Privacy Policy

This Privacy Policy explains how Mapster ("we", "our", or "us") collects, uses, shares, and protects information when you use our platform to create and run surveys on your website or inside your product, share surveys via links, and analyze the responses.

Mapster is operated by Galaxy Labs Limited, a company registered in New Zealand (company number 9439298), and is subject to the New Zealand Privacy Act 2020 and, where applicable, the GDPR and other privacy laws.

Two kinds of people use Mapster: creators (account holders who build and run surveys) and respondents (people who answer them). For creator account data, Galaxy Labs Limited is the data controller. For respondent data collected through a creator's survey, the creator decides what is collected (for example, whether responses are linked to their users' identities), and we process that data on the creator's behalf.

• Creator Information:
  • Name and email address (for account registration, handled by our authentication provider)
  • Billing information for paid plans (handled by our payment provider; we do not store card numbers)
  • Surveys you create and your account settings
• Respondent Information (collected when someone answers a survey):
  • The survey answers themselves
  • User attributes the creator chooses to attach to responses (for example an email address, user ID, plan, role, or custom traits passed by the creator's website, product, or survey link). Whether a response is identifiable is the creator's choice; without attributes, responses are not linked to a named individual.
  • Approximate location derived from the IP address at submission time (country, region, city, approximate coordinates, and postal code where available)
  • A hashed, survey-specific version of the IP address (see below), device type, browser, operating system, language preference, a visitor identifier, response timestamps, time taken to complete, and an automated bot-check result
• Usage Information:
  • Device and browser information (e.g., type, OS)
  • Platform interactions (e.g., pages viewed, survey creation)

Mapster's core feature is letting creators link survey responses to their own users. When a creator passes user attributes with a response, those attributes are stored with the response and shown to that creator. The creator is responsible for having a lawful basis to share that data with us and for disclosing this in their own privacy notice. If no attributes are passed, a response is not linked to a named individual.

How we handle IP addresses:

• The IP address of a submission is used transiently to derive approximate location (via our geolocation provider) and to rate-limit submissions as an anti-abuse measure.
• Responses are stored with a salted, survey-specific hash of the IP address, not the raw IP. The hash is used to detect duplicate and abusive submissions and cannot be reversed into the original address.
• If a submission fails to save, our diagnostic logs may temporarily retain the IP address so we can investigate and recover the submission. These records are used only for troubleshooting.

The survey widget may use browser storage (such as localStorage) to remember a visitor identifier and whether a survey was already shown or answered, so respondents are not asked repeatedly.

We use the collected information to:

• Deliver surveys and record responses, including any user attributes the creator attaches
• Show creators analytics on their own survey data, including breakdowns by the attributes and location data collected
• Prevent duplicate, automated, or abusive submissions
• Notify creators about survey results and platform updates
• Provide customer support
• Monitor platform usage, improve features, and detect and fix technical issues

We share information only in these cases:

• With the creator who ran the survey: Responses, including any identifying attributes collected with them, are shown to the creator whose survey they answer. We do not make one creator's response data available to other creators or to the public.
• With Service Providers: We use third-party providers for hosting, database services, authentication, payment processing, IP geolocation, bot protection, analytics, error monitoring, email delivery, and customer support, each processing data only as needed to provide their service.
• For Business Transfers: In case of a merger, acquisition, or asset sale, with notice to users.
• Legal Requirements: To comply with legal obligations or respond to valid requests, while protecting user rights.
• With Consent: For any other purpose, with your explicit permission.

We do not sell personal data.

Our service providers may store and process data outside New Zealand (for example, in the United States). Where personal information is disclosed overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those under the New Zealand Privacy Act 2020.

We take data security seriously and implement measures to protect your information, including:

• Encryption of data in transit and at rest
• Salted hashing of IP addresses on stored responses
• Input validation and sanitization on all survey submissions
• Restricted access to data through role-based controls
• Secure authentication for creator accounts

While we strive to protect your data, no online platform is 100% secure. Creators who link responses to their users should disclose their use of Mapster in their own privacy notice.

As a creator or respondent, you have rights over your data:

• Access the personal data we hold about you
• Correct inaccurate information in your account
• Request deletion of your account, your surveys, or your response data
• Object to data processing in certain cases
• Request a copy of your data (data portability)
• Withdraw consent where processing is based on consent

If you answered a survey and want your response accessed, corrected, or deleted, the fastest route is the creator who ran the survey (the company whose website or product you answered it on), since they control that data. You can also contact us directly and we will assist: contact@mapster.io

If you are not satisfied with how we handle a privacy request, you can complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz) or, if you are in the EU or UK, to your local data protection authority.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Updates will be posted here, with the "Last updated" date revised.

We encourage you to review this policy periodically. Changes are effective upon posting.