Privacy Notice

Who is responsible for your data

The data controller — the person who decides what happens to your data and answers for it — is:

That address and that inbox are not a call centre. They are one person. Write in English or Italian, whichever you prefer.

A business this small is not required to appoint a Data Protection Officer, and has not appointed one. For anything about your data, write to the address above.

What we collect, and where it comes from

When you place an order, this is the complete list of what ends up in our order record. It is not a summary — it is the actual set of fields in our database:

• Who you are and where the mat goes: your email address, your name, your phone number, and your shipping address (street, second address line, city, province or state, postcode, country).
• What you bought: the map design, the size, the product code, how many, the total you paid (stored in cents), and the currency.
• How the order moves: the date it was placed, its status (paid, design sent, ordered, shipped, refunded), the reference number Stripe gave the payment session, the order number our supplier gave it, and the tracking number once the parcel has one.
• Notes: a free-text field where we sometimes type a line by hand — for example “customer asked us to leave the parcel with the neighbour” or “replacement sent, first one arrived creased”. Whatever is in there, you have the right to ask for a copy of it.
• The order’s own reference number. Every row gets an internal identifier when it is created. We are naming it because it is not the harmless plumbing it looks like: the last part of it becomes the order number MW-XXXXXXXX that we put in the file we hand to the supplier. It is the name your order goes by in the workshop’s records, so it belongs on this list.
• One housekeeping field: the date on which we erased your personal details from the record. While it is empty, your details are still there.

Where it comes from: you type it in, but not on our site. You type it on Stripe’s payment page, and Stripe passes it to us once the payment succeeds. Your phone number is asked for because most couriers will not deliver a parcel from abroad without one.

If you write to us about a problem with the mat, that goes in a second, separate record. It is a complaints register. If you tell us the mat is unsafe, we do not keep that because it is useful — we keep it because Article 9(12) of Regulation (EU) 2023/988 requires the manufacturer of a product to investigate complaints from someone who reports it as dangerous, and to keep an internal register of them, of any recalls, and of any corrective action taken. On this product the manufacturer is us. An ordinary quality complaint — a crooked print, a creased parcel — goes in the same record because it is the same conversation, but that part is our choice and not that Regulation’s requirement. What goes in a row: the date it reached us, whether it came by email, AliExpress chat or Instagram, whether it is a safety matter or a quality one, your name and email address if you gave them, your order reference, what you told us, what we found when we looked into it, what we did about it, and whether we had to notify the authorities.

Your image in the custom preview stays on your device. The editor opens the selected image locally in your browser. It is not uploaded to our servers or sent to a printer. The composition and any added grid are also processed locally. Downloading the preview saves a PNG on your device; it does not place an order. The editor does not store the original or your edits on our servers.

And if you join the waiting list for custom mats, that is a third record, with one field in it. Your email address, the language you were reading in, the date, and the exact sentence you agreed to — we store the wording itself, not a tick, so that if this page ever changes you can still see what you actually said yes to. There is no name, no order, and no link to anything else about you. It exists to answer one question: do enough people want custom mats for us to build them. You will get one email in total, the day custom mats open, with an unsubscribe link in it; there is a field on the row whose only job is to make a second one impossible. Ask us at any time and the row is gone the same day — there is nothing else attached to it.

And if you arrived from one of our adverts, the order record keeps the name of the advert. Here is exactly how, because the how is the point. Our adverts do not point at mapwyrm.com — they point at an address of their own, like mapwyrm.com/c/dnd. The page you get is the shop, unchanged. Our server already knows which address it served, so it hands that one word along with your order and we store it next to it. That is the whole mechanism.

We put nothing on your device to do this and we read nothing from it — no cookie, no pixel, no tag, nothing kept in your browser, and we never look at where you came from before. The label says which advert, not who you are: everyone who clicked that advert carries the same word. We keep it for one reason, which is to find out whether money we spent on advertising produced any sales, and the lawful basis for that is our legitimate interest in knowing it.

One consequence worth stating, because it runs against us. Since we keep nothing on your device, the label only lasts as long as your visit. If you see an advert today, leave, and come back next week by typing our address, your order is recorded with no advert attached. So this method undercounts our own advertising and can never overcount it.

Separately from all of that, our hosting provider necessarily processes the technical information every website receives when you open a page: your IP address, the type of browser and device you are using, and which page you asked for. That is how a web page reaches you at all, and it is also how a host blocks attacks. We do not build any of it into a profile of you and we do not link it to your order.

What we do with it, and what allows us to

To send you the mat you paid for. That covers taking the order, having it printed, having it shipped, emailing you your order confirmation and your tracking number, and answering you when you write to us about it. Legal basis: performance of a contract with you (Article 6(1)(b) GDPR). Without this data there is no parcel and no address to send it to.

