |
| Compile public map and review data into a measurement | Providing a measurement product that cannot exist without it | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that the processing is limited to what a reasonable person would expect from a ranking measurement tool. You can object to it at any time — see Your rights.
Where we rely on consent, withdrawing it is as easy as giving it, and withdrawal does not affect anything we did lawfully beforehand.
We do not sell, rent or trade your personal data.
Automated decision-making
We do not make decisions about you that produce legal or similarly significant effects using automated processing alone. The scores and rankings the product produces are measurements about a business listing, not decisions about a person.
Who we share it with
We use a small number of service providers to run Maprix. Each receives only the data needed for its function, acts on our instructions, and is bound by a written contract.
| What they do | What they receive |
|---|---|
| Authentication and database hosting | Your account and scan data |
| Payment processing | Your email and payment details, entered on their own page |
| Sign-in with Google, if you choose it | Basic profile information for authentication only |
| Content delivery, traffic security and bot protection | Technical connection data, including your IP address |
| Transactional email delivery | Your email address and the content of service emails |
| Map and location data services | The search terms and coordinates needed to run a scan |
| Analytics and advertising measurement | Usage and advertising interaction data; for sign-up, checkout and purchase events also your email address and account ID in hashed (SHA-256) form, your IP address and browser details — only if you consented |
Beyond this, we disclose personal data only where we are legally required to, or in response to a lawful request from a competent authority.
International transfers
Several of the providers listed above are located outside the European Economic Area and the United Kingdom. This means your personal data is transferred internationally.
Where a provider is in a country that does not have an adequacy decision, the transfer relies on the Standard Contractual Clauses included in that provider’s data processing terms.
You may ask us for a copy of the safeguards that apply to a given transfer by writing to info@maprix.io.
How long we keep it
| What | How long |
|---|---|
| Account details and scan history | For as long as your account is open. When you close it, the data is deleted or irreversibly anonymised |
| Payment and invoicing records | For the period required by applicable accounting and tax law, which can run to several years and survives closure of the account |
| Technical and security records | For a short period, as needed for security and record-keeping |
| Your cookie choice | 180 days, then we ask again |
Your rights
If the GDPR or UK GDPR applies to you, you have the right to:
- Access the personal data we hold about you, and receive a copy.
- Rectification — have inaccurate data corrected and incomplete data completed.
- Erasure — have your data deleted, where one of the grounds in Art. 17 applies.
- Restriction — have us pause processing while a dispute is resolved.
- Portability — receive the data you gave us in a structured, machine-readable format, and have it sent to another controller where technically feasible.
- Object — object to processing based on our legitimate interests, including profiling based on them.
- Withdraw consent at any time, where processing rests on consent.
- Complain to a supervisory authority. In the EEA this is the authority in the country where you live, work, or where the issue arose; in the United Kingdom it is the Information Commissioner’s Office.
Write to info@maprix.io to exercise any of these. We will respond within one month, which we may extend by two further months for complex requests, telling you why. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting — that protection exists for you, not for us.
Information about people who are not our users
Scan results and profile analyses contain publicly available information about businesses, and can include the text and author display names of public reviews. Those people are not our users and did not give us their data directly.
Where this information constitutes personal data, our basis for processing it is our legitimate interest in providing a measurement service built on public search results, weighed against the limited privacy impact of reproducing information those individuals published publicly on a map platform. We do not enrich it, build profiles of the individuals concerned, or use it to contact them.
If you are named in material we hold and you want it removed, write to info@maprix.io and tell us where you appear.
Security
- All connections are encrypted in transit.
- Card details are never stored by Maprix; payment runs on a PCI DSS certified provider’s infrastructure.
- Bot protection and human verification guard the sign-up and authentication paths.
- Access to accounts is protected by authentication, and internal access is limited to what a task requires.
No system is perfectly secure. If we detect a personal data breach we will act on it and make the notifications the law requires, including to you where the breach is likely to result in a high risk to your rights. Please use a strong, unique password and do not share your sign-in details.
Children
Maprix is a business tool for business owners and agencies. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If we learn that we hold data about a child, we delete it.
Users in Türkiye
If you are in Türkiye, Law No. 6698 on the Protection of Personal Data (KVKK) applies to you in addition to this policy. The controlling text for those rights is our Turkish-language notice, which sets out the categories of data, the legal grounds under KVKK, the international transfer position and the Art. 11 rights and application procedure:
- KVKK Aydınlatma Metni — our Turkish-language notice under Law No. 6698
We deliberately do not publish an English translation of that notice. KVKK rights are exercised in Turkish, before a Turkish authority, under Turkish procedural rules; a second English text would be a second authoritative document that could drift from the first.
Changes to this policy
We update this policy when what we do changes. The current version is always published here and the “Last updated” date reflects the most recent change. Where a change materially affects you, we will make a reasonable effort to tell you through an appropriate channel.
Contact
- Email: info@maprix.io
- In-app support: the support section at app.maprix.io