Privacy Policy

1. Scope of this Policy

This Policy applies to personal information processed by OuterMap in connection with the Services, including by users of our mobile application. It does not apply to third-party websites, applications or services that may be linked to or integrated with the Services, which are governed by their own privacy practices. Where an organisation uses the Services to provide maps and related experiences to its own users, that organisation is responsible, as an independent controller, for the personal information it collects from those users; in such cases we act as a service provider on its behalf, under appropriate contractual terms.

2. What is personal information?

"Personal information" means information that identifies, relates to, or could reasonably be used to identify an individual. It does not include information that has been aggregated or de-identified such that it can no longer be associated with an individual.

3. Personal information we collect

We collect personal information that is reasonably necessary for the purposes described in this Policy. The categories of information we may collect include the following.

Information you provide to us

• Account and profile information, such as your name and the credentials you use to sign in. Depending on the part of the Services you use, this may include an email address and password or a mobile telephone number verified by a one-time passcode, together with any optional profile details you choose to provide.
• Content you submit, such as maps, locations, points of interest, descriptions, images and other materials uploaded through our web application, as well as reviews, ratings, comments and similar community content you may post.
• Communications, such as the information you provide when you contact us for support or other enquiries.

Information we collect automatically

• Usage and device information, such as your internet protocol (IP) address and approximate region derived from it, device and browser characteristics, application version, and information about how you interact with the Services.
• Authentication and security information, such as session and verification records used to keep your account secure.
• Location information. Where you use navigation or activity-recording features of our mobile application, and only where you have granted the relevant permission, we collect location information, including precise geolocation. Depending on the feature, location may be collected while the application is in use or, for activity recording, in the background, in which case a clear indicator shows that recording is active. You may disable location access at any time through your device settings, which will disable only the related features.

Information stored on your device

Certain information — such as sign-in tokens, cached profile details, recent searches, preferences and any maps you choose to save for offline use — is stored locally on your device to enable the application to function. This information generally remains on your device and is not transmitted to us, except where transmission is necessary to deliver a feature you have requested. You can clear this information through the application's settings or by uninstalling the application.

Information from other sources

We may receive information from third-party providers in order to deliver certain features, such as publicly available place information and location search results. We do not control, and are not responsible for, the privacy practices of those third parties.

4. How we use personal information

We use personal information for the following purposes:

• to provide, operate, maintain and improve the Services, including account creation, authentication, mapping, navigation and related features;
• to communicate with you, including to send service-related messages such as verification messages and one-time passcodes, and to respond to your enquiries;
• to maintain the security and integrity of the Services and to detect, prevent and address fraud, abuse or technical issues;
• to understand how the Services are used, on an aggregated or de-identified basis, in order to improve them; and
• to comply with applicable legal obligations and to establish, exercise or defend legal claims.

We do not use your content to train third-party artificial-intelligence models, and any AI-assisted output is provided as an editable draft for review before it is published. We do not send marketing communications without your consent where such consent is required.

5. Legal bases for processing

Where applicable law requires a legal basis for processing, we rely, as appropriate, on the performance of our contract with you, our legitimate interests (such as securing and improving the Services), your consent (for example, for access to location), and compliance with our legal obligations. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

6. How we disclose personal information

We do not sell your personal information. We disclose personal information only as described in this Policy, including:

• Service providers. We engage trusted third parties to perform functions on our behalf, such as cloud hosting and storage, map rendering and location services, automated image analysis, communications delivery, and analytics. These providers may process personal information only as necessary to perform their functions for us and are bound by appropriate confidentiality and data-protection obligations. A summary of the categories of providers we use is available on request.
• Organisational customers. Where you use a map or experience published by an organisation, your information may be made available to that organisation as the independent controller of that experience.
• Legal and protective disclosures. We may disclose personal information where we believe in good faith that it is necessary to comply with applicable law or legal process, to protect the rights, property or safety of OuterMap, our users or others, or to detect and prevent fraud or security issues.
• Business transfers. Personal information may be transferred as part of a merger, acquisition, financing or sale of assets, subject to the protections described in this Policy.

Your personal information may be processed and stored in countries other than your own. Where we transfer personal information across borders, we take steps to ensure that it remains protected in accordance with this Policy and applicable law, using appropriate safeguards such as standard contractual clauses where required.

7. Our mobile application and device permissions

Our mobile application may request access to certain capabilities of your device — such as location, camera, photo library, notifications and motion sensors — in order to enable specific features, including navigation, activity recording, scanning to open a map, and uploading images. Permissions are requested in context when a feature is first used, and you may grant or decline them and change your choices at any time in your device settings. Declining a permission disables only the related feature. We do not request access to your microphone or contacts.

8. Cookies and analytics

Our website and web application use cookies and similar technologies that are necessary for the Services to function, that remember your preferences, and that, with your consent where required, help us understand how the Services are used. Our mobile application does not use cookies and contains no third-party advertising technologies. Further information and controls are set out in our Cookie Policy.

9. How we protect personal information

We maintain administrative, technical and organisational safeguards designed to protect personal information against unauthorised access, use, alteration or loss. These include encryption of information in transit, secure storage of credentials, access controls and authentication measures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you are responsible for keeping your sign-in credentials confidential. In the event of a personal-data breach, we will notify the relevant authorities and affected individuals where, and within the time periods, required by applicable law.

10. Retention of personal information

We retain personal information for as long as necessary to provide the Services, to fulfil the purposes described in this Policy, and to comply with our legal obligations, after which it is deleted or de-identified. Retention periods vary according to the nature of the information and the purpose for which it is processed. Where you close your account or request deletion, we will delete or de-identify your personal information within a reasonable period, subject to any information we are required or permitted by law to retain.

11. Children's privacy

The Services are not directed to children under the age of 18, or the applicable age of digital consent in your jurisdiction, and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child without appropriate consent, we will take steps to delete it. A parent or guardian who believes a child has provided personal information may contact us using the details below.

12. Your rights and choices

Subject to applicable law, you may have rights in relation to your personal information, including the right to access, correct, update or delete it, to object to or restrict certain processing, to request a copy in a portable format, and to withdraw consent where processing is based on consent. You may exercise many of these choices directly — for example, by updating your profile, managing device permissions, or deleting your account or locally stored data through the application's settings. To make a request, please contact us using the details below; we will respond within the time period required by applicable law and will not discriminate against you for exercising your rights.

Depending on where you live, you may have additional rights:

• European Economic Area and United Kingdom. You have the rights described above under the General Data Protection Regulation and equivalent United Kingdom law, and the right to lodge a complaint with your local supervisory authority.
• United States. Residents of certain states, including California, have the right to know about, access and delete personal information and to opt out of its sale or sharing. As noted above, we do not sell personal information.
• India. You have the rights described above under the Digital Personal Data Protection Act, 2023, including the right to nominate another individual to exercise your rights in the event of death or incapacity, and the right to grievance redressal.

13. Third-party content and public maps

The Services may include content published by organisations, including maps designated as public, which may be accessible without signing in and may be embedded in other websites. Organisations are responsible for ensuring that content they publish is appropriate for public access. We are not responsible for the privacy practices of third-party websites or services.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. Where changes are material, we will provide notice through the Services or by other appropriate means before they take effect. The "Last updated" date at the foot of this page indicates when this Policy was last revised, and your continued use of the Services after that date constitutes acceptance of the updated Policy.

15. How to contact us

If you have any question about this Policy, or wish to exercise your rights or raise a concern, you may contact us at support@outermap.com. If you are not satisfied with our response, you may have the right to contact the data-protection authority in your jurisdiction.

Last updated: 2 June 2026