Privacy Policy
Version 2026-10-22
1. Controller and contact
WaveOrigin OÜ, Tööstuse tn 75-71, 10416 Tallinn, Estonia, registry code 17454567 ("Unmapped", "we"), is the controller for the processing described here. Privacy contact: unmapped.network@gmail.com. We have not appointed a Data Protection Officer, as we are not required to.
This policy covers Members (people with an Unmapped account), Guests (people who register for an Event or buy a ticket without an account), Organizers, and visitors to our website and apps.
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Account and profile | name, email, username, profile and cover photo, bio, city and country, skills, interests, languages, social links, roles, countries visited, travel plans and their visibility | you |
| Content and communications | posts, comments, images, Event, project and trip listings, chats, Event discussions, join-request messages | you |
| Interactions | Events and projects joined or saved, likes, connections, blocks, reports | you, the Platform |
| Event registrations | status (pending, approved, rejected, withdrawn), answers to guest registration questions, registration source | you |
| Guest data | name, email address, mobile number where the Event's form asks for it, answers, and a hashed token for your emailed ticket or payment link (we store only the hash) | you |
| Orders and tickets | amount, currency, status, timestamps, refund policy, refund type and amount, ticket code, check-in time and who checked you in, payment deadline for approved requests, the email address the order belongs to, and the seller information that applied to the order | the Platform, Stripe |
| Payment metadata | Stripe identifiers of the checkout session, payment, charge, refund and application fee; dispute notifications. We never receive full card numbers. | Stripe |
| Organizer payout and seller data | Stripe account identifier, payout country, payout readiness, settlement currency; your declared seller status and, if you sell as a business, its legal name, address, registration number and VAT ID; receipts for our platform fee | Stripe, you |
| Acceptance records | which version of which legal document you accepted, when, on which platform (web, iOS, Android), in which context (sign-up, re-acceptance, registration, checkout, Organizer), and whether you confirmed being 18 or older | you, the Platform |
| Transactional emails | recipient address, email type (Guest ticket, payment link after approval, Event-cancellation refund notice, contact-form messages), delivery status | the Platform, our email provider |
| Notifications | in-app notifications; push tokens of your devices | the Platform, your device |
| Location | city and country you enter; places you choose for Events; device location only as described in section 4.3 | you, your device |
| Technical and security | IP address, device and browser data, request logs, rate-limit counters, error reports (scrubbed, with an internal user ID only), authentication logs | your device, our providers |
| Internal analytics | actions on the Platform (for example sign-up, views, joins), stored in our own database | the Platform |
| Support and moderation | support messages, reports, moderation decisions, appeals | you, the Platform |
We do not ask for special categories of data. Content you choose to share, or answers to an Organizer's questions, could reveal such data; it is then processed only as part of that content.
3. Purposes and legal bases
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Providing your account and the Platform (profiles, content, chats, Events, connections) | contract (b) |
| Event registrations and tickets for Members and Guests, including Guest ticket emails and payment links | contract (b) |
| Payment processing, refunds, disputes, cancellation notices | contract (b); legal obligation (c) for accounting |
| Sharing attendee data with the Organizer (section 5) | contract (b); our and the Organizer's legitimate interest in running the Event (f) |
| Organizer payout setup with Stripe; showing the Organizer's seller status to buyers; platform-fee receipts | contract (b); legal obligation (c) |
| Recording acceptance of our terms and the age confirmation | legitimate interest in being able to prove acceptance (f) |
| Security, fraud and abuse prevention, rate limiting, logging, incident response | legitimate interests (f); legal obligation (c) where applicable |
| Content moderation, notices of illegal content, statements of reasons | legal obligation (c) under the Digital Services Act; legitimate interests (f) |
| Internal analytics to improve the Platform | legitimate interests (f) |
| Push notifications | consent (a), given through your device or browser setting |
| Accounting and tax records | legal obligation (c) |
| Establishing or defending legal claims | legitimate interests (f) |
You can object to processing based on legitimate interests (section 9).
