Privacy

This page says what personal information the site handles and why. minexmaps.com is run by Exploration Insider Ltd.

What we collect

• Contact form: your name, email, company and message, used only to reply to you.
• Client accounts: your email and password (stored hashed), used to sign you in to your maps.
• Sign in with Google, if you choose it: Google tells us your name, email address and profile picture, and that your Google account is linked to your MinexMaps account. We keep no Google password or access tokens, and you can unlink Google on your profile page.
• Passkeys, if you add one: we store the passkey's public key and its name. Your fingerprint or face never leaves your device.
• Web server logs: the full IP address, the page or map file requested, the linking site and the browser type, kept for security and troubleshooting. They are rotated by size (usually a few days to a few weeks of traffic) and never kept longer than 90 days. For security, each request (the IP address, its approximate place, the page asked for with any link code removed, and the browser type) is also kept for 90 days where only our administrators can see it.
• Map views: when a client portal or map is opened we record which one, when, how much of the map was viewed, the device type (phone, tablet or desktop), the country, and a shortened IP address (the last part removed). For signed-in users we record the account; for everyone else we keep only a daily code that changes each day, so we do not follow anyone from day to day. No cookie is used for this. These records are shown only to MinexMaps staff and, where agreed, to the client who owns the map, and are deleted after 13 months.
• Access and security log: when a map, portal, share link or saved-view link is opened we also record the full IP address, an approximate location worked out from it (country, region and city, from an offline database; never your exact position), the browser, operating system and device type, the site that linked to it, and which link was used. This is used for security and to audit who opened a shared link. Only MinexMaps administrators see it (not our clients), and it is deleted after 90 days.
• Who opened a client's maps and what they did in them: when a client's people sign in to their map portal with its shared password, we ask for their name and work email and confirm the email with a one-time code. We then record what each person (and each signed-in account) does: signing in, the portal and maps opened and in which viewer, questions asked to the map assistant, and actions in the map viewers such as turning layers on or off, identify clicks, measuring, 3D, prints and share links (the names of the layers and tools only, never what the map data says), with the full IP address and browser type. This is for the map owner's security and their audit of who saw their maps. MinexMaps administrators see it; a map owner's administrators see only who opened their own share links (their own team's accounts and the people named on their own portal, never an IP address). It is deleted after 90 days.
• Payments: handled by Stripe; we never see or store card numbers.
• AI map assistant: the question, the map's layer list and the answer, with its cost, kept for billing and quality.
• Help assistant ("Ask the help", for team administrators): your question, the answer, the sections it cites, the account that asked and the cost. Questions are sent to Anthropic to be answered, together with our help guides only (never your maps, team or other data). Only MinexMaps administrators read them, to improve the help, and they are deleted after 90 days.
• Error reports (Sentry): technical details of a failure, sent without personal data by default.
• Website analytics and session replay (PostHog, EU cloud), on the public pages only (home, pricing, about, tools, help, contact and the demo map's start page), and only when you are not signed in: the pages you view, the site that sent you, the buttons and links you click, your browser, device type and screen size, your IP address and the approximate location PostHog works out from it (country and city), and a recording of the page as you scroll and click. Everything you type is masked and the contact form is left out of recordings entirely, so your name, email and message are never recorded. PostHog keeps a random visitor id and a session id in your browser's local storage (no cookie); no profile is built about you. Never on client portals, maps, the free map editor, account pages or anywhere after you sign in. If your browser sends Do Not Track or Global Privacy Control, nothing is collected or stored.
• Terms acceptance: which version of the terms you accepted, when, a shortened IP address and your browser type. When a map admin releases a map (goes live), the same is kept with the map and the wording they confirmed.

What we do not do

We do not sell or share personal information, and the site sets no advertising cookies. Cookies are used only to keep you signed in, protect forms, and remember light or dark mode.

Services we use (sub-processors)

Hosting (Hetzner, Finland), DNS, security and form spam protection (Cloudflare), email delivery (Postmark), sign-in with Google (Google), error reports (Sentry), website analytics and session replay of the public pages (PostHog, EU cloud), payments (Stripe) and the AI map and help assistants (Anthropic). Some of them are in the United States, so your information may be processed outside Canada and the EU, where foreign authorities may be able to request it. The full list, with what each does, is below; we give 30 days' notice of a new one.

Why we may use it (legal bases)

In Canada we follow PIPEDA, and Quebec's Law 25 for people in Quebec. For people in the EU (our servers are in Finland), we rely on: performing our contract with you (accounts, maps, billing), legitimate interests (security logs, map view records, preventing abuse) and your consent where we ask for it (website analytics and session replay of the public pages, which in the EU/EEA, the UK, Switzerland and Quebec start only after you accept them on our banner). For the maps our clients publish, the client decides what is on them; we process that data for them.

How long we keep it

Map view records 13 months; the access and security log (full IP address and approximate location) 90 days; the record of who opened a client's maps and what they did (name, work email, actions, full IP address) 90 days; web server logs (full IP address) at most 90 days, usually much less; accounts while active; client maps until 12 months after a subscription ends (then deleted with notice); backups roll over within days; website analytics and session recordings of the public pages for PostHog's standard retention period.

Opting out of analytics and session recording

On our public pages (home, pricing, about, tools, help, contact, the demo's start page) we use PostHog to count visits and record how pages are used, with anything you type masked; our portals and maps never use it. In the EU/EEA, the UK, Switzerland and Quebec we ask first with a banner, and nothing starts or is stored until you accept. To opt out:

• This browser: press Turn off analytics below. We stop immediately and remember your choice on this browser. Turn analytics back on undoes it.
• Every site: turn on Do Not Track or Global Privacy Control in your browser. We honour both and never start analytics when either is on.
• Delete what was collected: write to us through the contact page and we will delete your visits and recordings from PostHog.

Your choices

To see, correct or delete information we hold about you, or to withdraw a consent, write to our privacy officer (Steven Siemieniuk, Exploration Insider Ltd.) through the contact page. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your EU data protection authority.

Cookies are listed on the cookies page.

Who we are