We keep what the Service needs and little else: your email, how much you use your keys, your IP address at signup to stop key farming, and a reference to your Stripe subscription. Stripe handles cards — we never see them. We don’t sell data and we don’t run ad trackers. Email us to see, fix or delete what we hold.
1.Who we are and what this covers
BananaMaps (“we”, “us”) operates bananamaps.io, the BananaMaps app, the BananaMaps API and BananaMaps Embed (the “Service”). This policy explains how we handle personal data when you visit the site, hold an account, call the API, or view or publish BananaMaps Embed. For the purposes of the GDPR, we are the controller of the data described here. You can reach us at support@bananazone.io.
Public blockchain data — wallet addresses, balances and transfers — is processed by the Service too. It is public by design and is not linked by us to any account holder. This policy is about data that relates to you.
2.Information we collect
Account data
- Your email address, whether it has been confirmed, and the time you accepted our Terms.
- Authentication data handled by Supabase Auth: a salted hash of your password (we never see the password itself), session tokens, and sign-in timestamps.
API and Embed usage
- For each API key: its name, a one-way hash of the key (we don’t store the key in clear text after showing it to you once), when it was created and last used, and counts of calls per minute and per month with timestamps.
- For each partner key: the domains you register, your display settings, and request counts per domain.
- Our servers log request metadata — endpoint, status code, response time — to meter quotas and debug problems.
Abuse-prevention data
- Your IP address when you create an account, used to enforce the per-network signup limit, and IP addresses in short-lived server logs for all requests.
- Your email domain, checked against a list of disposable-email providers before issuing a free key.
Billing data
- Your Stripe customer ID, subscription IDs, plan, billing interval, period dates and a log of billing events we received from Stripe.
- Payment is handled by Stripe. Card numbers, expiry dates and security codes go straight to Stripe and we never see or store them. Stripe’s handling of your payment data is described in Stripe’s Privacy Policy.
Support
- Emails you send us, and our replies.
What we don’t collect
- We don’t ask you to connect a wallet or sign anything, and we don’t link wallet addresses to accounts.
- We don’t run advertising trackers or sell data to data brokers.
3.How we use information
- Providing the Service — creating and securing your account, authenticating API and Embed requests, and serving data.
- Metering and billing — counting calls against your quota and rate limit, charging subscriptions, sending receipts.
- Preventing abuse — stopping key farming, scraping, credential stuffing and attacks on the Service.
- Communicating — transactional email about confirmation, password resets, payments, quota and important changes. We don’t send marketing email unless you opt in.
- Improving the Service — aggregate, non-identifying statistics such as which endpoints and chains are used most.
- Legal compliance — keeping the records tax and accounting law require, and responding to lawful requests.
4.Legal bases (GDPR)
Where the GDPR or UK GDPR applies, we rely on these bases:
- Performance of a contract — account, API, Embed and billing data needed to provide what you signed up for.
- Legitimate interests — abuse prevention, security, debugging and aggregate analytics. We balance these against your rights and keep the data minimal.
- Legal obligation — retaining billing records.
- Consent — for anything optional, such as marketing email if we ever offer it. You can withdraw consent at any time.
5.How long we keep information
- Account data — while your account exists, then deleted within 30 days of your deletion request.
- Per-request usage records — up to 90 days. Monthly totals per key are kept up to 24 months so we can answer billing questions.
- Signup IP addresses — up to 30 days. Server logs containing IP addresses — up to 30 days.
- Billing records — as long as tax and accounting law requires (typically 7 years), held by Stripe and in our billing-event log.
- Support email — up to 24 months after the thread closes.
We may keep anonymised or aggregated data, which no longer identifies you, for longer.
8.BananaMaps Embed on partner sites
When a website shows BananaMaps Embed, your browser loads the map from our servers. We receive the request’s IP address, user agent, the token being viewed and the address of the page that included the map (the referrer). We use this to serve the map, apply the partner’s plan and fair-use limits, and prevent abuse. We don’t set tracking identifiers in embedded maps, and we don’t build profiles of visitors to partner sites. The partner site’s own privacy policy governs everything else on that page.
9.Your rights under GDPR and UK GDPR
If you are in the EEA, the UK or Switzerland, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data (email us and we will correct it).
- Erase your data (“right to be forgotten”), subject to records we must keep by law.
- Restrict or object to processing based on legitimate interests.
- Port the data you gave us in a machine-readable format.
- Withdraw consent for anything based on consent.
- Complain to your local data protection authority.
To exercise any of these, email support@bananazone.io from the address on your account. We may ask you to confirm your identity. We respond within 30 days, and we never charge for a reasonable request.
10.Your California privacy rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to delete it, to correct it, to opt out of its sale or sharing, and to not be discriminated against for exercising these rights.
In the last 12 months we have collected these categories: identifiers (email address, IP address, account and key IDs), commercial information (plan and subscription history), and internet activity (API and Embed usage). We collect them from you directly and from your use of the Service. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of.
Submit a request by emailing support@bananazone.io. An authorised agent may submit a request for you with your written permission. We respond within 45 days.
11.Children
The Service is for adults. We don’t knowingly collect personal data from anyone under 18 (or under the age at which they can agree to our Terms where they live). If you believe a child has created an account, email us and we’ll delete it.
12.International transfers
Our processors run in the United States and the European Union, so your data may be processed outside the country you live in. Where data leaves the EEA or UK, we rely on the processor’s Standard Contractual Clauses, the EU–US Data Privacy Framework or another lawful mechanism.
13.Security
All traffic to the Service is encrypted in transit (TLS). API keys are stored as one-way hashes, passwords are hashed by Supabase Auth, database access is restricted by row-level security and service-role separation, and payment data never touches our servers. No system is perfectly secure, so if you find a vulnerability please tell us at support@bananazone.io. If a breach affects you, we’ll notify you as the law requires.
14.Changes to this policy
We’ll post updates here with a new “Last updated” date and, for material changes, notify you before the change takes effect by email to the address on your account or by a prominent notice on the site. Earlier versions are available on request.
15.Contact
BananaMaps · support@bananazone.io
For anything about your account, your data or this policy, write from the email on your account. Our Terms of Service and Refunds & Cancellation Policy cover the rest of the relationship.