Privacy Policy
Last updated: June 14, 2026
This Privacy Policy explains how Sjödin Media ("DDD Maps", "we", "us", or "our") collects, uses, stores, shares and protects personal data when you use the website dddmaps.com and the DDD Maps service (the "Service").
We are the data controller responsible for the personal data described in this Privacy Policy. If you have any questions about this policy or your personal data, contact us at contact@dddmaps.com.
1. Who we are
Data controller: Sjödin Media (enkeltpersonforetak)
Organisation number: 937 813 686
Address: Dronningens gate 12A, 8514 Narvik, Norway
Email: contact@dddmaps.com
We are established in Norway and process personal data in accordance with the EU General Data Protection Regulation (GDPR), as incorporated into Norwegian law through the Personal Data Act (personopplysningsloven), and other applicable Norwegian and EEA data protection rules.
2. What personal data we collect
We collect and process the following categories of personal data, depending on how you use the Service:
Account and identity data
When you create an account or subscribe to a paid plan, we process information such as your name, email address, account identifier, subscription plan and account status. Account creation, authentication and account management are handled through our provider Outseta.
Billing and subscription data
If you subscribe to a paid plan, billing and subscription data is processed through Outseta and Stripe. This may include your name, email address, billing address, subscription plan, tax information, payment status, renewal status and transaction history.
We do not store your full payment card number on our own systems. Card data and payment processing are handled by Stripe.
Session data
When you use PRO features, we may use a signed session cookie called dddmaps_pro_session. This cookie may contain or be associated with account/session information such as your user ID, email address, name, account ID, plan ID, issue time and expiry time. The cookie is used to verify your access to paid features.
GPX, route and location data
When you use the Service, you may upload GPX files or provide route, map, search, waypoint, camera or location data. GPX files and route data may contain precise location information, timestamps, elevation data, activity data, route names, waypoint coordinates or other information included in the file.
GPX files are primarily processed locally in your browser. When you request a server-rendered export, route data, coordinates, rendering settings and related metadata are temporarily sent to our server to generate the requested video.
Search and map data
When you search for places, trails or routes, or use map-related features, we may process search terms, place names, coordinates, zoom targets, camera views and related map interaction data.
Rendering and export data
When you generate an animation or MP4 export, we may temporarily process render settings, route geometry, GeoJSON, filenames, route or peak names, export identifiers, access tokens, timestamps, render status and temporary video files.
Technical and usage data
We automatically process technical data necessary to operate, secure and improve the Service. This may include IP address, browser type, device information, operating system, user agent, pages visited, request URLs, timestamps, errors, rate-limit events, render queue status and interactions with the Service.
Communications
If you contact us by email or through the contact form, we process your name, email address, message content and any other information you choose to include.
Cookies and similar technologies
We use cookies and localStorage to operate the Service, keep you signed in, remember your cookie preferences and, where you consent, measure usage. See Section 8 below.
3. How and why we use your personal data
We process your personal data for the following purposes and legal bases under GDPR Article 6:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of a contract, Article 6(1)(b) |
| Providing the Service and generating animations | Performance of a contract, Article 6(1)(b) |
| Processing GPX, route, location, render and export data | Performance of a contract, Article 6(1)(b) |
| Processing payments and managing subscriptions | Performance of a contract, Article 6(1)(b), and legal obligations where accounting or tax rules apply, Article 6(1)(c) |
| Keeping you signed in and verifying PRO access | Performance of a contract, Article 6(1)(b) |
| Securing the Service, preventing abuse, rate limiting, troubleshooting and debugging | Legitimate interests, Article 6(1)(f). Our legitimate interest is to keep the Service secure, reliable and protected against misuse. |
| Improving and developing the Service | Legitimate interests, Article 6(1)(f), where the processing is not based on consent. |
| Responding to support, bug reports, feedback or other messages | Legitimate interests, Article 6(1)(f), and performance of a contract where the request relates to your account or subscription. |
| Sending service-related communications, including billing notices, account messages and subscription updates | Performance of a contract, Article 6(1)(b), legal obligations where applicable, Article 6(1)(c), and legitimate interests, Article 6(1)(f) |
| Sending marketing emails, where applicable | Consent, Article 6(1)(a), unless applicable law permits us to contact existing customers about similar DDD Maps products or services based on legitimate interests or a soft opt-in rule. You can unsubscribe from marketing emails at any time. |
| Using non-essential cookies and analytics | Consent, Article 6(1)(a) |
| Complying with legal obligations, including accounting, tax, consumer law and legal claims | Legal obligation, Article 6(1)(c), and legitimate interests, Article 6(1)(f) where necessary to establish, exercise or defend legal claims. |
You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
We do not send marketing emails unless permitted by applicable law. Service-related emails, such as account, billing, security and subscription messages, are not marketing emails.
