Privacy. Kept small.

OnMap is operated by TRY2APP LTD (company no. 16526433), Suite 9335, 5 Brayford Square, London E1 0SG, United Kingdom.

We decide how the information described here is used (we are its "controller"). Questions or requests: hello@onmap.me.

• Your account: your email address, when you signed up and last signed in, and your sign-in sessions (stored only as a secure hash).
• Your business facts: what you enter for your page, such as the business name, handle, trade, city and service areas or address, hours, phone number, services, answers, logo, photos and custom domain. Most of this is public on your page by design, so do not add anything you want to keep private.
• Payments: Stripe takes your card. From Stripe we keep only the card brand, last 4 digits and expiry, your plan and subscription status, and your invoices (amount, date, number and links to Stripe's copy). We never see or store your full card number or security code.
• Emails: a log of the emails we send you (type, subject, time and whether it was delivered).
• Messages: if you write to us by email or through our contact form, your name, email address and message.
• Sign-in security: when a sign-in code is requested, we keep the requesting IP address with the code for up to 24 hours to stop abuse (for IPv6, only the network part).

When people open an OnMap page, we count visits and where they came from (an AI assistant such as ChatGPT, a search engine, social media, a direct visit or another site, read from the referring page and the link's source tag), and taps on the Call, Text and Directions buttons. We also log visits from AI and search crawlers, such as GPTBot or Googlebot, by the name their software sends.

We do not store visitors' raw IP addresses. To count each visit only once, we keep a one-way hash of the IP address made with a secret key, used only for short windows (30 minutes for a visit, 60 seconds for a tap) and deleted within a day.

We set no cookies for visitors, build no profiles and do not follow anyone across sites. We also measure page views with Cloudflare Web Analytics, which uses no cookies and does not identify visitors. Business owners see totals only, never who visited. On OnMap.me's own pages we count the same things for ourselves, plus the visitor's country (and US state) and whether it was a phone or a computer. No IP address is stored: a visit is recognized for one day by a scrambled code that cannot be turned back into an address.

Business pages have a short form to ask the business for a time or a quote. If you send one, we collect what you type: your name, your phone number, what you need and, if you add it, when. An AI assistant can fill in the form for you. We then note that an assistant sent it.

The request goes to that business and is kept for that business: it appears in the owner's dashboard and we email it to the owner. We use it for nothing else. Sending one needs no account and sets no cookie.

To stop spam we keep a one-way hash of your IP address with the request, never the address itself, and the business can mark a request as spam. That blocks later requests to that business from the same phone number and network.

We keep requests for 12 months, then delete them. They are also deleted when the business deletes its account. To have yours removed sooner, write to hello@onmap.me.

The business decides whether and how to answer. It is responsible for its replies and for how it uses your details. A request is not a booking until the business confirms it.

The example pages show fictional businesses. What you type in the form there is not stored or sent.

• to run your page and account and to sign you in (to provide the service you signed up for)
• to bill you and keep billing records (contract and legal duty)
• to send the emails listed below, and to answer your messages
• to show you how your page is doing
• to keep OnMap secure and stop abuse and fraud (our legitimate interest)

We do not sell personal information, use it for advertising, or share it with data brokers.

We use Anthropic's Claude AI to run the sign-up chat (it reads what you type there to set up your page) and to write the text of your page and guides from your business facts. Please don't type anything in the chat that you don't want on your page.

These companies process data for us, only to provide their service to us:

• Cloudflare: hosting, database, file storage for logos and photos, sending email, custom domains, security and Cloudflare Web Analytics (page views, counted without cookies).
• Stripe: payments, subscriptions, invoices and the billing portal.
• OpenStreetMap (Nominatim): only if you tap Use my location in the sign-up chat. Your position is sent once to turn it into a city and street address, and we do not store it.
• Anthropic: the Claude AI behind the sign-up chat and the writing of pages and guides. It receives what you type in the chat and your business facts, and does not use them to train its models.
• Google Workspace: our support mailbox.

