Privacy policy
Last updated: 27 October 2026 Download
This policy explains what personal data loveMap (lovemapart.app) processes, why, for how long, who receives it and how you can exercise your rights. It is also our data processing policy under Colombian Law 1581 of 2012 and Decree 1377 of 2013.
1. Who is responsible
The controller (responsable del tratamiento) of your personal data is:
- Email for privacy requests: hola@lovemapart.app
The same contact handles all questions, requests and complaints about your data (section 9).
Hotmart processes your payment. For the data you give in its checkout (card, document, address, phone), Hotmart acts under its own privacy policy, which you can read in the checkout.
2. What data we process
| Data | Where it comes from | What we use it for |
|---|---|---|
| Your design: place (label and coordinates), the names, the date and optional time, and the framing | You, in the studio, or your device’s location, if you tap “Use my current location” | To show the preview, sculpt your artwork and letter it |
| Place search text | You, in the search box | To find the place you are looking for |
| Email and name you type before paying | You, on the preview step and the review step | To show you your preview, prefill Hotmart’s checkout, link your payment to your order and, if the payment is not completed, send you one automatic reminder with a link back to your order and a preview of your artwork |
| Buyer email and name | Hotmart, when you pay | To link your payment to your order, email you your artwork (the print file) with a link to your order, let you recover it on another device, provide support and prevent abuse |
| A coded (hashed) version of your identity document number | Calculated from the number Hotmart sends. We never store the number itself | Only to prevent repeated chargeback abuse (section 3) |
| Transaction details: transaction code, offer, price, currency, payment method, coupon used, dates, order status | Hotmart | To confirm payment, handle refunds and disputes, and keep accounting records |
| Order access key | Created by us | To prove, through a cookie in your browser, that the order is yours. We keep only a hash of it |
| IP address and time of orders, downloads and recovery requests | Your connection | Security, rate limits, and evidence in case of fraud, refund or dispute |
| Technical logs: request lines (which can include place search text and coordinates), order ids, masked transaction codes, errors | Our server | Running and securing the service |
| Analytics data: pages and product steps you visit, device and browser type, language, screen size, referrer and campaign parameters, approximate location derived from your IP, errors and performance | Your browser, through our analytics provider | To understand and improve the site (section 6) |
| Session recordings (unless you opt out) | Your browser | To see where the site confuses people. They capture what you see and type on loveMap’s pages, including the names, the date, the place, the personal line and your email address. Payment card data is never recorded: you enter it in Hotmart’s own checkout, which recordings do not capture |
Ad measurement data: the pages and steps you take (viewing the studio, starting checkout), your IP address, device and browser details, and Meta’s cookie ids (_fbp, _fbc) | Your browser, through the Meta pixel (unless you opt out) | To measure and improve our ads (section 6) |
Visit measurement by Hotmart: the address of the page you view (including any query string such as campaign tags), the page you came from, your IP address, device and browser details, and a random visitor id (hotid) | Your browser, through Hotmart’s tracking script (unless you opt out) | To count visits to our pages and see, in our Hotmart account, which pages and campaigns lead to sales (section 6) |
| Purchase report to Meta: a coded (hashed) version of your order email, your IP address, browser details, Meta’s cookie ids, the price and the time of the purchase | Our server, when Hotmart confirms your payment (not sent if you opted out) | To measure and improve our ads |
| Reminder record | Created by us when we send a reminder | To send at most one reminder per order and per address, and to respect unsubscribes. It holds a coded (hashed) version of your email, never the address itself |
| Emails you send us | You | To answer you |
We do not receive your card details, and we do not store your phone number, postal address or the raw document number that Hotmart may send us.
Other people’s data. The names on the artwork often include someone other than you. Please only enter names that the people concerned would expect to see on a private keepsake. We use them only to make the artwork and never to contact anyone.
We do not ask for sensitive data.