To handle a change of mind, a return or a fault. If you exercise your 14-day right of withdrawal, or if the mat turns up damaged or not as described and you use your two-year legal guarantee, we need your order record to identify the purchase and refund or replace it. Legal basis: performance of a contract, and compliance with our legal obligations under EU and Italian consumer law (Articles 6(1)(b) and 6(1)(c)).

To keep our books. Italian law requires a business to preserve its accounting records for ten years (Article 2220 of the Italian Civil Code). Those records need the date, the amount, what was sold and the reference of the payment. They do not need your name or your home address — which is exactly why, after 913 days, we strip out the personal parts and keep only the commercial ones. Legal basis: legal obligation (Article 6(1)(c)).

To investigate a complaint about the product itself. If you tell us the mat is unsafe — a smell that gives you a headache, a material that irritates your skin — we are required to look into it, write down what we found and what we did, and in a serious case notify the market surveillance authorities through the EU Safety Business Gateway. Legal basis: legal obligation (Article 6(1)(c) GDPR), the obligation being Article 9 of Regulation (EU) 2023/988. This is one of the few things on this page we would have to keep doing even if you asked us to stop. For a complaint that is about quality rather than safety, no such obligation applies and the basis is the ordinary one: performing our contract with you (Article 6(1)(b)).

To keep the site standing up. Serving the page to you, keeping the shop online and defending it against abuse. Legal basis: our legitimate interest in running a working, secure shop (Article 6(1)(f)) — an interest we think is fairly hard to object to, since it is also the only way you get to see the site.

That is the whole list. We do not send marketing emails, we do not run a newsletter, we do not sell, rent or share your data with anyone for their own purposes, and we do not use your data to advertise to you anywhere else.

We do not rely on consent for any of the above. That means there is no consent for you to withdraw — but it also means the processing above is not optional for us while your order exists, so the right to object and the right to erasure below are the ones that matter to you.

Your card details: we never have them

When you click to pay, you leave our site and land on a payment page run by Stripe. Your card number, expiry date and security code are typed there, into Stripe’s systems, and they never touch ours. Depending on what you choose, that page may also offer other payment methods such as Klarna or Satispay, each with its own provider.

What comes back to us is: it worked, here is the amount, here is the buyer’s name, email, phone and shipping address. That is all.

Stripe is not simply passing data along on our behalf — it is a payment institution processing your payment data for its own regulatory and anti-fraud purposes too, under its own privacy policy. Read it at stripe.com/privacy. Stripe is an international group and processes data outside the EU under the safeguards described in that policy.

One consequence worth knowing: if you ask us to delete your card details, we cannot, because we do not have them. You would need to ask Stripe.

Who else sees your data

These are everyone who touches your data, and precisely what they get. There is nobody else.

Two of them are not simply working on our instructions, and saying otherwise would be the easy lie here. Most of the companies below are processors: they do what we tell them and nothing else. Stripe and Resend also decide things for themselves, for their own purposes, and where they do that they — not we — are the ones answerable to you. We say which is which.

• Stripe Payments Europe, Limited (Ireland) — takes the payment and collects your name, email, phone and address on its payment page. Both a processor and a controller in its own right. It works for us when it runs the payment. It decides for itself when it screens the transaction for fraud, meets its anti-money-laundering and know-your-customer duties, answers authorities, and analyses and improves its own products. For those purposes your rights are exercised against Stripe, under Stripe’s own privacy policy at stripe.com/privacy, not against us.
• Supabase Pte. Ltd. (Singapore) — provides the database where your order record is stored. The database itself sits in Frankfurt, Germany (region eu-central-1), but the company we contract with is Singaporean, so the data is reachable from outside the EU. See the transfers section: that is why “it stays in Frankfurt” is not the end of the story.
• Vercel Inc. (United States) — hosts the website and serves the pages to your browser. A processor for your order data, and a controller for the technical data its own service generates.
• Resend (Plus Five Five, Inc., United States) — sends you the order confirmation email. To do that it necessarily handles your email address and the contents of that email, which include your order details and your shipping address. Also a controller in its own right for its sending logs — which, by its own definition, include the data identifying the sender and the recipient of every message. So your email address is not only processed on our behalf: it is also Resend’s own record. Its list of sub-processors includes two artificial intelligence suppliers; we have asked Resend whether the content or metadata of customer emails reaches them, and this page will say what we are told.
• IONOS and Google — the mail servers for our domain are IONOS’s, and hello@mapwyrm.com is not a mailbox: it is a forwarding address into an ordinary Gmail account. So anything you write to us — your name, your email address and whatever you put in the message, including a request to delete your data — is routed by IONOS and then sits with Google. Our replies leave from that Gmail account too. See the transfers section.
• DSers — Nebulapart Limited, Hong Kong. This is the first company outside the EU to receive your data, and for a long time we described it as part of a vague “platform”. It is not. We generate an order file from our database and upload it to DSers; only afterwards does DSers place the order. Its own terms give a Hong Kong address and Hong Kong law, and its site carries a mainland Chinese operating licence. Its privacy policy never mentions the GDPR and it publishes no data processing agreement; it does say it moves data to the United States.
• Alibaba.com Singapore E-Commerce Private Limited — the company that actually runs AliExpress for a European business buyer, and the one we contract with. Singapore also has no adequacy decision, so this is a transfer outside the EU too. The platform then hands the order to the workshop.
• The supplier in China — the workshop that prints, stitches and ships your mat. It receives your name, your phone number and your shipping address. It does not receive your email address: that column is deliberately left empty in the file we upload, because the workshop has no use for it.
• The courier and its local delivery partner — they receive whatever is needed to carry the parcel to your door and hand it over: name, address, phone number.
• Our accountant and, if it ever came to it, our lawyer — bound by professional confidentiality, and only for the invoices and records they need.
• The authorities, if the law requires us to hand something over. We will not pretend otherwise.