We share personal information with no one else, except when the law requires it, or as part of a sale or merger of our business, which we would tell you about first.

• Account and page data: while you have an account. If your plan ends, we keep it so you can come back, until you delete your account.
• Deleting your account (Settings, Delete account) removes your page, guides, photos, metrics, email log and account at once. Copies in our hosting provider's backups expire within 30 days.
• Unfinished signups (the first payment never made) are deleted after 48 hours.
• Visitor metrics: raw events for 90 days, then only daily totals. They are deleted with the account.
• Sign-in codes and their IP address: 24 hours. Sessions: 30 days, or until you sign out.
• Email log: 180 days.
• Requests sent from business pages: 12 months.
• Invoices and payment records are kept in Stripe for as long as tax and accounting law requires, also after you delete your account.

We use only essential cookies, and only when you sign in: one keeps you signed in, and one small flag (no personal data) tells our site to show Dashboard instead of Sign in.

No advertising or tracking cookies. We measure page views with Cloudflare Web Analytics, which uses no cookies and does not identify visitors. Visitors to business pages get no cookies at all.

While you fill in a form, such as your signup, the app keeps your unfinished answers in your browser's session storage, which is cleared when you close the tab.

• sign-in codes
• a welcome email when your page goes live
• guide reminders before a guide goes out
• an email when someone sends a request from your page
• a weekly summary of how your page did
• a monthly AI visibility report (Pro)

Sign-in codes and the welcome email are part of the service. You can turn off reminders, request emails, the weekly summary and the monthly report in Settings, or with the unsubscribe link in each email. We send no marketing emails.

Wherever you live, you can ask us for a copy of your data, to correct it (most of it you can edit yourself in your dashboard), to delete it, or to stop or limit a use of it. Write to hello@onmap.me from your sign-in email. We reply within 30 days.

If you are in the UK or the EU, you can also complain to a data protection authority. In the UK that is the Information Commissioner's Office.

We honor these rights for California residents under the California Consumer Privacy Act, as amended by the CPRA.

What we collected in the last 12 months: identifiers (email address, IP address for sign-in security, and the name and phone number in a request sent from a business page), commercial information (plan, invoices, card brand and last 4 digits), internet activity (visit and tap counts on business pages, referral source, sign-in activity) and business information you enter. It comes from you, from your use of OnMap and from Stripe, and is used for the purposes above. We disclose it only to the service providers listed above, for those purposes.

No selling or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months.

Your rights: to know what we collect and get a copy, to delete it, to correct it, and to limit the use of sensitive personal information. The only sensitive information we handle is your sign-in (your email with a one-time code), and we use it only to sign you in.

How to ask: email hello@onmap.me with "California privacy request" in the subject, from your sign-in email. We check it is you by matching that address. An authorized agent can ask for you with your signed permission. We reply within 45 days.

No discrimination. We will not charge you more, give you a worse service or refuse you service because you used these rights.

OnMap is a service for businesses and is not meant for anyone under 18. We do not knowingly collect information from children. If you think a child gave us information, write to us and we will delete it.

We are a UK company, and our providers run servers in the United States, the European Union and other countries, so your information may be processed in those places. Our providers handle it under their data protection terms, which include the safeguards UK and EU law require for these transfers.

Sign-in codes expire after 10 minutes and are stored only as hashes. Sessions are stored as hashes too. Every page is served over HTTPS. Card details never touch our servers. Visitor IP addresses are hashed, not stored. Location and camera data is removed from photos when they are uploaded.

No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

When we update this policy we change the date at the top. If a change is material, we email the address on your account before it applies.

Questions or requests about your data: hello@onmap.me.

OnMap is operated by TRY2APP LTD (company no. 16526433), Suite 9335, 5 Brayford Square, London E1 0SG, United Kingdom.