Automated decisions. We do not use profiling. One decision is automatic: if an email or document is on our abuse-prevention list (section 3), we automatically refuse new orders from it. If a payment still goes through, we refund it to you. You can ask for a person to review that decision, give your point of view and contest it by writing to hola@lovemapart.app.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Show your preview and make, deliver and correct your artwork | Design, emails and names, transaction details, access key | Performance of the contract (art. 6(1)(b)) |
| Let you recover your order on another device, and provide support | Buyer email and name, transaction code, design, emails you send | Performance of the contract (art. 6(1)(b)) |
| Accounting and legal obligations, including proof of the transaction | Transaction details, buyer email and name | Legal obligation (art. 6(1)(c)) where EU law applies; otherwise our legitimate interest in complying with the tax and consumer laws that bind us (art. 6(1)(f)) |
| Security and rate limits | IP addresses, logs | Legitimate interest in protecting the service (art. 6(1)(f)) |
| Preventing repeated chargeback abuse, through a list of emails and document hashes linked to charged-back or disputed orders. A refund never puts you on this list | Buyer email, document hash | Legitimate interest in protecting our sales (art. 6(1)(f)) |
| Sending one automatic reminder, after you stop working on an order that is not paid (normally about an hour, and never more than 48 hours after you started it), with a link back to your order and a watermarked preview of your artwork. The same single reminder can go to the email you type to see your preview, with a link back to your design. Never more than one per order or one per address every 7 days, and never if you unsubscribed, already paid, or a payment made with this email was disputed | Email you typed before paying, order reference, reminder record | Legitimate interest in helping you finish a purchase you started (art. 6(1)(f)); you can object at any time with the unsubscribe link in the email or by writing to us. Where Colombian Law 1581 of 2012 applies, the authorisation you give us when you type your email to see your preview or continue to payment, after being shown the link to this policy (see below) |
| Defending refunds, disputes and chargebacks | Download and recovery records, IP addresses, transaction details | Legitimate interest in establishing and defending legal claims (art. 6(1)(f)) |
| Order and sales metrics (order reference, price, offer, payment method type, coupon used, country, language, device type) and server errors | Order and transaction records, sent to our analytics provider without your name, email, design or transaction code | Legitimate interest in measuring sales and keeping the service working (art. 6(1)(f)) |
| Analytics, session recordings, ad measurement (the Meta pixel and the purchase report) and Hotmart’s visit measurement, unless you opt out | Analytics data, session recordings, ad measurement data, purchase report, Hotmart visit data | Your authorisation through your conduct after the notice in the site footer and in this policy (Colombian Decree 1377 of 2013). Where the GDPR applies, our legitimate interest in understanding the site and measuring our ads (art. 6(1)(f)); you can object at any time by opting out |
Giving your design and email is necessary to buy: without them we cannot make or deliver the artwork. Analytics, session recordings and ad measurement are optional (a voluntary purpose): you can use the whole site after opting out.
Authorisation under Colombian law. When you type your email to see your preview or continue to payment, after being shown the link to this policy, you give us your prior, express and informed authorisation to process your data for all the purposes in the table above. For analytics, session recordings and ad measurement, we rely on the notice in the site footer and in this policy: if you keep using the site you authorise them, and you can opt out at any time (section 6). You can revoke your authorisation at any time (section 9), unless a legal or contractual duty requires us to keep the data.
4. How long we keep it
| Data | How long |
|---|---|
| Unfinished designs you never pay for | The design stays in your browser until you clear it. An order that is never paid expires after 7 days and is deleted from our server 30 days later |
| Temporary production files | 48 hours after they are made |
| Map and relief caches (place data only, no names) | 30 days after last use |
| Your artwork files | 365 days after payment |
| Paid order records: design, buyer email and name, transaction details, document hash, download and recovery records, the delivery email record (order reference, send time, Resend message id) | As long as needed for accounting, tax and dispute purposes. We do not delete them on a fixed schedule today. You can ask us to delete them (section 9), and we will delete or anonymise what the law does not require us to keep. Resend keeps its logs of the delivery email under its own retention period |
| Payment notifications from Hotmart that do not match any order | 90 days |
| Abuse-prevention list (email, document hash) | As long as it is needed to prevent repeated chargeback abuse. You can ask us to review your entry at any time (section 2, “Automated decisions”) |
| Technical logs | Up to 30 days |
| Meta identifiers kept on your order (Meta cookie ids, IP address, browser details) | Deleted as soon as the purchase report is sent to Meta, and after 7 days at most (Meta accepts reports for 7 days). The coded email is never stored, it is calculated when the report is sent |
Meta’s cookies in your browser (_fbp, _fbc) | Up to 90 days, or until you opt out |
Hotmart’s visitor id (hotid, cookie and browser storage) | Hotmart sets a very long lifetime and we cannot shorten it (browsers cut it, for example to 400 days in Chrome); it is deleted when you opt out |
| Order access cookie in your browser | 90 days |
| Reminder record (coded email, order reference, send time, whether you opened the link) | About 7 days after the reminder. Resend keeps delivery logs under its own retention period |
| Unsubscribe list (coded email only) | As long as loveMap sends reminders, so we never email you again |
| Server backups | Deleted data can remain in backups for up to 7 more days until they rotate out |
5. Who receives your data
We share your data only with providers that help us run loveMap, and only what each one needs.