4. GPX, route and location data
We treat GPX, route and location data with particular care because it can reveal sensitive details such as where you live, train, travel or spend time.
- We use GPX and route data only to provide the Service to you, including generating the animations and exports you request.
- We do not sell your location data.
- We do not use GPX or route data for advertising.
- We do not use GPX or route data to profile you or make automated decisions about you.
- We do not store your original GPX files permanently as files on our own servers.
GPX files are primarily processed in your browser. When you request a server-rendered export, route data, coordinates, rendering settings and related metadata are temporarily sent to our server to generate the requested video.
Server-rendered MP4 exports, preview links, download links, temporary render data and access tokens are retained only for a short period, normally up to approximately 12 hours, and are then automatically deleted.
DDD Maps is not intended as a permanent storage, backup or hosting service for GPX files, route data or generated videos.
5. Who we share personal data with
We share personal data only where necessary to operate, provide, secure, improve or bill for the Service, or where required by law.
Depending on the service and applicable terms, third-party providers may act as our processors, independent controllers or separate service providers. We only share data that is necessary for the relevant purpose.
We use the following providers and recipients:
Outseta
Purpose: Account management, authentication, CRM, subscription management, support, account emails and transactional emails.
Data involved: Name, email address, account data, subscription data, support/CRM data and related account information.
Stripe
Purpose: Payment processing, checkout, fraud prevention and subscription billing through Outseta.
Data involved: Billing details, payment status, transaction data and payment-related identifiers. We do not store full card numbers on our own systems.
Mapbox
Purpose: Map display, terrain, tiles, geocoding, map rendering and related mapping services.
Data involved: IP address, device/browser information, map interaction data, coordinates, search or location data where needed to provide map functionality.
OpenRouteService
Purpose: Route calculations, nearest-point calculations and routing functionality.
Data involved: Coordinates, route data, search or location data and technical request information.
Nominatim/OpenStreetMap and Overpass API
Purpose: Place, trail, route and map-data lookup.
Data involved: Search terms, location names, coordinates, map queries and technical request information.
Google Analytics / Google Tag Manager
Purpose: Usage analytics, only after you give consent.
Data involved: Pseudonymous usage data, device/browser data, page interactions and analytics identifiers. IP anonymisation is enabled where supported.
Google Fonts
Purpose: Displaying website fonts, unless fonts are served locally.
Data involved: IP address, browser information and technical request information when fonts are loaded from Google servers.
Web3Forms
Purpose: Contact form submission and message delivery.
Data involved: Name, email address, message content and technical form-submission data.
Hetzner Online GmbH
Purpose: Hosting and infrastructure for the Service.
Data involved: Data processed by the Service, including server logs, temporary render data and technical data. Servers are located in the EU/EEA where applicable.
We may also disclose data where required by law, to enforce our Terms, to protect our rights, users or the public, or in connection with legal claims.
We do not sell personal data to third parties.
6. International transfers
Some of our providers, including Outseta, Stripe, Mapbox, Google and Web3Forms, may be based in or transfer personal data to countries outside Norway, the EU or the EEA, including the United States.
Where this happens, we rely on appropriate safeguards where required by applicable data protection law. These may include adequacy decisions, the EU-US Data Privacy Framework, Standard Contractual Clauses, UK or Norwegian transfer mechanisms where applicable, or other legally recognised safeguards.
You can request more information about relevant safeguards by contacting us at contact@dddmaps.com.
7. How long we keep personal data
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
Account data
Retained while your account is active and for up to 24 months after account closure, unless a longer period is required for legal, accounting, tax, fraud-prevention, dispute-resolution or security purposes.
Billing and accounting records
Retained as required by applicable accounting and tax law. In Norway this is typically up to 5 years.
GPX files and route data
Original GPX files are primarily processed locally in your browser and are not permanently stored as files on our own servers.
When you request a server-rendered export, route data, coordinates, rendering settings and related metadata are processed temporarily for the export and deleted when no longer needed for that purpose.
Server-rendered MP4 exports
MP4 exports, preview files and download files are normally deleted automatically within approximately 12 hours.
Temporary render data and access tokens
Temporary render data, export identifiers and access tokens are retained only for the time needed to complete, preview and download the export, normally no longer than approximately 12 hours.
