Privacy policy

Mantle Place LLC is the data controller for personal data processed through mantle.place. For privacy questions, data-subject requests, or to contact the controller, email contact@mantle.place. Mantle Place LLC does not currently have an appointed EU representative under GDPR Art. 27; if EU traffic exceeds the Art. 27 threshold (regular processing of EU resident data at scale) we will appoint one and update this section.

• Email address: required to deliver bundles and re-access links. Provided by you at checkout or through Supabase Auth.
• Order details: your AOI bbox, codename, the canonical provider IDs used to fulfill the order (Protomaps, NAIP or Sentinel-2, USGS 3DEP in the continental US or Mapterhorn elsewhere, Overture Maps), and the computed price.
• Payment metadata: Stripe handles card details directly; we store only the resulting PaymentIntent / Customer / Charge IDs and the dispute / refund status returned by Stripe webhooks.
• Technical signals: IP address (for rate limiting), browser user-agent, request paths, and standard server logs.

• Stripe: payment processing and refunds.
• Cloudflare: Workers runtime, KV (rate limit + tile vintage), R2 (bundle storage), CDN.
• Supabase: Postgres database (orders, users, etl_jobs) and Auth.
• Google Cloud Platform: Pub/Sub queue and Cloud Batch workers that produce your bundles.
• Resend: transactional email (bundle-ready, refund, dispute notifications).
• PostHog: pseudonymous product analytics. Data hosted in the US region; transfers from the EU rely on PostHog Inc.’s EU-US Data Privacy Framework certification.

Esri, only if you use the Satellite view. The curator globe’s optional Satellite view loads imagery straight from Esri (ArcGIS Location Platform) in your browser. Esri then receives what any website you load from receives: your IP address, your browser’s user-agent, and which map tiles you view, which shows roughly where you are looking. We send Esri nothing about you or your account. The default Stylized view contacts no one but us. Esri handles those requests under its own privacy statement.

Komoot (Photon), only if you search for a place. We send the text you type, and nothing about you, to Photon to find it on the globe. The request goes from our servers, so komoot sees our server and the query text, not your IP address. A typed address can be personal data.

• Order fulfillment, vault re-access, refunds: Art. 6(1)(b) performance of a contract with you (or steps prior to entering one).
• Email + auth records: Art. 6(1)(b) (contract) and 6(1)(c) (legal obligation, e.g. tax-recordkeeping) where applicable.
• Product analytics (PostHog events) and cookie storage of preferences: Art. 6(1)(a) consent covers the full analytics, which recognize a returning browser; they start only when you click Accept on the consent bar. Decline, closing the bar, or no choice at all never turns them on. Without consent we only count visits in the anonymous, nothing-stored way §7 describes, on Art. 6(1)(f) legitimate interests in knowing whether the service is used and working.
• IP-based rate limiting, security logs, CSP violation reports, fraud prevention via Stripe: Art. 6(1)(f) legitimate interests in keeping the service available and protecting curators and Mantle Place from abuse.
• Personal email from the founder: The founder may occasionally email you personally about your account or to ask for your feedback. The basis is Art. 6(1)(f) legitimate interests in improving the service. Reply "stop" to any such email and it won’t happen again.
• Compliance with binding legal requests: Art. 6(1)(c).

• Order records (orders + etl_jobs rows): retained for the lifetime of your account so the vault stays permanent; the durable re-access promise depends on it. Deleted on account deletion or at your written request (after tax-recordkeeping obligations have lapsed).
• Payment metadata (Stripe PaymentIntent / Charge / Customer IDs, last-4): retained alongside the order record for chargeback and dispute defense, per Stripe’s and applicable financial regulations’ requirements (typically up to ~6 years for tax / chargeback windows).
• Billing address from Stripe Elements (for tax): captured at checkout, retained only as long as needed to satisfy tax-recordkeeping obligations.
• Email address + auth tokens: retained for the lifetime of your account; tokens rotate on each login.
• Server logs (Cloudflare Worker logs, including IP and user-agent): kept by Cloudflare for 7 days and copied to our PostHog Logs project, which expires them within ~30 days, unless an active investigation requires longer retention.
• Resend transactional email logs: retained per Resend’s standard retention policy (delivery + bounce metadata, typically ≤90 days).
• PostHog product analytics events: retained per PostHog Cloud’s standard retention policy for the US region (typically ≤12 months on free tier).

Email contact@mantle.place to exercise any of the rights below. We respond within 30 days; deletion of your account is destructive (it voids your vault), and we’ll confirm before acting.

If GDPR applies to you (you are in the EEA, UK, or Switzerland), you have the right to:

• Access: request a copy of your personal data (Art. 15).
• Rectification: correct inaccurate or incomplete data (Art. 16).
• Erasure: request deletion (Art. 17), subject to retention obligations in §4.
• Restriction: restrict processing in specific cases (Art. 18).
• Portability: receive your data in a machine-readable format and transmit it elsewhere (Art. 20).
• Objection: object to processing based on legitimate interests (Art. 21).
• Withdraw consent: for processing that relies on consent (analytics via the §7 control).
• Lodge a complaint with your local supervisory authority (Art. 77). We hope you’ll email us first so we can resolve it, but the right is yours either way.

If you are a California resident, the CCPA / CPRA grants you the right to know, delete, correct, and limit the use of sensitive personal information, plus the right to opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising. See §8 California Privacy Rights below for our specific disclosures and the opt-out mechanism.

A Site Brief is the free step in the curator, after you draw and before you order, that describes a rectangle of ground from open data. It has no page of its own: a link to a brief opens the curator on that rectangle, with its coordinates in the link.

• What a brief stores. One document of facts about the rectangle (elevation, slope, aspect, land cover, permanent water) and the versions of the open datasets they were computed from, kept so the next request for the same rectangle does not compute them again.
• Nothing about you. A brief records no account, no email, no IP address, no browser details and no map view. Two people who ask for the same rectangle get the same document.
• Links. The curator’s Share button copies a link that holds the rectangle’s coordinates and nothing else. There is no private brief and no public one; anyone who has the link opens the curator on that rectangle.
• Nothing to delete. Because a brief holds nothing personal, there is nothing about you in it to delete or to request.
• How one is made. Only by reaching the Brief step in the curator for a rectangle, or by opening a link someone shares. Asking for a rectangle that has been asked for before shows the stored document and does not say whether anyone did.
• Limits. To stop a flood of new briefs, the number a connection can make in an hour and in a day is counted under a keyed hash of its IP address that changes every day, never the address itself, and expires within two days. Asking for a brief that already exists is never counted.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the rights enumerated in §5 plus two additional opt-out rights:

• Right to Opt Out of Sale or Sharing. Mantle Place does not sell personal information for money. Mantle Place does not share personal information for cross-context behavioral advertising. Our PostHog analytics are first-party product analytics only and do not feed third-party advertising networks. Use the control in §7 above to decline analytics if you prefer, or let your browser send Global Privacy Control, which we honor; it’s the same opt-out surface for "sharing" under the CCPA definition.
• Right to Limit Use of Sensitive Personal Information. Mantle Place does not collect sensitive personal information as defined by CCPA §1798.140(ae) (precise geolocation, racial/ethnic origin, religion, union membership, mail/email contents, genetic data, biometrics, health, sex life). Your drawn AOI is geospatial but is not your geolocation. If we ever collect a category that meets the CCPA sensitive-PI definition, this section will be updated and a limit-use opt-out surfaced here.

We do not knowingly collect personal information from California residents under 16; if you believe we have, email contact@mantle.place and we will delete it. You may also authorize an agent to make a request on your behalf; we will verify their authority before responding.