Privacy Policy

1. Who is responsible for your data

The person responsible for deciding how your personal data is used (the "Data Fiduciary" under India's Digital Personal Data Protection Act 2023, and the "data controller" under the Nigeria Data Protection Act 2023) is:

Praful Kumar, trading as Social Mapia
Ahmedabad, Gujarat, India
Email: info@socialmapia.app

Grievance Officer (India — IT Rules 2021 and data-protection complaints): Praful Kumar, Founder · info@socialmapia.app · Ahmedabad, Gujarat, India. We acknowledge complaints within 24 hours and resolve them within 7 days (see section 12).

Data Protection contact for Nigeria: the Grievance Officer above — info@socialmapia.app.

In this policy "we", "us" and "Social Mapia" mean the person above. "You" means anyone who visits the website or uses the app.

2. What we collect

a) Information you give us

• Account details: name, username, email address, password (stored only as a one-way scrambled code we cannot read) — required to create an account by email.
• Phone number — if you sign in with phone, verified by a one-time code (OTP) sent through Google Firebase.
• Google account details: name, email, profile photo, Google account ID — if you choose "Sign in with Google". We do not get your Google password or contacts.
• Profile: photo, cover photo, bio, city, social-media links, website, WhatsApp number. For creators and business pages this is public.
• Pins: place, photos, video reels, captions, #tags, offers, event dates. Creator pins are public; a member's private pins (up to 100) are private to them.
• Moments: your "been there" photos and captions on a place — shown publicly on that place's page.
• Business information: business name, logo, photos, address, phone, WhatsApp, opening hours, offers, and the details you give us to prove you own or manage the business. Business page details are public; proof-of-ownership details are seen only by us.
• Saves, Plans and visit dates, follows (Radar), collections — private to you (a creator you follow can see you in their list of followers).
• Reports, blocks and support messages, including any screenshot you attach — used to keep the platform safe and answer you.
• Agreement record: the date and time you agreed to our Terms and this policy and confirmed you are 18+.

b) Information collected automatically

• IP address when you sign up, sign in or send certain forms, plus the action and time ("security log") — to stop spam, fake accounts and attacks, and to meet legal record-keeping duties.
• Usage events: views, saves, direction taps, reel plays, shares, offer reveals, searches you type, the page you came from (e.g. "Instagram" or a creator's link), and whether you use the app or website. Creators and businesses only ever see totals, never who did what.
• What you do while signed in: we use what you save, plan, watch and search to suggest places you may like. This is part of your account, so it works even if your browser sends a “Do Not Track” signal. These records are private, never shown to anyone, kept for 90 days in raw form, and deleted with your account. Write to us any time to have them cleared.
• Device and browser information: browser type, operating system, app version, screen type.
• Server logs kept by our hosting provider (IP address, page requested, time, browser) — kept for a limited time, normally up to 30 days, for security and troubleshooting.

Analytics, in short. To run and improve the service we record the kind of device you use (app or website, phone model, operating system), the app version and your approximate city and country — not your precise location and not your IP address. We also keep anonymous usage and error logs (which screens are opened, for how long, and what went wrong) that are not linked to your account. These anonymous logs are kept for 90 days.

c) Information from others

• Other users may mention or tag a place you manage, or report your content or account.
• Google Places provides place names, addresses and map positions when a pin is added.
• Sign-in providers (Google, Firebase) confirm your identity when you choose them.

We do not collect: your contacts, your messages in other apps, payment card details, government ID numbers (unless you choose to send one to prove you own a business), or health, religious, biometric or financial data.

d) Smart features (AI) and your taste

Some features use artificial intelligence to read text, short video clips and place details and to turn them into short descriptions, search results, summaries and translations. They never decide anything about you that has legal effect, and nothing an AI writes is published on a pin or place page without a person approving it.

• Anthropic (the Claude service) receives the text and a few still frames of a clip, the words spoken in it, place names and addresses, and the words you type in search, so it can write descriptions, translations and answers. We do not send your name, email, phone number or account ID.
• Sarvam receives the audio of a voice search only if you are signed in and your browser cannot listen by itself. We do not store the audio.
• Google provides public details about places (such as opening hours and phone numbers). That is information about a place, not about you.
• Browser speech recognition: when you tap the microphone, your browser or phone maker's own speech service may listen to you. That service has its own privacy policy.

Your taste. If you are signed in we keep one private profile of what you seem to like (kinds of places, areas, creators, your city and tags). It is built from what you pick when you join and from what you save, plan, follow, open, skip and search for, and the older it gets the less it counts. It can put places you are likely to enjoy first in the lists and change the order of search results a little; it never hides a place and is never shown to anyone else, sold or shared. You can see it, reset it, or switch it off at any time in Settings → Your taste: resetting forgets what it had learned and ignores everything you did before, and turning it off stops it being used or built and deletes it.