4. Service providers and other recipients
4.1 We use the following providers. Providers that process data on our behalf do so under data-processing terms with us.
| Provider | What for | Data | Location |
|---|---|---|---|
| Supabase | database, authentication, file storage, real-time messaging | all Platform data | European Union (Frankfurt, Germany) |
| Vercel | hosting and all server-side processing (payments, emails, ticket links, administration, place search) | requests, IP addresses and the data the server handles | United States (server processing); content delivered from nearby locations |
| Stripe | card payments (Stripe Checkout), Organizer Stripe accounts and payouts, refunds, disputes | buyer email, amount, card data entered directly at Stripe, Organizer identity and bank details (Stripe onboarding) | Stripe processes payment data under its own privacy notice; for parts of this processing Stripe acts as an independent controller |
| Resend | transactional emails | recipient email, name, Event title, ticket or payment link | European Union (Ireland) |
| Upstash | rate limiting | IP address or user ID used as a counter key | — |
| Sentry (Functional Software, Inc.) | error monitoring for web, server and apps | scrubbed error reports, internal user ID, device and browser data; no names, emails, request contents or session recordings | United States |
| Photon (komoot) | place and address search when you pick a place for an Event | the search text or map point, sent from our server — not your IP address | — |
| CARTO | map tiles on the website | your IP address and the map area you view | — |
| Apple Maps (iOS app), Google Maps (Android app) | maps in the apps and looking up the place of a point you tap on the map | IP address, device data, map area, the tapped point | Apple, Google |
| Expo; Apple Push Notification service; Google Firebase Cloud Messaging; your browser's push service | delivering push notifications | push token or endpoint, notification title and text | — |
| Apple, Google | sign-in, if you choose it | your sign-in identity | Apple and Google act as independent controllers |
4.2 We use no third-party analytics, advertising or tracking services and no session recording. Usage analytics are stored in our own database.
4.3 Device location. The website does not use your device location. The Unmapped app asks for location permission only when you tap "My location" on the map; it then takes one location reading, uses it on your device to centre the map, and does not store it or send it to us. When you tap a point on the map to create an Event there, your phone's map service (Apple on iOS, Google on Android) looks up the place name for that point.
4.4 Organizers receive attendee data (section 5). Authorities receive data where we are legally required to provide it. We do not sell personal data.
5. Data shared with Organizers; seller information shown to buyers
5.1 When you register for an Event or buy a ticket, the Organizer (and Unmapped administrators) can see your name (Members: profile name and username), your registration status, your answers to their questions, your payment, ticket and check-in status, and — for Guests — your email address and, if the Event's form asks for it, your mobile number; for a paid Guest order also the email address the ticket was sent to. The Organizer uses this data as an independent controller to run their Event and is responsible for using it lawfully.
5.2 If you organize Paid Events, buyers see your declared seller status before paying and — if you sell as a business — your business's legal name and address and, where given, registration number and VAT ID. Each order keeps the seller information that applied when it was placed.
6. International transfers
Some providers process data outside the European Economic Area, in particular in the United States (server processing at Vercel, error monitoring at Sentry). Such transfers take place only on the basis of safeguards recognised by the GDPR — an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses. You can ask us for more information at unmapped.network@gmail.com.
