Privacy policy
Last updated: 14 September 2026
Who looks after your information?
Mapia is operated by MAPIA STUDIO LIMITED, registered in England and Wales, company 17449745. Registered office: 1 Brendan Gardens, Darley Abbey, Derby, DE22 1BD, United Kingdom. Email support@mapia.studio. We aim to reply within one working day (Monday–Friday, excluding UK bank holidays).
We are responsible for personal information used to run Mapia. This notice covers our shop, artwork creator and customer support.
Your photograph and artwork
We use your uploaded photograph, chosen place and date, optional title and email to create three AI-assisted previews and your private gallery. If you order, we use your selected artwork and delivery details to print and deliver it. A private link gives access to your gallery: share it only with people you want to see it.
Our service is for adults, but photographs may include children. Uploaders must have appropriate rights and permission for the people pictured. We do not use customer photographs or artworks in our marketing without separate permission. We do not use them to build our own AI training dataset or to identify people through facial recognition.
We also receive billing and delivery contact details, payment status, support messages and technical information such as IP address, browser, device and service activity. These come from you, your device and the providers handling the relevant service. Without the necessary photo and order details, we cannot create or deliver your artwork.
Why we use it
We process your request and order to provide the service you ask for and perform our contract with you. For other people pictured, and for necessary security, fraud prevention and support, we rely on legitimate interests in providing a safe personalised-artwork service, balanced against their rights, particularly children's. We keep necessary financial records to meet legal obligations. Optional analytics and marketing rely on consent where required; refusing them does not prevent an order.
Services that help us
OpenAI processes image-generation inputs; Geoapify provides place search and map data; Supabase and Hostinger support storage and hosting; Cloudflare helps protect forms; Better Stack monitors service availability; Tailscale supports secure administrator access; Resend and Hostinger handle email; Gelato and its production and delivery partners receive the artwork and details needed to fulfil an order. Access is limited to what is needed for each service.
Cloudflare also processes security signals for its own bot-detection purposes, as described in its privacy policy. Availability monitoring does not receive your photograph or artwork.
Shopify hosts our shop and checkout and processes visit, order and payment information. We receive order and payment-status details, not your full card number. Shopify also uses information from interactions with our shop, other merchants and Shopify to provide enhanced services, including personalisation, analytics and relevant advertising. Shopify and other providers may process information outside the UK. Read Shopify's Consumer Privacy Policy for its processing and rights.
Providers may act as processors or, for some purposes, independently. International transfers are subject to applicable data-protection requirements, including adequacy decisions or appropriate contractual safeguards where required. Contact us for details of the safeguards relevant to your information.
How long we keep it
Our managed artwork storage normally removes abandoned uploads after 30 days of inactivity and unpaid galleries 30 days after they are ready. For paid orders, source and working files are normally removed 30 days after confirmed delivery; purchased final proofs and print files after 90 days. Open support cases can pause deletion. Backup copies expire separately and are protected from ordinary use.
Essential order, tax and accounting records are kept for six years from the end of the relevant company financial year, or longer where legally required. We normally retain routine support correspondence for 12 months after a case closes, and remove unnecessary photo attachments within 30 days of closure. Security, privacy-request and permission records have separate periods based on their purpose and any legal claim; unnecessary photos are not required as accounting records. Optional analytics and request-tracking records expire after 395 days. Provider copies can have different retention periods, so deletion from our artwork storage does not mean immediate deletion from every provider or backup. Contact us to request deletion or ask about a particular record.
Cookies and emails
Essential cookies keep the shop and forms working. Optional measurement helps us understand use of the service. Use Cookie preferences to change your choice. Service emails about your request or order are separate from optional marketing. You can withdraw marketing consent using the unsubscribe link or by contacting us.
Your rights
Depending on the circumstances, you can ask to access, correct, erase, restrict or transfer your information, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. These rights also apply to people pictured. Email support@mapia.studio; we normally respond within one month and may need proportionate identity checks. You can complain to the Information Commissioner's Office.