Privacy Policy

This Privacy Policy explains how Mapster ("we", "our", or "us") collects, uses, shares, and protects information when you use our platform to create and run surveys on your website or inside your product, share surveys via links, and analyze the responses.

Mapster is operated by Galaxy Labs Limited, a company registered in New Zealand (company number 9439298), and is subject to the New Zealand Privacy Act 2020 and, where applicable, the GDPR and other privacy laws.

Two kinds of people use Mapster: creators (account holders who build and run surveys) and respondents (people who answer them). For creator account data, Galaxy Labs Limited is the data controller. For respondent data collected through a creator's survey, the creator decides what is collected (for example, whether responses are linked to their users' identities), and we process that data on the creator's behalf.

Where we process respondent data on a creator's behalf, our Data Processing Agreement sets out the terms of that processing, and the providers we use are listed on our security page.

• Creator Information:
  • Name and email address (for account registration, handled by our authentication provider)
  • Billing information for paid plans (handled by our payment provider; we do not store card numbers)
  • Surveys you create and your account settings
• Respondent Information (collected when someone answers a survey):
  • The survey answers themselves
  • User attributes the creator chooses to attach to responses (for example an email address, user ID, plan, role, or custom traits passed by the creator's website, product, or survey link). Whether a response is identifiable is the creator's choice; without attributes, responses are not linked to a named individual.
  • Approximate location derived from the IP address at submission time (country, region, city, approximate coordinates, and postal code where available)
  • A hashed, survey-specific version of the IP address (see below), device type, browser, operating system, language preference, a visitor identifier, response timestamps, time taken to complete, and an automated bot-check result
• Usage Information:
  • Device and browser information (e.g., type, OS)
  • Platform interactions (e.g., pages viewed, survey creation)

Mapster's core feature is letting creators link survey responses to their own users. When a creator passes user attributes with a response, those attributes are stored with the response and shown to that creator. The creator is responsible for having a lawful basis to share that data with us and for disclosing this in their own privacy notice. If no attributes are passed, a response is not linked to a named individual.

How we handle IP addresses:

• The IP address of a submission is used transiently to derive approximate location (via our geolocation provider) and to rate-limit submissions as an anti-abuse measure.
• Responses are stored with a salted, survey-specific hash of the IP address, not the raw IP. The hash is used to detect duplicate and abusive submissions and cannot be reversed into the original address.
• If a submission fails to save, our diagnostic logs may temporarily retain the IP address so we can investigate and recover the submission. These records are used only for troubleshooting.

The survey widget may use browser storage (such as localStorage) to remember a visitor identifier and whether a survey was already shown or answered, so respondents are not asked repeatedly.

We use the collected information to:

• Deliver surveys and record responses, including any user attributes the creator attaches
• Show creators analytics on their own survey data, including breakdowns by the attributes and location data collected
• Prevent duplicate, automated, or abusive submissions
• Notify creators about survey results and platform updates
• Provide customer support
• Monitor platform usage, improve features, and detect and fix technical issues

Where the GDPR or UK GDPR applies, we rely on the following legal bases. Where the New Zealand Privacy Act 2020 applies, we collect and use personal information only for the lawful purposes described above.

• Performance of a contract: creating and managing your account, delivering the Services, processing payments, and providing support.
• Legitimate interests: preventing duplicate, automated, and abusive submissions, securing the platform, diagnosing faults, understanding how the product is used so we can improve it, and marketing our own services to existing customers. Our interests here are running a secure and reliable service and growing our business, balanced against the limited impact on individuals, which is why we hash IP addresses on stored responses rather than keeping raw addresses.
• Consent: analytics and advertising cookies and similar technologies where consent is required, marketing emails to people who are not existing customers, and any other purpose we ask you about. You can withdraw consent at any time.
• Legal obligation: keeping tax and accounting records, and responding to lawful requests from authorities.

For respondent data collected through a creator's survey, the creator is responsible for identifying and documenting its own legal basis for collecting that data and for telling respondents about it.