Server and security logs
Technical logs are normally retained for up to 90 days for security, abuse prevention, troubleshooting and service operation. Logs may be retained longer where necessary to investigate abuse, resolve technical incidents, comply with legal obligations or establish, exercise or defend legal claims.
Contact and support messages
Support and contact messages are normally retained for up to 24 months after the last interaction, unless a longer period is necessary to resolve a support issue, dispute, security incident or legal matter.
Cookie consent records
Your cookie consent choice is stored in localStorage for up to 183 days unless you update your preferences or clear your browser data.
When data is no longer needed, we delete or anonymise it.
8. Cookies and localStorage
We use cookies, localStorage and similar technologies to operate the Service, keep you signed in, remember your preferences and, where you consent, measure usage.
Strictly necessary cookies and storage are required for the Service to function and do not require consent where they are necessary to provide a service you requested.
Analytics cookies and analytics storage are non-essential and are used only after you give consent through our cookie banner.
You can give, refuse or withdraw consent for non-essential cookies at any time through the cookie settings link on the website footer or through your browser settings.
Cookie and localStorage overview
| Name | Provider | Type | Purpose | Duration | Consent required |
|---|---|---|---|---|---|
| dddmaps_pro_session | DDD Maps | Strictly necessary cookie | Keeps your PRO/account session active and verifies access to paid features. | Up to 24 hours or until session expiry/logout. | No. |
| dddmaps_cookie_consent_v1 | DDD Maps | localStorage preference | Stores your cookie consent choice. | Up to 183 days. | No, used to remember your consent preference. |
| _ga / _ga_* | Google Analytics | Analytics cookie | Measures usage and helps us understand how the Service is used. | Up to 2 years, unless configured for a shorter period in Google Analytics. | Yes. |
| _gid | Google Analytics | Analytics cookie | Distinguishes users for analytics purposes. | Usually up to 24 hours. | Yes. |
| _gat / related Google Analytics rate-limiting cookies | Google Analytics | Analytics/performance cookie | Used to throttle analytics request rate. | Usually up to 1 minute. | Yes. |
| Outseta cookies or storage | Outseta | Account/authentication/subscription support | Account login, profile, subscription and checkout-related functionality. | Session-based or as determined by Outseta for authentication and account functionality. | Usually no where strictly necessary for account or checkout functionality; otherwise yes where required by law. |
| Stripe cookies or storage | Stripe | Payment/security | Secure payment processing, fraud prevention and checkout functionality. | Session-based or as determined by Stripe for payment security and fraud prevention. | Usually no where strictly necessary for payment or fraud-prevention functionality; otherwise yes where required by law. |
Third-party services may update the cookies or storage they use. We aim to keep this overview accurate and may update it from time to time.
9. Your GDPR rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete personal data;
- erase your personal data where the legal requirements are met;
- restrict processing of your personal data;
- object to processing based on our legitimate interests;
- object to direct marketing at any time;
- receive your personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with a supervisory authority.
Where we process your personal data based on legitimate interests, you have the right to object to that processing at any time based on your particular situation. If we process your data for direct marketing, you may object at any time and we will stop using your data for that purpose.
To exercise your rights, contact us at contact@dddmaps.com. We will respond within the time limits required by law, generally within one month.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.
10. Account deletion and data export
You may request deletion of your account data or a copy of your personal data by contacting us at contact@dddmaps.com.
Account-related data is handled through Outseta. We may process account deletion, export or correction requests through Outseta and any other relevant providers.
Some data may need to be retained where required by law, such as billing records, accounting records, fraud-prevention records, security logs or information needed to establish, exercise or defend legal claims.
11. Automated decision-making and profiling
We do not use your personal data for automated decision-making or profiling within the meaning of GDPR Article 22.
12. Security
We take reasonable technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure.
These measures include using HTTPS, signed session cookies, access controls, temporary export links, automatic deletion of temporary exports, rate limiting and security logging.
No method of transmission or storage is completely secure, but we work to protect your data and to keep our providers held to appropriate standards.
13. Children
The Service is not directed at children under 16 and we do not knowingly collect personal data from children under 16.
If you believe that a child has provided us with personal data, please contact us at contact@dddmaps.com and we will take appropriate steps to delete it.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
When we make material changes, we will update the "Last updated" date above and, where required, notify you or request your consent before the changes apply.
15. Contact
Questions or requests regarding this Privacy Policy or your personal data can be sent to:
Sjödin Media
contact@dddmaps.com
Dronningens gate 12A
8514 Narvik
Norway
Organisation number: 937 813 686