Search text. What you type in search is kept with your account for 90 days to improve results and then deleted. After that only daily counts of search words remain, with no account or person attached. Weekly trend reports use only such counts.

3. Why we use your data, and our legal basis

We use your data to create and run your account, show public creator/business content, send service emails and notifications, run "Near me", show creators and businesses their totals, keep the platform safe and enforce our Terms, respond to lawful government and court orders, and (only with your consent) remember non-essential cookies. In India our basis is your consent or a legitimate use permitted by the DPDP Act; in Nigeria it is your consent or our contract with you, or a legitimate interest where the law allows it (you can always object — section 9).

4. Your location

• We use your device's precise location only when you tap "Near me" (or a similar "around me" button) and only after your phone or browser asks your permission. You can say no and still use Social Mapia by choosing a city.
• Your coordinates are sent to our server for that one request, to find places near you, and are not saved to your account. They may sit in our server's access logs for up to 30 days before being overwritten, like any other page request.
• We remember the city you pick in a cookie called sm_city, kept for 1 year, so the app opens in the right place.
• Pin and Moment locations are places, not your personal location. They show where a place is, not where you were when you posted.
• In the Android app, we show a short explanation before asking for location permission. We never collect location in the background.

5. Who we share data with

We do not sell or rent your personal data. We do not show ads and do not share data with advertisers or data brokers.

We use these service providers ("processors") to run Social Mapia. They may only use your data to provide their service to us.

• Hostinger — server and database for the website, app API and uploaded photos, on a Hostinger VPS located in India (Mumbai).
• Bunny.net (BunnyWay d.o.o., a company based in the EU/Slovenia) — stores, processes and streams video reels, over a worldwide delivery network.
• Google Firebase Authentication (Google LLC) — sends and checks phone sign-in codes. Phone number, Firebase user ID, device/IP data needed for anti-abuse. USA and other Google locations.
• Google Sign-In (Google LLC) — lets you sign in with Google. Name, email, profile photo, Google ID. USA and other Google locations.
• Google Maps Platform / Places (Google LLC) — place search, addresses, directions links. USA and other Google locations.
• Map tiles: OpenFreeMap and OpenStreetMap — draw the map pictures; sees your IP address and the map area you view.
• Resend — sends our emails. Your email address, name, email content. USA.
• Dropbox — daily backups of the database and uploads, overwritten after 14 days, stored with our backup provider.
• Google Fonts, cdnjs, unpkg — deliver fonts and code libraries to your browser; they can see your IP address and browser details.

We may also share data: with other users, as you choose (public content, offers, business details); when the law requires it — for example a valid court order or a lawful request from an authorised Indian or Nigerian government agency; to protect people — to prevent fraud, harm or a threat to someone's safety; and if Social Mapia is sold or becomes a company — your data would move to the new owner, who must follow this policy, and we will tell you first.

When you tap Directions, Watch on Instagram/YouTube, WhatsApp, Call or a social link, you leave Social Mapia and that service's own privacy policy applies.

6. Cookies and similar storage

We use a small number of cookies. We do not use advertising or cross-site tracking cookies.

smapia_sess	Strictly necessary — keeps you signed in and protects forms. Until you sign out or close the browser.
sm_city	Necessary / preference — remembers the city you chose. 1 year.
sm_desk, sm_full	Preference — remembers whether you prefer the phone-style view or the full website on a computer. 1 year / until the browser closes.
sm_visit	Analytics (needs your OK) — makes sure one visit is counted once. 30 minutes.
sm_sid	Analytics (needs your OK) — a random visitor number so views and saves are counted once. 1 year.
sm_ft	Analytics / attribution (needs your OK) — remembers which creator's link first brought you, so we can credit them. 30 days.

Your browser or app also keeps a few settings on your device only (for example your phone country code, reel filters, and whether you've seen a tip). These never leave your device.

Your choice: on your first visit as a guest, a small notice lets you choose OK (essential + analytics cookies) or Only essential. Choosing "Only essential" stops sm_sid, sm_ft and sm_visit from being set on your browser, and stops us recording where that visit came from. You can change your mind any time by clearing your cookies.

7. International transfers

Social Mapia is run from India, and our providers are in India, the EU and the USA (see section 5).

• If you are in Nigeria: your data is transferred out of Nigeria to India and the other countries listed above. We do this because it is necessary to provide the service you signed up for (NDPA s.43(1)(b)), and we rely on our providers' data-protection terms and security measures. These countries may not have been found by the Nigeria Data Protection Commission to give the same level of protection as Nigeria, which carries some risk (for example, foreign authorities may be able to request data under their own laws). Where the law requires your consent for a transfer, we will ask for it separately.
• If you are in India: the DPDP Act allows transfers abroad except to countries the Indian Government restricts. We will stop using any provider in a restricted country.