7. Retention
We keep personal data only as long as needed for the purposes above, then delete or anonymise it.
| Data | Retention |
|---|---|
| Account and profile | while your account exists; deleted or de-identified when your account is deleted (section 8) |
| Content, chats, Events, projects | while active; on account deletion your content is replaced or removed and your name is no longer shown |
| Event registrations and Guest data | 24 months after the Event, then Guest registrations are deleted and the answers of Member registrations removed — unless longer retention is needed for accounting, an open refund or dispute, legal claims or security |
| Orders, tickets, refunds, check-in records, payment metadata, platform-fee receipts | 7 years from the end of the financial year in which they were recorded (Estonian Accounting Act), also after account deletion and limited to what is required |
| Guest ticket and payment-link tokens | stored only as a hash, with the order |
| Acceptance records | as long as needed to prove acceptance; after account deletion no longer linked to your account |
| Organizer seller declaration | while your account exists; the copy on each order and receipt is kept with it |
| Reports and moderation records | as long as needed for safety, our legal obligations and legal claims |
| Payment-webhook records | 90 days, except records of payment disputes and failed processing needed to investigate them |
| Raw internal analytics events | up to 90 days; afterwards only daily totals without personal data; deleted with your account |
| Read in-app notifications | up to 90 days; all deleted with your account |
| Rate-limit counters | minutes to hours |
| Push tokens | until you turn notifications off, sign out on that device or delete your account |
| Server and error logs at our providers | for limited periods set by those providers |
| Backups | our database provider keeps backups for a limited period for disaster recovery; deleted data disappears from backups when they expire |
8. Deleting your account
8.1 Request deletion in Settings → Delete Account (app and web) or by emailing unmapped.network@gmail.com. We review the request and process it without undue delay, within the time limits of the GDPR (Article 12(3)).
8.2 On approval, your profile is de-identified (name, username, email, profile and cover photo, profile details, roles and terms flags removed); your messages, posts and comments are replaced with a placeholder and their images removed; your profile photos, country visits, travel plans and the trips you created, your Organizer seller declaration, likes, saves, connections, blocks, notifications, push tokens and internal analytics are deleted; your own uploaded files are deleted from storage, except images still shown by Events, projects or communities that remain on the Platform; and your sign-in account is deleted. If you still organize an upcoming Paid Event with sold tickets, the sign-in account is deleted once that Event has ended or been cancelled; until then the account stays blocked and de-identified.
8.3 Kept after deletion, limited to what is needed and no longer linked to you where possible: orders, tickets, refunds and platform-fee receipts required for accounting (with the email address of the order and the seller information that applied); records of the legal terms you accepted; Events, projects and communities you created, because other people's registrations and history depend on them (your name is no longer shown); reports and moderation records; and records needed for legal claims, fraud prevention or security.
8.4 Deleting your account does not cancel tickets you bought.
8.5 Guests can request access to or deletion of their data at unmapped.network@gmail.com.
9. Your rights
You have the right of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18), data portability (20), to object to processing based on legitimate interests (21), and to withdraw consent at any time without affecting earlier processing (7(3)). Contact unmapped.network@gmail.com; we answer within one month, which can be extended by two months where the GDPR permits. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the data-protection authority in your country of residence.
10. Security and data breaches
We use appropriate technical and organisational measures, including encryption in transit, access controls and row-level security in our database, server-only handling of payment and administrative keys, scrubbing of error reports, rate limiting, and storing ticket and payment-link tokens only as hashes. No system is completely secure. If a personal data breach occurs, we notify the supervisory authority within 72 hours where required (Article 33 GDPR) and the people affected without undue delay where the breach is likely to result in a high risk to them (Article 34 GDPR).
11. Cookies and similar technologies
We use only what is strictly necessary for signing in and for the security of the Platform (for example session tokens in browser storage), plus small on-device preferences. We use no analytics, advertising or tracking cookies and no session recording. Map tiles on the website are loaded from CARTO (section 4).
12. Children
The Platform is for people aged 18 and over, including Guests. If we learn that someone under 18 has an account or registered as a Guest, we delete their data except where we must keep it.
13. Automated decisions
We make no decisions based solely on automated processing that produce legal or similarly significant effects (Article 22 GDPR). Spam and abuse filters may flag content for human review.
14. Changes
We update this policy when our processing changes and tell Members about material changes. Where we ask you to accept a new version, we record it as described in section 2. Previous version: Privacy Policy of 7 September 2026.