Privacy Policy

Effective: May 28, 2026

This policy explains what CarveMap collects, why, and what you can do about it. It applies to everyone using the Service. CarveMap processes personal data under GDPR.

1. What we collect

• Account data: email, username, password hash.
• Subscription data: tier (Pro), status, renewal date, last-four of the card. Full card details are held by Stripe; CarveMap never sees them.
• Technical data: IP address (short-lived, for abuse prevention and rate limiting), browser/device info, request logs.

2. What we do not collect

• We do not store user-generated posts (the Service is read-only for end users).
• We do not store GPS coordinates of users.
• We do not run advertising trackers.
• We do not sell personal data to anyone.
• We do not share data with data brokers.

3. How we use it

• To operate and improve the Service.
• To authenticate you and prevent abuse.
• To process subscription payments via Stripe.
• To bill API usage and enforce per-tier rate limits.
• To comply with legal obligations and enforce our Terms.

4. Pulse content

Pulses on CarveMap are derived from publicly available sources on the open web. They contain no personal data about you. The pulse content itself is not subject to user-side privacy rights : it is public information about public events.

5. Third parties

• Stripe : payment processing.
• Google Analytics : aggregate page usage statistics. Loaded only with your consent. IPs are anonymised. No advertising features, no cross-site tracking, no remarketing.

We do not run advertising trackers and do not share account data with advertisers or data brokers.

6. Retention

Account records are retained while your account is active and for a reasonable period after deletion for billing reconciliation and legal obligations. Raw IP logs are retained for no more than 90 days. Stripe holds payment records under its own retention rules.

7. Your rights

Under GDPR you have the right to: access your data, correct it, delete it, restrict processing, port it to another service, or object to processing. To exercise a right, email [email protected]. We respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

8. Cookies

Essential cookies keep you signed in, defend the service from abuse and bots, and remember your session. They are always on because the service does not work without them.

Google Analytics runs by default in cookieless mode(Google Consent Mode v2 with analytics_storage denied): no analytics cookies are set, no cross-site identifier is stored, and we still get aggregate page counts. Accepting analytics cookies from the banner upgrades GA to its standard cookie-based mode so we get a sharper picture of how you navigate. IP anonymisation and the no-advertising signals are on in both modes.

Change cookie settings

9. International transfers

Where personal data is transferred across borders, CarveMap relies on appropriate safeguards under GDPR (Standard Contractual Clauses or an equivalent transfer mechanism) for the receiving jurisdiction.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided data, contact us for deletion.

11. Changes

We may update this policy. Material changes will be announced on the Service.

12. Contact

Data protection questions: [email protected]. See also our Terms of Service.