Privacy policy
This policy explains how we handle artwork, purchases, correspondence and usage measurement, and what changes when you allow optional analytics.
Last updated: September 23, 2026
Who is responsible
Boetz Digital operates Cartivale and is responsible for processing your personal data as controller. The linked business information provides its address and registration details. Contact [email protected] with questions or data-subject requests. No Data Protection Officer has been appointed; this is a customer and data-subject contact, not a DPO address.
Artwork and service information
To show and export a map, the service processes the selected area, style, artwork settings, text, markers and routes you provide. Export and purchase records can contain the artwork specification, location, language, file references and timestamps. Search and request logging can record search terms and service activity. Hosting systems may also process network and technical logs.
Purchases and Stripe
Stripe-hosted Checkout collects payment information. Cartivale stores purchase and payment identifiers, package and price details, payment/refund state, customer email and tax country or amounts supplied by Stripe. Stripe handles full payment-card details; Cartivale does not receive or store full card numbers. Stripe responses can include billing contact and payment-method details. Our purchase records retain the payment references, customer email, tax country and amounts described here, rather than the full billing address. Before paid Checkout we record your express digital-supply consent and withdrawal acknowledgement, the server timestamp, language and applicable policy versions. We do not add an IP address or browser fingerprint to that consent record.
Browser storage
A language cookie, privacy preference and browser-tab checkout draft support site use. Limited first-party measurement uses a random browser-tab session that expires after 30 minutes of inactivity. Before analytics consent, we do not create a persistent cross-visit analytics identity. Optional analytics storage and Google Analytics are enabled only after your choice. The Cookie policy lists the storage and lifetimes.
Purposes and legal bases
Artwork generation, order handling and transaction emails are necessary to provide the requested service and perform the purchase contract. Accounting and consumer-law obligations require relevant transaction, consent and request records. Security, abuse prevention and error diagnosis support our legitimate interest in a reliable service, subject to balancing your rights. Digital-supply consent records a consumer-law choice; it is not consent to marketing. We do not use purchase email addresses for advertising. We use limited first-party measurement to understand use of the service, identify problems and maintain reliable product information, relying on our legitimate interest in operating and improving Cartivale. This uses a short-lived browser-tab session rather than a persistent visitor identity before optional analytics consent. You can object to this processing by contacting our privacy email address. Optional persistent analytics and Google Analytics remain subject to your consent.
Service providers and international transfers
Hetzner hosts the Cartivale web/application server in Germany. The PostgreSQL/PostGIS database and current private customer export files are stored on that server. Hostinger provides email hosting and SMTP delivery for purchase confirmations, withdrawal acknowledgements, refund confirmations and support/privacy correspondence. Stripe processes payments under its applicable service and privacy arrangements. Cloudflare processes web traffic for security and content delivery where enabled. Turnstile checks withdrawal submissions and free-export generation requests to limit automated abuse; you can also submit a withdrawal by email. R2/CDN can deliver public Cartivale-owned artwork where configured; private customer exports stay in the protected download system. Google Analytics processes optional usage measurements only after analytics consent where configured. Service providers may process data outside the European Economic Area. Where GDPR transfer restrictions apply, we use the safeguards provided under the applicable service agreements, including adequacy mechanisms or standard contractual safeguards where applicable. The linked provider privacy information explains their processing and transfer arrangements. Contact [email protected] for information about the safeguards applying to your data and how to obtain a copy.
Your choices and rights
Where applicable, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent where processing relies on it. Some records may need to be retained by law. Email [email protected] to exercise your rights. You may also complain to the Dutch Autoriteit Persoonsgegevens or another competent data-protection authority.
Keep private details out of artwork
Only enter information you are entitled to use. Text, routes and locations can reveal personal information and can appear in exported artwork. Keep purchase links private: anyone with the valid link may be able to access the purchase files during the access period.
Retention and download access
Paid download access lasts 30 days from confirmed payment. Access expiry is not deletion: scheduled housekeeping normally removes paid generated exports and purchase-related map configurations after that recovery period. Free export files expire 24 hours after successful generation and are removed during scheduled housekeeping. Keep your downloaded files locally. Active support, refund, dispute, security or legal matters may temporarily require relevant data to remain. These holds do not extend download access automatically. Backup copies are not necessarily destroyed at the same moment.
Purchase records and minimization
Necessary transaction/accounting and related payment/consent evidence is normally retained for 7 years where required, subject to applicable longer legal obligations. This does not mean retaining complete artwork or all personal information for that period. Once recovery and outstanding matters no longer need it, our housekeeping removes the purchase email address and creative/recovery details while preserving the minimum accounting and legal evidence. Remaining payment references can still link to provider records; we do not describe the whole retained purchase as anonymous. Abandoned unpaid purchases are normally removed after 30 days, except unresolved payment or investigation matters.
Messages, withdrawal requests and logs
When the purchase reference and email supplied through the online withdrawal form match a purchase, we store your name, purchase reference, email, statement and its version, language, receipt time and review status, and send an acknowledgement. If they do not match, we do not store the submitted withdrawal details or send an acknowledgement. The public response is the same in both cases and does not reveal purchase status. Withdrawal statements sent directly by email remain available for manual handling. We do not collect an IP address or fingerprint for the shared submission rate limit. Support/privacy and withdrawal correspondence is normally retained for 2 years after closure, unless a legal, accounting or active dispute need justifies longer retention. Ordinary application/server logs normally have a 30-day period, extended only when needed for an active investigation or legal obligation. Mailbox, server-log and backup retention is managed operationally alongside application cleanup.
Limited first-party usage measurement
We record known page types, navigation and product actions, active engagement, language, referral domain and bounded campaign labels, and device/browser/crawler categories. Country is recorded only if trusted infrastructure supplies it; otherwise it is unknown. Analytics does not receive your name, email, map text, raw search query, form message, purchase access link or Turnstile token. We do not retain IP addresses or raw user agents in this analytics store and do not create device fingerprints. Confirmed payment, refund, generation and delivery events come from our backend; they are separate from browser intent.
Optional analytics and retention
Limited first-party measurement links payment, refund and paid-file generation events to the short-lived session and page codes present at checkout, including when optional analytics is not accepted. Free generation and downloads use the current session and page codes. Linking a persistent visitor code requires analytics consent. Checkout context is kept separately for up to 90 days. A refund uses the original checkout country and session, not a new visit. Allowing analytics creates a random first-party visitor code for up to 180 days and enables Google Analytics where configured. Raw first-party events are retained for up to 90 days, subject to scheduled cleanup. We do not retrospectively attach earlier pre-consent events to your new visitor code. Change or withdraw analytics through Privacy preferences in the footer or editor. Withdrawal stops future optional collection and removes optional browser identifiers; it does not automatically erase previously retained events. GPC or Do Not Track signals keep optional analytics off. Contact [email protected] for privacy requests.