Privacy

Last updated 20 October 2026.

We sell custom map artwork. To print something and post it to you we need your name, your address and the design you chose - and very little else. This page says exactly what we hold, why, who else sees it, and how to have it removed.

Who we are

Maps & Son is the data controller for the information described here. You can reach us at orders@mapsandson.com.

What we collect

From Etsy, when you place an order

Your order number, your name, and the delivery address you gave Etsy (street, city, county or state, postcode and country). Your email address, where Etsy makes it available to us.

From you, when you design your artwork

The place you choose and its coordinates, the style, size, orientation and framing, any title, subtitle or date you type, and the position of any pin you drop. If you upload a GPX route file we keep the track and the distance, duration and elevation derived from it. You may optionally give us an email address so we can tell you before your artwork goes to print - this is never required, and leaving it blank does not affect your order.

If you design before buying

When you design here without an order, we keep your design so that its link (an address beginning /design/) can reopen it later: the place and its coordinates, and the choices listed above. A place worth hanging on a wall is often somebody’s home, so treat that link like a key - anyone who has it can open the design. We keep the design so the link goes on working, and we do not yet delete these automatically; ask us and we will delete yours.

If you share a design

When you press Share, we make a short link (an address beginning /s/) and keep a copy of your design with it, so the person you send it to sees the design exactly as you made it: the place and its coordinates, the framing, the style, your words and date, any pin, and any route with its figures. It does not include a gift message, your own design link or anything about an order. Anyone who has the short link can open that copy, and anyone they forward it to can too, so share it as you would a photo of the design. Their changes make a new design of their own and never touch yours. We also keep a copy of the preview picture you had made, which is what shows when the link is pasted into a chat or a post, so it stays as it was when you shared it even if you change your design later. We keep the copy so the link goes on working, and we do not yet delete these automatically; ask us and we will delete yours.

If you make an account

Our sign-in service (Supabase) keeps your email address and how you sign in, and we link your orders and the designs you save to it, with any name you give a design. You can delete your account yourself, at any time, at the bottom of your account page. That removes your sign-in, takes your saved designs and their names out of it, and stops our reminder and offer emails. Any record we hold of your email preferences is kept, marked as no offers, because forgetting it is how we would start emailing you again. Your past orders are kept, because the law requires it, but are no longer linked to you, and the links in your order emails still work. A saved design is not deleted either: it becomes like any design made without an account, which its link still opens.

If it is a gift

If you tell us an order is a gift, or Etsy tells us, we keep the message you write and the name you sign it with, and the delivery address is the recipient’s rather than yours. We print your message on the slip packed with the artwork, so our printer sees it too. Your message may name or describe the person you are sending it to, and they will not have heard from us before the parcel arrives, so please write only what you are happy for us and our printer to read. We keep it with the order, for as long as order records are kept.

If you start paying but do not finish

When you go to the payment page we record that a checkout began: which design, the price and the time. If you leave without paying, Stripe closes that page after 24 hours and tells us the email address you typed there, if you got that far, with a link that would reopen a payment page for the same artwork. We keep this to see how many people stop at the payment step and, in future, to send one reminder with that link. We do not send any reminder today, and we will update this page before we do. We do not yet delete these records automatically; ask us and we will delete yours.

If something arrives damaged

What you tell us went wrong, and any photograph you send. Photographs are stored in a private location, never a public one, because a photograph of a damaged parcel routinely shows a doorstep, an address label or a person.

Automatically

When you look up an order we record a one-way cryptographic hash of your IP address, a hash of the order number you typed, and whether the attempt succeeded, so nobody can guess their way into someone else’s order, from one address or from many. When you design without an order, we record the same kind of hash each time you make a preview, search for a place, upload a route or use Strava, with what kind of request it was and when, so nobody can run up the cost of our servers by sending thousands of them. When a route or a photo of a damaged print is sent for an order, we record a hash of that order’s link and when, for the same reason. The hash is made with a secret key only our server holds, so it cannot be turned back into your address. We keep the hash, never the address itself, and only the last ten minutes of these design records are ever read. We also use privacy-preserving website analytics that set no cookies and identify nobody; the page address of your design link is stripped of its access code before anything is recorded.

Only if you accept cookies for our ads

Meta and Pinterest learn which pages of our shop you visit and which steps you take (searching, designing, starting to pay), so we can see which of our ads work. They never see the pages for an order, a saved design or a payment. When you buy, we tell them about the sale from our own server: the order value, the product, the ad you clicked, your browser and IP address, and your email address in a scrambled (hashed) form they can only match to an account they already hold. If you reject, or never answer, none of this happens.

If you came here from one of our Google ads, the link carries a reference for that ad click. We keep it in a cookie of our own for 90 days, and when you buy, our server sends Google that reference, what the sale was worth to us, our reference for the payment and your email address in a scrambled (hashed) form, so Google can count the sale against the ad. No Google code runs on this site, and nothing else about you goes to Google. If you reject, or never answer, the reference is never kept and nothing is sent.

See the cookies involved.

If you answer “How did you hear about us?”

The payment page asks this as an optional question. If you answer, we keep your choice with your order so we can see which ways of finding us work. Leaving it blank changes nothing.

If you are a creator we work with

We keep your name, your social media handle and platform, the date you agreed to post, and our own notes about the collaboration, so we can send you your codes and see which posts bring visitors. We do this because we have a legitimate interest in running the collaboration you agreed to. Tell us and we will delete it. When someone taps your link we count the tap, but we store nothing about the person who tapped.