8. How long we keep data

Account, profile, pins, Moments, saves, follows	While your account is open. We don't close or delete an account just because it's been inactive — it's your call.
Pins you delete	Hidden from everyone at once. We don't yet auto-erase a deleted pin on a fixed schedule — it stays hidden (so it can be restored if deleted by mistake) until you ask us to erase it for good at info@socialmapia.app.
After you delete your account	Hidden at once. You have 30 days to change your mind by signing back in. On day 30 your account and content are permanently erased, including photos and videos on our servers and on Bunny.net.
Legal hold after deletion	Indian law (IT Rules 2021, Rule 3(1)(h)) requires us to keep basic registration details (name, username, email/phone, sign-up date, security log) for 180 days after an account is closed, in locked storage, only for investigations or legal requests. Content removed for breaking the law or our rules is preserved for 180 days for the same reason (Rule 3(1)(g)).
Phone sign-in record at Firebase	Today, deleting your account does not yet automatically delete your phone-sign-in record at Google Firebase — this is on our list to fix. Until it is, email info@socialmapia.app and we will delete it by hand within 30 days of your request.
Security log (IP addresses) and usage events	We don't yet run a scheduled clean-up of these; they are deleted when your account is deleted (see "Legal hold" above) or sooner on request.
Anonymous usage and error logs	Which screens were opened, for how long, app version, phone model and approximate city/country, and error reports. Not linked to your account and without your IP address. Deleted automatically after 90 days.
Support messages	Kept to answer you and for safety/legal reasons; your name is unlinked from a ticket if you delete your account.
Claimed businesses	If you delete your account, the business page stays (it describes a real place) but is unlinked from you and goes back to Social Mapia. Your proof-of-ownership documents are deleted.
Backups	Overwritten after 14 days.
Server logs	Kept for a limited time, normally up to 30 days.

9. Your rights

Wherever you live, you can:

1. Access — get a summary of your data and how we use it, and a copy.
2. Correct and update — most details can be edited in Edit profile and Settings; ask us for the rest.
3. Delete — delete your account yourself (Settings → Delete my account) or ask us to delete specific data.
4. Withdraw consent — for example turn off emails, Near me, or analytics cookies. This doesn't affect what happened before.
5. Complain — to our Grievance Officer first (section 12), and then to the regulator.

Extra rights in India (DPDP Act 2023): nominate a person to exercise your rights if you die or become unable to (s.14); get a list of the parties we shared your data with.

Extra rights in Nigeria (NDPA 2023): object to processing based on legitimate interest; ask us to restrict processing; receive your data in a commonly used, machine-readable format (data portability); not be subject to decisions made only by automated means that significantly affect you (we don't make any).

How to ask: email info@socialmapia.app from the email on your account (or use Help & support while signed in). We may ask you to confirm it's you. We reply as soon as we can, and in any case within 30 days (the law allows up to 90 days in India). Requests are free.

Regulators: India — the Data Protection Board of India (set up under the DPDP Act 2023), after you have used our grievance process. Nigeria — the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.

10. Security

We use HTTPS everywhere, scrambled (hashed) passwords and reset tokens, limits on repeated sign-in attempts, key-only server access, separate admin roles, and daily backups. Only the founder can access personal data, and only when needed.

No system is perfect. If a breach affects your data, we will tell you without undue delay, explain what happened and what you can do, and notify the Nigeria Data Protection Commission within 72 hours where required (NDPA s.40), and the Data Protection Board of India as the DPDP Rules require.

Please use a strong password you don't use elsewhere, and keep your phone/email secure.

11. Children

Social Mapia is only for people 18 and over. We do not knowingly collect data from anyone under 18. Every sign-up asks you to confirm you are 18+. If we learn an account belongs to someone under 18 we will close it and delete its data. If you think a child is using Social Mapia, tell us at info@socialmapia.app.

12. Complaints and Grievance Officer

If you have a complaint about your data, content on Social Mapia, or how we treated you:

1. Write to info@socialmapia.app or use Help & support (choose "A pin, profile or offer" or "My account").
2. We acknowledge within 24 hours and resolve within 7 days.
3. Complaints that content is unlawful (for example obscene, defamatory, invading privacy, impersonation) are acted on within 36 hours. Complaints about intimate images shared without consent, nudity or sexual content involving you are acted on within 2 hours of receipt.
4. If you are not satisfied with our decision in India, you can appeal to the Grievance Appellate Committee at gac.gov.in within 30 days, or complain to the Data Protection Board of India. In Nigeria, you can complain to the NDPC.

13. Changes to this policy

We will update the date at the top when we change this policy. For important changes (new kinds of data, new purposes, new countries) we will tell signed-in members by notification or email before the change applies and, where the law requires, ask for your consent again.

14. Contact

• Privacy questions and requests: info@socialmapia.app
• Complaints: info@socialmapia.app
• Everything else: info@socialmapia.app or Help & support
• Post: Praful Kumar, Social Mapia, Ahmedabad, Gujarat, India

See also our Terms of Use and Community Guidelines.