Privacy policy

Data controller and contact

Rujie Huangm, trading as The Real World Map, is the controller of the personal data described here. Address: Calle de Olot 35, 08227 Terrassa, Barcelona, Spain. Tax identification: X8701088G. For privacy requests, contact info@therealworldmap.com. This policy applies to the website and its account, purchase and advertising features.

What we collect and why

We collect only the data needed for the features you use. We do not sell personal data or use this site to build advertising profiles across other websites.

• Accounts: email address, authentication identifiers, optional display name and avatar. Google sign-in also supplies the profile information you choose to share. We use these to create and secure your account and manage your spaces, on the basis of our contract and legitimate interests in preventing misuse.
• Purchases and resales: purchase email, selected space, amount, discount, currency, order and payment/promotion references, ownership history, seller eligibility and payout status, and the version and time of your checkout acceptance. These support our contract, fraud prevention and applicable accounting or legal obligations. Stripe collects payment, identity and bank details directly; we do not store full card numbers or security codes.
• Private offers: the territory, amount, optional message, participant account identifiers, status changes and read receipts. Your display name, offer and message are shared with the other participant; email addresses are not shared. We use these records to provide the requested negotiation and purchase features, prevent misuse and send transactional email notices. An accepted price is only available to its designated buyer.
• Content: images, titles, descriptions and links you submit. Published advertising content and region price/transaction history are public. Original uploads and account profiles are not intentionally published as a public directory. Do not upload personal information you do not have the right to publish.
• Support and safety: messages you send, records needed to investigate reports, and technical access/error information handled by our providers. We use these to answer you, protect the service and establish or defend legal claims.
• Audience statistics: page loads, approximate active browsers, country of connection estimated from the IP address, and advertisement opens/clicks. Public activity shows the countries of up to three recent active browsers, without browser identifiers or exact arrival times. Historical country aggregates are kept internally. VPNs and proxies can affect country accuracy. We do not store the raw IP address or precise location in country analytics. We use our own limited analytics for legitimate interests in understanding service usage and reporting advertisement performance. We do not use analytics cookies or persistent analytics identifiers. Public counters and advertiser statistics are aggregated.

Cookies and browser storage

Sign-in uses Supabase session storage in your browser so you can remain signed in. A guest checkout cookie is HttpOnly, Secure over HTTPS, restricted to this site and lasts up to seven days. Short-lived session data helps return you to the selected space and recover a checkout. Map appearance preferences may be kept locally until you clear them.

Stripe may use necessary payment and fraud-prevention cookies or similar storage when you open checkout or seller onboarding. Google sign-in is optional and is governed by Google’s own notices. We do not load marketing analytics or advertising-tracking cookies. If we introduce optional tracking in future, we will provide the required notice and choices first.

You can clear browser storage or sign out, but doing so may interrupt an unfinished guest checkout or require you to sign in again. Analytics browser identifiers are ephemeral; server-side rate limiting uses a daily changing keyed hash of the network address rather than storing the raw address in our analytics tables. Infrastructure providers may separately process IP addresses in security/access logs.

Who receives data and where

We use Supabase for our database, authentication and file storage (the project’s database region is Paris), Vercel for hosting and request delivery, Hostinger for transactional/support email, and Stripe for payments and seller onboarding. Google receives information when you choose Google sign-in. Encrypted recovery backups are held in our private GitHub repository’s Actions artifacts; the decryption key is kept separately.

Some providers process information outside the EEA, including in the United States. Where required, transfers rely on applicable adequacy decisions or contractual safeguards such as the European Commission’s Standard Contractual Clauses. You can request information about relevant safeguards at our privacy email. Stripe and Google may also act as independent controllers for their own services.

We may disclose information when legally required, to resolve payment disputes or to protect rights against fraud or abuse. We do not make your purchase email, banking details or private profile public. If you follow an advertiser’s link, the destination’s privacy policy applies.

Retention

Account and active ownership records are kept while needed to provide the service. If you request account closure, we delete or anonymise information that is no longer needed and restrict records we must retain for active ownership, accounting, disputes or legal obligations. Transaction and acceptance records may need to be retained for the applicable legal period, generally up to six years in Spain, or longer for an unresolved legal claim.

Individual analytics events are removed after 30 days, stale presence after 24 hours, and rate-limit buckets after one hour. Aggregated statistics can be kept without identifying individual visitors. Recovery artifacts expire after seven days; deleting live data therefore does not immediately remove it from an existing encrypted backup. Restores must reapply recorded deletion requests.

For support, unsuccessful purchase attempts and security records, we keep information only as long as needed for the request, fraud prevention or applicable claims. Ask us for the applicable retention period for a particular record. Provider-managed logs follow their own service retention settings.

Your rights

You can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests, by emailing info@therealworldmap.com. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We may need proportionate information to verify a request; do not send passwords, full card details or identity documents unsolicited.

We normally respond within one month, subject to lawful extensions explained to you. You may complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or your competent local supervisory authority. We do not use solely automated decisions to make legal or similarly significant decisions about you; payment providers may apply their own fraud checks.

Accounts and purchases are intended for adults aged 18 or over. If you believe a child has provided personal information, contact us so we can assess and address it. We update this notice when our processing changes and provide additional notice when required.