Why, and on what legal basis

To fulfil your order - name, address, design choices. Necessary to perform our contract with you.
To email you about your order - the grace period before printing, and problems. Contract, and your consent where you gave us an address voluntarily.
To offer you a discount on another print - a code in the email confirming a purchase, and only if you bought here rather than through a marketplace, and only to the address you gave at the checkout page. Our legitimate interest in selling to our own customers, under the soft opt-in at regulation 22(3) of the Privacy and Electronic Communications Regulations. Every one of those emails carries a one-click unsubscribe link, and your mail app’s own Unsubscribe button works on them too. Stopping them stops nothing about an order you have already placed.
To remind you about designs you saved - only if you have an account and ticked the box asking for reminders and offers, when you signed up or on your account page. We send occasional emails about designs you saved but have not bought, sometimes with an offer: at most a few a month, around the end of each month and before Christmas. Your consent, which you can take back at any time: every one of those emails carries an unsubscribe link, and you can switch them off on your account page.
To let Trustpilot invite a review - only if you bought here rather than through a marketplace, gave your email address at the checkout page, and the order is not a gift. Once your order is past the time you have to change or cancel it, we send Trustpilot your name, email address and order reference, and Trustpilot emails you to ask what you thought of us. Our legitimate interest in hearing from our customers and letting other people read what they say. You can decline in Trustpilot’s email, and unsubscribing from our offers stops it too.
To stop abuse of the order lookup - the hashed IP address. Our legitimate interest in protecting your order from a stranger.
To stop abuse of the designer - the hashed IP address. Our legitimate interest in keeping the designer free to use without letting anyone run up its costs.
To keep a design you have not bought yet - the place and your choices. Our legitimate interest in letting you come back to your work, and steps you have asked for before buying.
To open a design you shared - the copy of the design, and the hashed IP address that made the link. Our legitimate interest in letting you ask somebody what they think, which you choose to do by sharing.
To print a gift message - the message and the name it is signed with. Necessary to perform our contract with you.
To understand unfinished checkouts - the record of a checkout that began, and the email address Stripe passes on if you leave. Our legitimate interest in seeing where our shop loses people.
To keep accounting records - order details. Legal obligation.
To connect Strava, if you choose to. Consent, which you can withdraw by disconnecting.
To measure our advertising, only if you accept cookies for our ads. Consent, which you can withdraw at any time from “Cookie settings” at the bottom of every page.

Who else sees it

We do not sell your information. Apart from the advertising measurement you can choose to allow (above), it is shared only where a service is needed to complete your order, and with Trustpilot to invite a review:

Stripe - takes payment when you buy here. Receives your name, email address, billing and delivery addresses, and the payment itself. Your card details go straight to Stripe and never reach us.
Prodigi - printing and delivery. Receives your name, delivery address, a temporary link to your artwork and, for a gift, the message printed on the packing slip.
Etsy - receives the tracking number so Etsy can tell you your parcel is on its way.
Resend - delivers our emails.
Trustpilot (Trustpilot A/S, Denmark) - only for an order you bought here that is not a gift, once it is past the time you have to change or cancel it. Receives your name, email address and order reference, so it can invite you to review us. You can decline in its email.
Supabase - stores our database and files.
Hetzner (Germany) and Vercel - run the servers that draw your artwork and serve this website.
Cloudflare - our domain names and email forwarding.
MapTiler - receives the place name you type into the search box, so it can find it. Nothing identifying you goes with it.
Meta Platforms Ireland Ltd - only if you accept cookies for our ads, as described above.
Pinterest Europe Ltd - only if you accept cookies for our ads, as described above.
Google Ireland Ltd - only if you accept cookies for our ads and came from one of our Google ads: when you buy, the reference for the ad you clicked, what the sale was worth to us, our reference for the payment and your email address in a scrambled (hashed) form. Nothing else about you.
Strava - only if you connect it. We do not keep your Strava login: the permission lives in your browser for the few minutes it takes to pick a route, and is then discarded.

Some of these operate outside the UK. Where they do, transfers are covered by the supplier’s standard contractual clauses or an adequacy decision.

Your maps

Map data is © OpenStreetMap contributors, with cartography from Protomaps and elevation from Mapzen. Choosing a place on the map does not send your location anywhere - the map is drawn on our own servers.

How long we keep it

Order and design records - six years, to meet UK tax record-keeping rules.
Print files and preview images - twelve months after your order ships.
Damage photographs - twelve months after the claim is settled.
Order-lookup records - thirty days.
Records of a design made without an order, and of a checkout that was not finished - we do not yet delete these automatically. Ask us and we will delete yours.
Shared designs (short links) - we do not yet delete these automatically, so the link goes on working. Ask us and we will delete yours.
Records that stop abuse of the designer - thirty days.
Email delivery records - twelve months.
A record that you unsubscribed from offers - kept indefinitely, because forgetting it is how we would start emailing you again.

Your rights

You can ask for a copy of what we hold, have it corrected, have it deleted, restrict or object to how we use it, or ask for it in a portable format. Email orders@mapsandson.com and we will respond within one month.

Deleting order records before six years may not be possible where we are legally required to keep them - we will tell you if that applies and delete everything else.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk.