Privacy Policy
Last updated: 14 July 2026
BossMaps ("we", "us") explains in this policy what personal data we collect through bossmaps.co.uk (the "Service"), why, and what rights you have over it. We act as the data controller for the personal data described below.
1. Data we collect
| Category | What | Why |
|---|---|---|
| Account | First/last name, email address, password (stored as a bcrypt hash — we never see or store your plain-text password) | To create and secure your account |
| Community content | Shop submissions, suggested edits, star ratings, written reviews, shop reports you file | To operate the community map and moderate content |
| Saved shops | Shops you favourite, and their coordinates | To show your saved list and to alert you if a new community shop opens near one |
| Push notifications | Your browser's push subscription details (only if you opt in) | To notify you about your submissions and edit suggestions, new reviews or nearby new shops for shops you've saved, and shop verification events (including billing/payment status) |
| Payment & subscription | Shop name/address you're verifying, subscription status and renewal dates. We never see or store your card details — Stripe handles payment directly | To provide and bill the Verified badge subscription |
| Usage analytics | Shop popup views and link clicks (impression/navigate/website/order-platform clicks), page views, and technical error reports | To show verified shop owners how their listing performs, and to find and fix bugs |
We deliberately do not collect or store your live location — location search happens in your browser and is only sent to our geocoding providers (see below) to resolve a search, never stored against your account.
2. Cookies & similar technologies
BossMaps itself does not set marketing or advertising cookies. Our error/performance monitoring tool (Microsoft Application Insights) is configured in cookieless mode — it does not set a persistent cookie in your browser. We use your browser's localStorage (not a cookie) to keep you signed in and remember a few interface preferences (e.g. whether you've dismissed a banner); this data stays on your device and is never sent to Microsoft or any third party.
3. Who we share data with
We use the following processors to run the Service. None of them are permitted to use your data for their own purposes.
| Processor | Purpose |
|---|---|
| Microsoft Azure (hosting, database, cache, email, monitoring) | Hosts the app, database, and sends transactional emails on our behalf. Data is hosted in the UK (and, for the database, Germany — within the EEA) |
| Stripe | Processes Verified badge subscription payments. We never receive or store your card details |
| Geoapify & Foursquare | Provide location search, geocoding, routing and third-party shop listings. A search query and approximate location are sent to these providers to return results |
| ImprovMX | Forwards mail sent to hello@bossmaps.co.uk — used only for our own inbox management, not for processing your submitted data |
We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.
4. Legal basis for processing (UK GDPR)
- Contract — creating your account, running your Verified subscription
- Legitimate interests — moderating community content, preventing abuse, understanding how the Service is used, and improving it
- Consent — push notifications, which you opt into and can withdraw at any time from your browser/device settings or by unsubscribing in the app
5. How long we keep data
- Account data — kept until you delete your account yourself, or ask us to do so (see Section 7)
- Reviews and moderation history — if you delete your account, your reviews and past submissions are kept but disassociated from you (shown as "Anonymous") so the map data and audit trail stay intact
- Password reset tokens — expire after 24 hours whether or not they're used
- Shop analytics events (impressions/clicks) — kept for 90 days, then automatically deleted
- Abandoned Verified-badge checkout attempts that were never completed — automatically deleted after 48 hours
6. Where your data is processed
Our infrastructure runs in Microsoft Azure's UK South region, with our database in Azure's Germany West Central region (within the European Economic Area). Some of our processors (e.g. Stripe) may process data outside the UK/EEA under their own standard contractual safeguards.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your account and personal data
- Object to or restrict certain processing
- Receive a copy of your data in a portable format
You can exercise the access and erasure rights above yourself, instantly, from within the app: sign in, tap your username to open the account menu, then choose Export My Data to download a copy of everything we hold on you, or Delete Account to permanently remove your account and personal data (some content, like reviews and past submissions, is kept but disassociated from your identity — see Section 5). For anything else — correcting data, objecting to processing, or if you'd rather we handled a request for you — email hello@bossmaps.co.uk from your account's email address. We aim to respond within 30 days. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
8. Children
BossMaps is not directed at children and we do not knowingly collect data from anyone under 16.
9. Changes to this policy
If we make material changes to this policy, we'll update the "last updated" date above. Continuing to use the Service after a change means you accept the updated policy.
10. Contact
Questions about this policy or your data: hello@bossmaps.co.uk