| Recipient | Role | What they receive | Location |
|---|---|---|---|
| Hetzner Online GmbH | Hosting and backups (processor) | Everything stored on our server | Germany |
| Cloudflare, Inc. | Network, security, DNS and email routing (processor) | All traffic to the site, including IP addresses, and emails you send us, in transit | Global network, US company |
| Hotmart (Hotmart BV and its group) | Payment processing (our payment agent; an independent controller for the data it collects) | The email and name you typed, and your order reference. Hotmart collects the rest of the payment data itself, under its own policy | Netherlands, Brazil and, for some payments, the United States |
| PostHog, Inc. | Product analytics and error tracking (processor) | Analytics data; for every order, the order reference with its price, offer, payment method type and country; server error reports; and, unless you opt out, session recordings (which can show the names, dates, places, personal line and email you type on our pages, but never payment card data), click events (which can include the text shown on the element you click, such as those same details) and a link between your visit and your order. Never your transaction code or card data | United States |
| OpenStreetMap Foundation tile servers, and openstreetmap.fr | Map tiles | When you move the map, your browser downloads map images directly from the OpenStreetMap Foundation’s tile servers, which shows them your IP address and the area you are viewing. To make your artwork, our server also fetches map images of the area you chose from them and from openstreetmap.fr, without your IP address | United Kingdom, through a content delivery network, and France |
| Photon by komoot | Place search | Your search text, the map area, and the coordinates of the place you pick or of your device when you use “Use my current location”, sent by our server without your IP address | Germany |
| Meta Platforms, Inc. and Meta Platforms Ireland Limited | Ad measurement | Through the pixel in your browser: the pages and steps you take (viewing the studio, starting checkout), your IP address, device details and Meta’s cookies. When you buy, from our server: the purchase report (a coded version of your email, IP address, browser details, Meta’s cookie ids, price and time). Never your names, dates, places or transaction code. Nothing is sent if you opted out or your browser sends Do Not Track or Global Privacy Control | United States and Meta’s global network |
| Hotmart (Hotmart BV and its group), visit measurement | Visit measurement for our Hotmart account | Through Hotmart’s tracking script in your browser: the address of the page you view (including any query string), the page you came from, your IP address, device and browser details and its hotid identifier. Your names, dates and places are not part of our page addresses, so they are not sent. Nothing is sent if you opted out or your browser sends Do Not Track or Global Privacy Control | Netherlands, Brazil and, for some data, the United States |
| Resend (Plus Five Five, Inc., USA) | Email delivery (processor) | For the one reminder: your email address, the message with the link to your order and a watermarked preview image of your artwork, which shows your names, date, place and personal line. For the delivery email, when you pay: your email address, the print file (which shows your names, date, place and personal line) and a link to your order | United States (sending infrastructure in Brazil) |
| Google (Gmail) | Support mailbox | Emails you send us | United States |
We may also disclose data when the law requires it, or to Hotmart or a card issuer to resolve a dispute about your order.
We do not sell your personal data. The Meta pixel and the purchase report are for measuring and optimising our own ads; we do not give Meta your design or names. Hotmart’s visit measurement is for the sales figures of our own Hotmart account.
6. Cookies, browser storage and analytics
| Name | Type | Purpose | Needed? |
|---|---|---|---|
lm_o_<order> | Cookie, 90 days | Proves that an order is yours so you can download it | Strictly necessary |
lovemap:draft:v1, lovemap:job:v1 | Browser storage | Keeps your unfinished design (place, names, date) and the progress of a preview on your device, so a reload does not lose it | Functional, requested by you |
lovemap:lang:v1, lovemap:country:v1 | Browser storage | Remembers your language and search country | Functional |
lovemap:consent:v2 | Browser storage | Remembers your tracking choice (“Don’t track me”) | Strictly necessary |
_fbp, _fbc | Cookies, up to 90 days | Meta pixel identifiers for ad measurement. lovemap:fbc:v1 (session storage) keeps the ad click id for the visit | Unless you opt out |
hotid | Cookie on our domain and browser storage; very long lifetime set by Hotmart (browsers shorten it) | Hotmart’s random visitor id, to measure visits and sales in our Hotmart account | Unless you opt out |
__ph_opt_in_out_… | Browser storage | Records your analytics choice for our analytics provider | Strictly necessary |
ph_… | Browser storage and session storage | Analytics identifier, session and settings state | Unless you opt out |
Your design stays in your browser’s storage after you buy. On a shared device, you can remove it by clearing this site’s data in your browser.
Tracking is on by default. Unless you opt out, our analytics provider stores an identifier on your device and records your sessions (what you see and type on our pages, including the names, the date, the place, the personal line and your email address, but never payment card data, which you enter in Hotmart’s own checkout) and click events, which can include the text of what you tap, so we can understand how visits turn into orders, the Meta pixel measures our ads, and Hotmart’s tracking script counts visits to our pages. We tell you in a notice in the site footer.