Nobody at any of these companies is buying your data or being given it to market to you. They are all doing a specific job we hired them for.

Where your data goes outside the EU

This is the part most shops bury. We are going to be blunt about it, because two different things happen and both deserve saying.

The United States, and one place that is not. Vercel and Resend are United States companies: Vercel runs a worldwide delivery network, Resend sends our mail. Our database is physically in Frankfurt, but the company we contract with for it is Supabase Pte. Ltd., of Singapore — not an American company and not a European one, and Singapore has no adequacy decision either. Staff can access the systems they operate, for example when we ask them for support. So even though the data lives in Europe, the companies controlling the systems it lives in are outside the EU, and that counts as a transfer. It would be misleading to tell you “your data stays in Frankfurt” and stop there.

The instrument for this is the set of Standard Contractual Clauses adopted by the European Commission — the standard contract terms designed for exactly this situation — which all three providers offer inside their data processing terms.

Stripe is the one that works differently, and the order matters. Its transfer terms put the EU–US Data Privacy Framework first and the Standard Contractual Clauses second, as the fallback: Stripe, LLC is self-certified under that Framework. So for Stripe the primary safeguard is the Framework, not the Clauses.

And one gap we are not going to paper over. Resend is certified under the Framework for the EU and the UK, but not for Switzerland. We ship to Switzerland. For a Swiss customer the Framework is therefore unavailable for the order confirmation email, and the safeguard is the Standard Contractual Clauses in Resend’s own terms — which do cover it, but it is a different instrument and you deserve to know which one is holding your data up.

Google is the exception we cannot dress up. The address we give you for everything — questions, withdrawal, the legal guarantee, your data rights, complaints — forwards into an ordinary Gmail account. So your message, and our answer, sit with Google in the United States under the terms Google applies to any consumer account, not under the clauses above. If you would rather not go through there, write to us on paper at the postal address at the top of this page: that reaches us without passing through Google.

China. This one is simpler and more direct: to deliver a parcel to you, your name, phone number and address have to reach the people who pack and ship it, and those people are in China. There is no adequacy decision from the European Commission covering China, and Chinese law does not offer the same protections as EU law.

You can ask us for more detail on any of these transfers, including a copy of the relevant safeguards, by writing to hello@mapwyrm.com.

How long we keep it — and what “deleted” means here

913 days from the order. That is about 2.5 years. On that date, your name, your email address, your phone number, your full shipping address, the parcel tracking number, the supplier’s order number and any notes we wrote about you are erased from the order record. Not hidden, not archived — the fields are emptied.

Why 913 and not a rounder number: your legal guarantee of conformity runs for two years from delivery, and for as long as it runs we have to be able to work out who bought what. The extra months are the margin for a complaint raised right at the end of that period.

This is not a promise we made up for this page. It is a function in our own system with the 913 days written into it, and it runs on a schedule, once a day, without anyone having to remember. There is also a per-order version of it, so we can honour an individual erasure request without waiting for the clock.

Your right to erasure is not unlimited, and we will not pretend it is: while the legal retention obligation is running, we can strip the personal fields but we cannot delete the accounting trace of the sale. Article 17(3)(b) GDPR says as much. What we can do — and will do on request — is remove everything that points at you.

The complaints register keeps its own, shorter clock: 1825 days. That is five years, and it is not our number — it is the ceiling set by Article 9(13) of Regulation (EU) 2023/988, which says a complaints register may hold only the personal data needed to investigate, for no longer than the investigation needs and in any case no more than five years. On that date your name and email address are erased from the complaint. What you reported, what we found and what we did about it stay, because that is the register the law asks us to keep — and so does your order reference, when there is one, because it is the link between the complaint and the sale. That reference is the same pseudonymised identifier described above, not your name. And if the investigation finishes sooner, we erase your details sooner: that is the same Article, first half of the same sentence.