We share information only in these cases:

• With the creator who ran the survey: Responses, including any identifying attributes collected with them, are shown to the creator whose survey they answer. We do not make one creator's response data available to other creators or to the public.
• With Service Providers: We use third-party providers for hosting, database services, authentication, payment processing, IP geolocation, bot protection, analytics, error monitoring, email delivery, and customer support, each processing data only as needed to provide their service. Our current providers are named on our security page.
• For Business Transfers: In case of a merger, acquisition, or asset sale, with notice to users.
• Legal Requirements: To comply with legal obligations or respond to valid requests, while protecting user rights.
• With Consent: For any other purpose, with your explicit permission.

We do not sell personal data.

Our service providers may store and process data outside New Zealand (for example, in the United States). Where personal information is disclosed overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those under the New Zealand Privacy Act 2020.

We use cookies and similar technologies in three distinct places, and they are worth separating.

• Strictly necessary: keeping you signed in to your Mapster account, securing form submissions, and remembering your preferences. These are required for the Services to work and cannot be switched off.
• The survey widget on a creator's site: the widget uses browser storage (such as localStorage) to remember a visitor identifier and whether a survey has already been shown or answered, so respondents are not asked repeatedly. It does not set advertising cookies and does not track respondents across other websites.
• Analytics and advertising on our own website: on mapster.io we use product and website analytics (PostHog and DataFast), a support chat widget (Chatwoot), and advertising and conversion measurement technologies from Meta, Google, and X. The X technology stores a click identifier in a first-party cookie for up to 90 days so we can measure which ads lead to sign-ups. These are not used on survey pages or in the widget shown to your respondents.

Where consent is required for analytics and advertising technologies, we ask for it before they load, and you can change or withdraw your choice at any time. You can also block or delete cookies in your browser settings, and control ad personalization through the settings offered by Meta, Google, and X directly.

We take data security seriously and implement measures to protect your information, including:

• Encryption of data in transit and at rest
• Salted hashing of IP addresses on stored responses
• Input validation and sanitization on all survey submissions
• Restricted access to data through role-based controls
• Secure authentication for creator accounts

While we strive to protect your data, no online platform is 100% secure. Creators who link responses to their users should disclose their use of Mapster in their own privacy notice.

We keep personal data only for as long as we need it for the purposes described above.

• Survey responses and attached attributes: kept for as long as the creator's account is active, because the creator controls this data. Creators can delete individual responses or entire surveys at any time from their dashboard, and can export their data first.
• Creator account data: kept while the account is open and deleted within 30 days of account closure or a deletion request, except where we are required to keep records for longer.
• Raw IP addresses in diagnostic records: if a submission fails to save or a location lookup fails, the raw IP address may be held in a recovery queue. These records are reviewed and cleared regularly, and in any event within 90 days.
• Billing and tax records: kept for 7 years, as required by New Zealand tax law.
• Support conversations and marketing contacts: kept for up to 3 years from your last interaction with us.

Backups are overwritten on a rolling cycle. Data deleted from the live service may persist in a backup for a short period before it is overwritten, and remains protected by this policy until then.

As a creator or respondent, you have rights over your data:

• Access the personal data we hold about you
• Correct inaccurate information in your account
• Request deletion of your account, your surveys, or your response data
• Object to data processing in certain cases
• Request a copy of your data (data portability)
• Withdraw consent where processing is based on consent

If you answered a survey and want your response accessed, corrected, or deleted, the fastest route is the creator who ran the survey (the company whose website or product you answered it on), since they control that data. You can also contact us directly and we will assist: contact@mapster.io

If you are not satisfied with how we handle a privacy request, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz) or, if you are in the EU or UK, to your local data protection authority.

Mapster is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16, and accounts may only be created by adults. If you believe a child has provided us with personal data, contact us at contact@mapster.io and we will delete it.

Creators are responsible for not directing surveys at children without the consent required in their jurisdiction.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Updates will be posted here, with the "Last updated" date revised.

We encourage you to review this policy periodically. Changes are effective upon posting.