Privacy
Last updated: 9 October 2026
We use your photos to make your book and for nothing else. No advertising, no analytics trackers, no selling of data.
1. Who is responsible
Samarti Art Ltd., Sofia, Bulgaria (UIC 208055883), is the controller of your personal data. Full company details are on the Legal page. For anything about your data, write to office@maporiesbooks.com.
2. What we collect
| Data | What it is | Why we need it |
|---|---|---|
| Photos | The image files you upload or pick from Google Drive, and smaller copies we make for the preview. | To design, preview and print your book. |
| Photo details | What the camera wrote into each file: date and time, GPS position, camera model. | To order the trip, draw the route on the maps and name the places. |
| The book | What we derive: chosen photos, place names, chapters, titles, captions, the cover and page layouts. | This is the product. |
| Account | Your email address, and your name when Google provides it. With email sign-in: the address and a record that a code was sent. | To save your books and let you back in. |
| Guest id | A random id in a cookie when you use the app without signing in. | To keep your work between visits. |
| Order | Name, delivery address, phone number if asked by the carrier, email, what you ordered and paid. | To print and deliver the book, send order emails, and keep the accounts the law requires. |
| Payment | Handled by Stripe. We receive the result, amount and country, never your card number. | To take payment and issue refunds. |
| Technical | IP address, browser type, time of requests, error logs. | To run the service securely and stop abuse. |
| Messages | What you write to us by email. | To answer you. |
From Google Drive we can read only the files you pick in Google's own file picker, not the rest of your Drive.
Photos often show other people. Upload only photos you are allowed to use.
3. How your photos are processed, including AI
- Software reads each photo's date and GPS position, groups the trip into days and places, and drops near-duplicates.
- AI models look at your photos. Reduced-size copies, together with place names and dates, are sent through OpenRouter to AI model providers to describe what is in a photo, choose the best ones, plan chapters and write titles and captions.
- GPS coordinates, without the photo and without anything that identifies you, are looked up in map data to find place names. Part of this uses the public OpenStreetMap services.
- We do not use face recognition and do not build profiles of the people in your photos.
- No decision with legal or similar effect on you is made automatically. The result is a book design that you review before ordering.
- The AI providers process your photos and text only to answer our request. We use them under business terms that do not allow them to train their models on your content, and OpenRouter is set to route only to such providers.
4. Legal grounds
- Contract (GDPR Art. 6(1)(b)): making the book you asked for, your account, your order and delivery.
- Legal obligation (Art. 6(1)(c)): invoices and accounting records.
- Legitimate interest (Art. 6(1)(f)): keeping the service secure, preventing abuse, fixing errors, and measuring how the service performs in aggregate.
We send only emails about your account and your orders. There is no newsletter.
5. Who receives your data
We use these companies to run the service. Each gets only what its task needs.
| Company | Task | What it receives |
|---|---|---|
| Google Cloud | Hosting, file storage, sign-in (Firebase Authentication) | Everything stored in the service; your Google sign-in. |
| Neon | Database | Account, book and order records. Not the photo files. |
| OpenRouter | Access to AI models that describe photos, choose them and write captions | Reduced-size photos, place names, dates. OpenRouter passes them to the company whose model does the work. Which models we use changes over time. |
| OpenStreetMap services | Place names from coordinates | GPS coordinates only. |
| Stripe | Payment | Your payment details, email, amount, order reference. |
| Gelato | Printing and delivery, with its print houses and carriers | The print files of your book, your name, delivery address, email and phone. |
| Resend | Sending email | Your email address and the content of our emails to you, including sign-in codes. |
| Cloudflare | Domain and network services | Technical connection data. |
| GitHub Pages | Hosts this website (not the app) | Technical connection data. |
We also share data when the law requires it, for example with tax authorities, and with our accountant for the order records.
Some of these companies are in the United States or process data there. Transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. The app, your photos and your books are stored in Google Cloud's Belgium region. The database runs in Neon's Frankfurt region. Both are in the EU.
6. How long we keep it
| Data | Kept for |
|---|---|
| Guest work | Deleted automatically 30 days after your last visit, photos included. |
| Account, photos, books | Until you delete the book or ask us to delete the account. We do not delete inactive accounts on our own. |
| Ordered books | The print files are kept for two years after delivery, the period of the legal guarantee, so we can reprint if something goes wrong. Then they are deleted. |
| Order and invoice records | Ten years after the end of the year of the order, as Bulgarian accounting and VAT law requires. |
| Sign-in codes | One day. |
| Server logs | 30 days. |
| AI usage records | A record of each AI call is kept for cost accounting after a book or account is deleted: the model, the cost, and the text sent and returned (place names, dates, captions). Never the photos. |
7. Cookies
- The app sets one cookie,
mapories_uid, which holds your guest or account id for up to one year. It is necessary for the service to work, so there is no consent banner. - The app also keeps small preferences in your browser's storage, such as the last view you used. They never leave your browser.
- We use no analytics, advertising or social media trackers.
- This website (the landing page) sets no cookies.
- When you sign in with Google or pay with Stripe, you are on their pages and their own cookies apply.
8. Your rights
Under the GDPR you can:
- get a copy of the data we hold about you;
- have wrong data corrected;
- have your data deleted, including your account, photos and books;
- ask us to restrict processing, or object to processing based on legitimate interest;
- receive your data in a portable form.
Write to office@maporiesbooks.com from the email address of your account. We answer within one month. It is free.
Two limits: we must keep order and invoice records for the period the law sets, even after deleting your account; and an account cannot be deleted while one of its books is at the printer or in the post.
You can also complain to the Bulgarian Commission for Personal Data Protection, cpdp.bg, or to the data protection authority of the country where you live.
9. Security
Connections are encrypted. Photos are stored in private storage and are reachable only through your session. Access on our side is limited to the people who run the service. If a breach affects your data, we tell you and the authority as the law requires.
10. Children
The service is for adults. We do not knowingly create accounts for anyone under 16. Photos of your own children in your book are your decision as a parent.
11. Changes
When we change how data is handled, we update this page and its date. If the change is significant, account holders hear about it by email first.