Privacy Policy

This Privacy Policy explains how MapMotion, an animated course map service for running events, processes personal information on this website and while fulfilling orders.

The service operator and data controller is WSoft Servicos LTDA, Brazilian registration (CNPJ) 35.489.697/0001-90, identified with its full address below. For privacy matters, contact mail@mapmotion.ai.

This policy describes our practices. Not all processing relies on consent: each purpose uses the appropriate legal basis as explained below.

We receive information you provide, account data and records needed to operate the service:

• Purchase and account: name, email for access and delivery, WhatsApp contact, account identifier, email verification, order dates and identifiers.
• Event materials: event name, updated contact number, primary color, GPX/KML files or a public Strava link, logo, additional brand assets and optional order notes. Drafts are stored so you can return later.
• File contents: original uploads are retained. Course files can contain coordinates, timestamps and other metadata; images, documents and other files may contain personal information you include.
• Payment: amount, currency, payment status, dates and identifiers returned by Stripe. Full card details are entered directly into Stripe checkout. Our order database does not store your full card number, expiry date or security code.
• Operation and support: your requests, delivery files and technical records needed for security, diagnostics and abuse prevention. Hosting and authentication providers may record IP addresses, browser information, dates and access events.
• Optional measurement: with permission, visit sources, campaign parameters, navigation and click identifiers, purchase funnel actions, and the amount, currency and identifier of a confirmed purchase. Analytics events do not include names, emails, phone numbers, files, courses or access credentials.

Only submit necessary event materials you are authorized to share. Remove unnecessary athlete or third-party data. We do not request your live location. Firebase Hosting estimates your connection’s country from its IP to present the Brazilian or international offer. A manual region preference is remembered in a preference cookie; it does not prove residency or change existing orders.

Choosing Sign in with Google uses Firebase Authentication. Depending on your account, the authentication service may receive your identifier, name, email address, verified email status and profile photo.

We use this information to authenticate you, maintain a secure session and connect access to orders placed with the same email. A profile photo and name in the authentication profile are not required to produce a map. Email-link sign-in is also handled by Firebase.

Information obtained through Google sign-in is not sold, used for personalized advertising or used to train AI models. Its use and sharing are limited to this policy and the applicable Google API Services User Data Policy, including Limited Use requirements where applicable.

Submitting an order does not authorize us to use your files or event videos in MapMotion’s portfolio or advertising. That requires specific permission.

Necessary information is shared with service providers and authorized support and production staff:

• Google and Firebase: authentication, hosting, application processing, databases and file storage through Firebase Authentication, Firebase Hosting and Google Cloud.
• Stripe: payment processing and fraud prevention. Information such as email, order ID, service description, amount and currency is supplied. Stripe collects information needed for checkout directly.
• Hostinger Email: transactional messages about confirmed payment, required materials and available delivery. The provider processes your email, name and summarized order information in the message. Videos remain in the authenticated MapMotion area. Emails do not contain uploaded attachments, private download links or automatic access authorization.
• Google Analytics and Google Ads: visits, purchase steps and advertising results only after permission. Google click identifiers on the public landing page may be sent to its tag to connect a visit to an ad. Confirmed purchases are sent from the server with amount, currency, transaction ID and authorized navigation identifiers. Linking Analytics and Google Ads measures which ads led to purchases. We do not send names, emails or phone numbers, or enable personalized advertising, Google Signals or enhanced conversions using contact data.
• OpenAI Ads Manager: measuring purchases from campaigns with permission. The server sends purchase confirmation, amount, currency, a deduplication identifier and a click reference where available. This version does not load its automatic form-data collection pixel.
• Meta Ads: after Accept cookies, when enabled, we may measure and optimize ads on Facebook and Instagram. Earlier permission limited to Google and OpenAI is not extended to Meta automatically. With applicable permission, the Conversions API receives public visit and purchase steps, confirmed purchase value and currency, deduplication event IDs, valid Meta click or browser references, and browser user-agent information. The server obtains and associates user-agent information only after permission. We do not send names, emails, phone numbers, IP addresses, form contents, private-page URLs or query-string URLs to Meta. We do not load the Meta browser pixel or enable automatic advanced matching.
• Support and production staff: information and materials needed to check the course, produce videos and assist you.
• Authorities and legitimate recipients: where needed to meet a legal obligation, valid order or exercise legal rights within applicable limits.

