MapsGPT

GDPR overview

There is no mention of the GDPR anywhere. Searching the eleven archived pages, in text and in raw HTML, returns not a single occurrence of "GDPR" or "General Data Protection". No Article 27 representative, no data protection officer, no data processing agreement and no subprocessor list are published. The only regulatory framework the privacy policy addresses is the Californian CCPA, granting access, deletion and non-discrimination rights, exercised by writing to contact@proxi.co, with a 45-day response window extendable by a further 90 days. International visitors are simply warned that their data travels to the United States, where the servers are located, and that those countries may not offer equivalent protection. The policy itself is dated 6 December 2021, more than a year before the MapsGPT domain existed.

Who owns the data?

Under the Terms of Use, Map Your Idea, Inc. claims no ownership over the content you submit. You keep it, but you grant the publisher a worldwide, royalty-free licence to use, modify, publicly display, reproduce and distribute it through the Services, including making it available to other users. A second clause in the same document describes that licence as non-transferable and non-sublicensable, contradicting the first. Proxi keeps ownership of the unique map link itself. You alone remain liable for the legality of what you upload, and in the event of a merger, an acquisition or bankruptcy your stored data is treated as a transferable asset.

Reuse rights

You may reuse the map you generate without asking anything further: the Terms explicitly allow you to embed the unique map link for personal, professional, marketing and promotional purposes, and the map can be passed on by link, embed code or QR code. What is off limits is the publisher's own material — transferring, sublicensing, selling, renting, reverse-engineering or reproducing Proxi's layouts, themes and screen arrangements is forbidden. In the other direction, the publisher collects your name, your email address, your map parameters, browsing statistics and IP addresses. It states that it does not collect location data through the Services, that it does not sell personal information, and that Stripe handles payments. A broad aggregation clause lets it extract and exploit non-identifiable aggregated data commercially, and your email address and account name are passed on to map creators. The homepage adds its own caveat: the places shown are drawn from aggregated sources and are not guaranteed to be accurate or current.

Data retention & training

Hosting summary

The privacy policy states plainly that the servers are located in the United States and that visitors from elsewhere are sending their data there. No region can be chosen and no European hosting option exists. The publisher acknowledges that data may be transferred within or outside the United States depending on its type, and that the receiving countries may not have data protection laws as comprehensive as those where the user lives. Some employees and contractors may sit outside the user's home country, and using the service counts as consent to that transfer. On the security side, the publisher describes physical, technical and administrative safeguards but claims no certification at all — neither SOC 2 nor ISO 27001 is mentioned anywhere. No subprocessor list is published; Stripe is the only third party named, as the payment processor. The domain itself resolves to a Cloudflare anycast address, which says nothing about where the data is actually stored.