Your choice: “Don’t track me.” You can opt out at any time. It stops analytics and the Meta pixel at once and on future visits, stops Hotmart’s tracking script from the next page you load (one that is already running can still add its identifier to links to Hotmart until the page reloads), deletes their identifiers (including Hotmart’s hotid cookie) from your browser, and means we do not send Meta a purchase report for orders you make afterwards. The choice is stored on this device and browser, so repeat it on each one. You can also use it to switch tracking back on.
Do Not Track and Global Privacy Control. If your browser sends either signal, we treat it as an opt-out: analytics, the Meta pixel and Hotmart’s tracking script never load and we send no purchase report. Order and sales metrics (section 3) are still recorded.
The checkout inside our page is provided by Hotmart and may use its own cookies, as explained in Hotmart’s privacy policy. Hotmart’s tracking script (visit measurement) is separate from the checkout, and the opt-out above covers it. It loads a small tracking image (a pixel) from Hotmart and adds its identifier (a _hi parameter) to links on our pages that point to Hotmart, so Hotmart can connect your visit to a purchase there.
Other than the providers in section 5, no third party collects information about your activity on this site over time or across other sites, except Hotmart, inside its checkout and through its tracking script.
7. International transfers
- Where. Our providers process data outside your country: in Germany, the Netherlands, the United Kingdom, France, Brazil and the United States (section 5). The email and name we send to prefill the checkout go to Hotmart BV in the Netherlands. Any further transfer inside Hotmart’s group, including to Brazil, is Hotmart’s responsibility as an independent controller, under its own privacy policy.
- From the European Economic Area or the United Kingdom to the United States. We rely on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, and on the European Commission’s standard contractual clauses otherwise.
- From Colombia. We use providers in countries with an adequate level of protection or under data transmission contracts, as required by Law 1581 of 2012 and Decree 1377 of 2013.
You can ask us for more information about these safeguards, and for a copy of them, at hola@lovemapart.app.
8. Security
We protect your data with encrypted connections, a firewall that accepts traffic only through our network provider, access to orders through a secret cookie whose value we store only as a hash, masking of transaction codes in logs, strict limits on what our analytics can receive, automatic deletion of expired data and restricted administrative access. No system is perfectly secure. If a breach affects your data and puts you at risk, we will tell you and the competent authorities as the law requires.
9. Your rights and how to exercise them
Depending on where you live, you have the right to:
- know and access the data we hold about you, and receive a copy;
- update and correct it;
- ask us to delete it, or revoke your authorisation, when we have no legal or contractual duty to keep it;
- restrict or object to processing based on our legitimate interest;
- receive the data you gave us in a portable format;
- opt out of analytics and ad measurement at any time (section 6), without affecting earlier processing;
- stop reminder emails at any time with the link in the email (we then keep only a coded version of your address, so we never email you again);
- ask for proof of the authorisation you gave us and be informed of how we have used your data;
- complain to a data protection authority.
How to make a request. Write to hola@lovemapart.app with the subject “Data request”. Tell us your name, what you are asking for and how to reply to you. To protect your data, we may ask you to confirm that you are the buyer, for example with the email and transaction code from your Hotmart receipt. Requests are free. Someone acting for you must show that they are authorised.
Response times.
- Queries (access to your data): we answer within 10 business days. If we cannot, we tell you why and answer within 5 more business days.
- Claims (correction, update, deletion, revocation, or a complaint about how we handle your data): we answer within 15 business days. If we cannot, we tell you why and answer within 8 more business days. If your claim is incomplete, we ask you for what is missing within 5 business days; if you do not reply within 2 months, we treat the claim as withdrawn.
- If you are in the European Economic Area or the United Kingdom, we answer in any case within one month, extendable by two months for complex requests, and we tell you if we extend.
Complaints to an authority. In Colombia, you can complain to the Superintendencia de Industria y Comercio (www.sic.gov.co) after you have used the procedure above with us. In the European Economic Area or the United Kingdom, you can complain to the data protection authority where you live or work. Elsewhere, you can contact the authority that applies to you.
10. Children
loveMap is not directed at children and you must be of age to buy. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.
11. Effective date
This policy is in force from 27 October 2026. Our databases stay in force for as long as loveMap operates, and each type of data is kept only for the periods in section 4.
12. Changes to this policy
We may update this policy. We show the date of the latest update at the top. If we want to use your data for a new purpose that needs your authorisation, we will ask for it first. We keep previous versions and will send you one on request.
13. Contact
loveMap · hola@lovemapart.app