Your order confirmation email lives in your own inbox and in Resend’s sending logs for the period Resend retains them; and your payment record lives with Stripe under Stripe’s own retention rules. Those are outside our control.

Cookies, tracking and fonts

Our site sets no profiling cookies, no advertising cookies and no analytics cookies. There is no cookie banner because there is nothing here for you to consent to.

We do measure, and here is exactly what that means. Since 3 September 2026 this site uses Vercel Web Analytics. It counts page views and a handful of clicks — which map you looked at, which size you picked, whether you started a checkout — so that we can tell whether anything we do actually works. It sets no cookie, it stores no identifier on your device, and it does not build a profile of you or follow you to other sites. What we see is a total, not a person.

Vercel processes your IP address to derive an approximate country; it does not retain the IP address in the analytics data. Vercel also hosts this site. We do not use Google Analytics.

There is no customer account. Fonts are self-hosted and do not require a request to Google when you view a page.

Store interactions are announced within your browser and sent to Vercel as analytics events, without your name, email or order ID. Preview sites and operational pages are excluded.

You can exclude this browser from analytics. This saves only an exclusion preference in local storage, not a personal identifier. It remains until you clear the site’s browser data or enable analytics again. The preference applies to this browser and device; if browser storage is blocked, it lasts only for the current page.

Stripe’s payment page is a different website with its own cookies, most of them strictly necessary to process the payment and detect fraud. Stripe’s privacy policy governs that page, not this one.

How we look after it

The order database has row-level security switched on with no public access policy at all: it can only be read by our server, holding a secret key that never reaches anybody’s browser.

The internal page where we work through orders — the one that shows names, phone numbers and home addresses — sits behind a username and password, checked both at the door and again inside every action that page can perform. If those credentials are not configured, the page refuses everyone rather than letting anyone in.

Payment events arriving from Stripe are cryptographically verified before we record anything, so nobody can invent an order in our system.

The one part of the chain that is not a managed service is the spreadsheet described in “Who else sees your data”. We would rather point at it twice than describe our security without it.

We are not going to claim military-grade anything. We are a small shop using well-run services and keeping the secrets secret. If something goes wrong and your data is exposed in a way that puts you at risk, we will tell you, and we will tell the Italian supervisory authority within 72 hours, as Articles 33 and 34 GDPR require.

Your rights

Under the GDPR you have all of the following, and using them costs you nothing.

• Access (Article 15) — ask us for a copy of everything we hold about you. Including the free-text notes.
• Rectification (Article 16) — get anything wrong corrected. If you spot a typo in your address, tell us fast: before the order goes to print we can still fix it at the source.
• Erasure (Article 17) — ask us to delete your personal data. We will empty every field that identifies you. As explained above, the bare accounting record of the sale has to stay until its legal retention period ends.
• Restriction (Article 18) — ask us to freeze the processing while a dispute about accuracy or lawfulness is sorted out.
• Data portability (Article 20) — ask for the data you gave us in a structured, machine-readable format, or ask us to send it to someone else.
• Objection (Article 21) — object to processing we base on our legitimate interest.
• Not to be subject to automated decision-making (Article 22) — see the next section; we do not do any.

How to use them: email hello@mapwyrm.com. Say which right you are exercising, or just say what you want in plain words — you do not need to quote article numbers at us. We answer within one month, and if a request is genuinely complicated we may take up to two months more, in which case we will tell you why within the first month.

We may need to check that you are really you before handing over personal data — usually just writing from the email address on the order is enough. We will not demand documents we do not need.

No automated decisions, no profiling

Nothing on this site makes an automated decision that produces legal effects for you or similarly significantly affects you, and we do not profile you. A human being reads every order, writes to you by hand, and types the notes.

Do you have to give us this data?

You can read the whole site, look at every map and never tell us a thing.

If you want to order, then yes: your name, address and phone number are required, because there is no way to deliver a physical object without them, and your email is required because the law obliges us to send you a confirmation of the contract on a durable medium (Article 51(7) of the Italian Consumer Code). If you do not provide them, we cannot conclude the sale. That is a contractual requirement, not a legal one — but it is not one we can waive.

If you think we have got it wrong

Please tell us first, at hello@mapwyrm.com. We would rather fix a problem than argue about one.

But you do not have to come to us first, and you never lose the right to complain to a data protection authority:

If you live in another EU or EEA country, you can complain to your own national supervisory authority instead. You also always have the right to go to court (Articles 77, 78 and 79 GDPR).

Changes to this policy

If we change how we handle your data — a new provider, a new purpose, anything that makes a sentence above untrue — we update this page and change the date at the top before the change takes effect, not after.

This version is dated 12 September 2026. It describes the site as it actually works on that date, checked line by line against the code that runs it, not against what we would like to be true.