Privacy Policy

1. Who we are

The data controller for hotspot.earth is Neuf et demi (SAS), 52 rue Georges Lafont, 44300 Nantes, France (EU VAT FR14818092116). You can reach us at sebastien@neufetdemi.com for anything relating to your data.

This policy describes, in plain language, what personal data we collect, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act of 6 January 1978 as amended.

2. What we collect

• Account data:email address, and — if you sign in with an OAuth provider (Google, Apple) — your name, profile picture URL, and the provider’s stable user ID.
• Creator profile data: username, bio, avatar, social links, and any content you publish (maps, spots, descriptions, photos).
• Payment metadata: Stripe customer ID, Stripe Connect account ID (for creators), amount, currency, timestamp, and the map purchased. We do not see or store card numbers, CVVs, or bank details — those live with Stripe.
• Usage data: server logs containing IP address, user agent, and timestamps of requests. Used for security and debugging.
• Map interaction data: when you open a map, Mapbox loads tiles on your behalf and may receive your IP address and coarse location to serve them.

We do not use advertising trackers. We do not sell your data.

3. Why we use it, and on what legal basis

• Creating and securing your account, and giving you access to the maps you’ve purchased — performance of a contract (GDPR Art. 6(1)(b)).
• Processing payments and paying out creators — contract and legal obligation (accounting, anti-fraud, Art. 6(1)(b) and (c)).
• Transactional email (purchase receipts, password resets, map updates from creators you’ve bought from) — contract or legitimate interest in running the service.
• Security, abuse prevention, and debugging — legitimate interest (Art. 6(1)(f)).

4. Who we share it with

We only share data with processors that make the service work. Each is bound by a data processing agreement.

• Stripe (payments, Stripe Connect payouts, fraud prevention) — Ireland / USA, SCCs in place.
• Supabase (database, authentication, file storage) — EU region.
• Forward Email (transactional email delivery).
• Mapbox (map tiles and geocoding) — receives IP and request metadata from your browser when a map loads.
• Vercel (hosting and CDN).

When a provider is located outside the EEA, transfers rely on Standard Contractual Clauses or equivalent safeguards.

5. How long we keep it

• Account and profile data: for as long as your account exists. Delete your account and it goes.
• Purchase records and invoices: 10 years, as required by French commercial and tax law.
• Server logs: 12 months maximum.

6. Your rights

Under GDPR, you can ask us to:

• access a copy of the data we hold about you;
• correct anything that’s wrong;
• delete your account and associated data (subject to the legal retention periods above);
• export your data in a portable format;
• restrict or object to certain processing.

Email sebastien@neufetdemi.com. We reply within 30 days. You also have the right to lodge a complaint with the French data protection authority, the CNIL.

7. Cookies

We only set strictly necessary cookies (authentication session, CSRF protection). Under French law these do not require prior consent. We do not use analytics or advertising cookies.

8. Changes

If we change this policy materially, we’ll update the effective date at the top and, for registered users, send an email before the change takes effect. See also our legal notice and terms of service.