Providers may process information in other countries. International transfers must follow applicable safeguards, including those under Brazil’s LGPD and relevant contracts. We do not claim that all information remains in Brazil. See Firebase privacy, Google privacy, Stripe privacy, OpenAI privacy and Meta privacy. We do not sell your personal information.

Local or session storage maintains account access and purchase continuity. Firebase can persist a session between visits, with session or memory alternatives when browser storage is restricted.

The selected course and text of an unsaved route link can remain in the same tab’s session storage for up to 24 hours to recover your work. This copy does not contain files or other form fields and is removed when you save the order or sign out.

When requesting an email sign-in link, the site may remember that email for up to one hour to complete sign-in without entering it again. It is removed after sign-in, sign-out or detected expiry. Temporary purchase access is limited to the tab session.

The cookie notice collects your choice for optional Google Analytics, Google Ads, OpenAI Ads Manager and Meta Ads measurement. Accept cookies authorizes the optional technologies described here; Essential only keeps only necessary functionality. Optional tags and events activate only with applicable permission. Earlier choices are preserved, without extending old permission to new providers or reopening a notice merely because Meta measurement is enabled. Update your choice under Privacy and cookies.

Visit sources and campaign references remain in browser storage for up to 30 days; your consent choice for up to 180 days. Google Analytics cookies are configured for up to 30 days; ad measurement cookies follow Google settings. Google click identifiers are read only from the current public page after permission; they are not copied to orders or OpenAI Ads Manager. Authorized sources and navigation identifiers associated with an order form part of its records under the retention criteria below.

When Meta measurement is enabled and authorized, the site may read accessible _fbp and _fbc cookies. A genuine ad click on the current public page may create _fbc, kept for up to 30 days. We do not create a missing Meta browser identifier.

You can revise or withdraw permission under Privacy and cookies. Choosing Essential only removes accessible analytics and advertising cookies and local attribution, stops new events and requests that pending sends for orders accessible to this browser stop. Incomplete withdrawal operations remain locally queued for retry. Withdrawal does not undo events already transmitted; contact us about those records or orders on another device. Necessary Google/Firebase and Stripe authentication, payment and security technologies continue under their privacy information.

Manage storage in your browser settings and use Sign out to end a session. Blocking essential mechanisms may prevent sign-in, payment or order continuity.

Accounts, orders, materials and videos are retained as needed to provide the service and deliveries, handle requests and meet applicable obligations. Retention depends on the data category, order status and any legal or rights-related requirements.

This service version does not automatically delete information after a fixed period. Request account or material deletion through the contact below. We will explain what can be deleted, what must remain and why. Information no longer needed should be deleted or anonymized as applicable.

We use HTTPS, account and permission controls, private file storage and temporary download links. Administrative access is restricted to authorized staff. No system removes all risk. Report suspected unauthorized access and never email passwords, sign-in codes or full card details.

Under Brazil’s LGPD, you can request processing confirmation and access, correction, information about sharing, anonymization, blocking or deletion where applicable, portability within regulatory limits, review of automated decisions where applicable, and withdrawal of consent. Deletion can be limited by lawful retention requirements. Any other mandatory rights that apply to you are preserved.

To exercise your rights, including deleting your MapMotion account and associated information, email mail@mapmotion.ai, preferably from your account email. State the right you wish to exercise and, if needed, your order ID.

We may verify account ownership using proportionate information. You do not need to send a password, token or access code. We respond within applicable deadlines and conditions, protecting other people’s rights too. You may submit a request to the competent data protection authority.

MapMotion is intended for organizers and people authorized to purchase the service. Purchasers must have legal capacity or act as an authorized representative. We do not deliberately request children’s data. Contact us if such information is included in uploaded materials without an appropriate basis.

This policy may change as the service and processing practices evolve. The date above identifies the current version. Material changes will be communicated appropriately. A new purpose requiring consent is not authorized merely by publishing an update.

Read the Terms of Use for ordering, production, delivery and support.