Privacy Policy

Introduction

This policy explains what information Anorak Group, LLC, a Texas limited liability company doing business as MapCrates ("MapCrates," "we," "us"), collects when you use the MapCrates websites, account portal, and desktop application, how we use it, and the choices you have. Questions: privacy@mapcrates.com.

1. Information We Collect

Information you give us:

• Beta application information - name, email, phone number, company (optional), job title, work description, GIS experience, software used (optional), and how you expect to use MapCrates. We also store the application decision and private administrative review notes.
• Account information - name, phone number, company (optional), mailing address (optional), email address, and a password we store only in hashed form. We do not offer social media sign-in.
• Billing information - payments are processed by Stripe. We store your Stripe customer ID, subscription plan and status, and billing event records. We never store your full card number.
• Communications - emails you send to our support, security, or privacy addresses, and any files you voluntarily attach.
• Launch-notification signups - an email address, if you join our mailing list.

Information collected automatically:

• Website technical data - IP addresses (stored as hashes rather than raw addresses), browser type, request metadata, and the cookies needed for login sessions and security.
• Desktop app licensing data - a device identifier generated by the app, operating system and app version, and license lease events (login, refresh, release, revocation). This is how we enforce one-active-session licensing.
• Security data - login attempts, audit events, and Cloudflare Turnstile verification tokens used to block bots.

What we deliberately do not collect:

• Your geospatial project data, imagery, attachments, .mapcrate files, or exported exhibits.
• Your device's geolocation. MapCrates processes the location data inside your files, on your machine; we never receive it.
• Sensitive personal information - no health, biometric, genetic, financial account, precise geolocation, or government ID data, and no information about race, religion, or political affiliation.
• Information from data brokers, social networks, or any other third-party sources. We collect information only from you directly and from your use of the Service.
• Behavioral advertising data. We use no third-party analytics or advertising trackers.

2. How We Use Information

• To administer beta access - review tester applications, communicate an approval or decision, and issue a one-time account invitation to approved applicants.
• To provide the service - create and secure your account, verify your email, issue and refresh desktop license leases, deliver installer downloads, and process subscription payments and trials.
• To communicate - administrative emails (verification, password reset, trial and payment notices) and, if you opted in, product news you can unsubscribe from at any time.
• To protect the service - detect fraud and abuse, rate-limit attacks, enforce one-active-session licensing, and maintain audit logs.
• To comply with law - tax and accounting records, and responses to valid legal requests.
• To improve MapCrates - aggregate, non-identifying information (for example, how many installations run each version) to prioritize fixes. If we ever add product analytics, we will update this policy first.

3. Who We Share Information With

We share personal information only with service providers who process it on our behalf:

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or sale of the business (with notice to you).

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not share it with corporate affiliates or business partners. The Service displays no third-party advertisements, and we do not permit third parties to collect information about you through our Service for their own purposes.

4. Cookies

We use only cookies necessary for login sessions, security, and site function. We do not use advertising cookies, cross-site tracking, or Google Maps APIs. Because we use no non-essential cookies, no cookie-consent banner is currently required; if that changes, we will update this policy and add appropriate controls. You can clear or block cookies in your browser, though login will not work without session cookies.

5. Data Retention

• Account data: kept while your account is active; deleted or anonymized within 90 days after account deletion, except records we are required to keep.
• Billing records: retained 7 years for tax, accounting, and dispute obligations.
• Security and license logs: retained 12 months, then deleted or aggregated.
• Support correspondence: retained 24 months after resolution.

6. Your Rights and Choices

You may access and update your profile in account settings; request a copy of the personal data we hold about you; request correction or deletion of your account; and unsubscribe from marketing emails via the link in any message or in account settings. Administrative emails, such as password resets, continue while you have an account.

To exercise any right, email privacy@mapcrates.com; we will respond within 30 days and may verify your identity first.

California residents: you have rights under the CCPA/CPRA to know, access, correct, and delete personal information, and to opt out of its sale or sharing - we do not sell or share personal information - and to non-discrimination for exercising your rights. Use the contact above to exercise them.

7. Security

We use HTTPS for all traffic, hash passwords with a modern algorithm, rate-limit authentication endpoints, require email verification, offer multi-factor authentication, restrict administrative access with role checks and audit logs, and use Cloudflare security controls. Our strongest protection is architectural: we cannot lose, breach, or disclose map data we never possess.

No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you as required by law.

8. Children

MapCrates is a professional tool for users 18 and older. We do not knowingly collect information from children under 13; if we learn we have, we will delete it. Contact privacy@mapcrates.com if you believe a child has provided us information.

9. International Users

MapCrates is operated from the United States and data is processed on U.S.-based infrastructure. If you use MapCrates from outside the U.S., your account information is transferred to and processed in the U.S. MapCrates does not currently market to or target users in the European Union, and we have not appointed an EU representative or a Data Protection Officer; privacy@mapcrates.com is our designated privacy contact.

10. Changes to This Policy

We will post updates here with a new effective date and, for material changes, notify you by email or in-product notice at least 30 days in advance. Prior versions are available on request.

11. Contact

Anorak Group, LLC d/b/a MapCrates
521 Pecos Circle, New Braunfels, TX 78130
Privacy: privacy@mapcrates.com | Security: security@mapcrates.com | Support: support@mapcrates.com | 903-285-1081