Privacy Notice

1 Who we are

Bramble makes story maps for estates, gardens and hotels: a map a visitor opens on their own phone, which plays a story when they reach a place on the grounds. This notice explains what personal data we collect, why, who else handles it, how long we keep it and what you can ask us to do about it.

We are not required to appoint a Data Protection Officer, and have not. Data protection questions go to the address above and are answered by a person, not a form.

The one distinction that matters

There are two different relationships in this notice, and confusing them is the usual way a privacy notice misleads people.

• Where we are the controller — the data we collect for our own purposes: your enquiry, the account behind a map, billing, and how the site is used. That is what this notice covers, and we decide what happens to it.
• Where we are the processor — the content an estate puts into its own map: the stories, the photographs, the people named or pictured in them. The estate decides what goes in; we only host it. If you want something in an estate's map changed or removed, the estate is the one who can decide that, and we will point you to them. Our obligations to the estate for that content are set out in Schedule 1 of the subscription terms.

2 If you enquire through this website

The contact form on bramblemaps.com collects your name, your email address, the name of your estate or property, and whatever you write in the message. The form also carries a hidden field and a timing value used only to reject automated submissions; neither is kept.

We use it to answer you, and to carry on the conversation if you want one. Our lawful basis is legitimate interests — replying to someone who has asked us a question. We will not add you to a mailing list, and we do not sell data to anyone.

The form also counts recent submissions against your IP address, held in memory for ten minutes, so that one sender cannot flood it. It is not written down and is gone when the ten minutes pass.

The message is delivered by Resend to hello@bramblemaps.com, a mailbox we operate on Google Workspace. It is not written to any database. It sits in that mailbox like any other email — see section 6 for how long.

3 If you run a Bramble map

This covers starting a free trial and holding a subscription. Our lawful basis is performance of a contract, except where noted.

When you start a trial

• Your email address, so we can send you the verification link, the two reminders before a trial ends, and anything you need to run the map.
• Your property name and the web address you choose for the map. Both are public: the web address is how visitors reach it.
• Where the property is — the map position, which is the point the map opens on. If you type an address or postcode to find it, that text is sent to Nominatim, the OpenStreetMap Foundation's lookup service, to be turned into coordinates.
• Which version of the subscription terms you accepted, and when. This is the only record that you agreed to them, so it is the one thing we are reluctant to delete; see section 6.
• The IP address the signup came from. We keep this only to detect abuse of a service that hands out live maps with no card. Lawful basis: legitimate interests. It is cleared automatically after 90 days — nothing needs to ask.

Your access code

The code you use to sign in to the portal is stored only as a cryptographic hash. We cannot read it back, recover it or tell you what it is; if it is lost we can only replace it. It is emailed to you once, in the clear, when your map is created — so a copy exists in that email and in Resend's sending records, as it does for any emailed password.

What you put into the map

Everything you upload — photographs, audio, the text of each story — is public by design. A map is meant to be opened by a stranger at a gate with no sign-in, so anything you place in one is readable by anyone who has the address. Do not put anything in a map that you would not put on a public web page. Where that content includes personal data about other people, you are the controller and we are your processor; see section 1 and Schedule 1.

Inviting someone to add a stop

The portal can generate a link that lets someone walk the grounds and add a stop from their phone. That flow is the one place in Bramble where a person's position is deliberately uploaded: it is how the stop gets its place on the map, and it is then published on the map like any other stop. It applies only to someone you have sent that link to, never to a visitor opening the map. If you send the link to a member of staff or a volunteer, tell them what it does.

Paying

Payment is taken by Stripe. Your card details go to Stripe and never reach us — we never see, hold or store a card number. Stripe holds the billing name, address and card; we see the resulting invoices, which carry your name, billing address and what you paid. Keeping those is a legal obligation under UK tax law. When we send you a payment link, it carries your email address and your map's web address so that the payment arrives attached to the right map, which means Stripe sees both before you have typed anything.

4 If you are opening a map as a visitor

You do not sign in, and we do not create an account for you.

Your location never leaves your phone

This is the part people reasonably worry about, so here is exactly how it works. When you allow location access, your browser gives your position to the page running on your phone. The page already holds the coordinates of the places on the map, and compares the two on the device. When you are close enough, it opens the story.

No request we make carries your coordinates. We never receive them and we never store them. The map asks for location so that it can react to where you are, not so that anyone can see it.

Two honest qualifications, because "we know nothing at all" would be a stronger claim than we can keep. A story belongs to a place, so when one opens because you walked into range we count that, and a run of those counts is a coarse record of which places a visitor reached — no coordinates, nothing naming you, but not nothing. And if you tap the button that centres the map on you, the map tiles your phone then asks for are the ones around you, so the tile provider can tell roughly where on the grounds you are. Neither tells us where you walked, and neither is used to build any profile of you.

What does leave your phone

• A page view, counted by Vercel Web Analytics. It records which map page was opened, the referring site, the country, your browser, operating system and device type, and any tracking tag in the address — a scan code on a poster carries one so we can tell poster scans from other arrivals. It sets no cookie and stores nothing on your phone. To count one visitor once, it derives a hash from your IP address and browser that changes every day; it cannot follow you between sites, or from one day to the next.
• Two events with no coordinates in them. One records whether location worked — allowed, refused, or unavailable — because a map that silently fails is the most common fault we have to fix. The other records whether a story was opened by walking into range or by tapping it. Both also record whether you opened the map in an ordinary browser or inside another app's built-in one, such as Facebook's or Instagram's, which is worked out from your browser's user-agent string and is the usual reason location fails. Neither event carries a position, and neither carries anything identifying you. Lawful basis: legitimate interests in knowing whether the product works in the field.
• Your IP address, unavoidably, as part of making a connection: to Vercel, who serve the page, to Geoapify, who serve the background map tiles, to Sentry, and to Google, if the estate has chosen a typeface that your browser fetches from Google Fonts. None of it is used by us to build any profile of you.
• A performance trace of the page loading, to Sentry. We currently sample every visit rather than a fraction of them, so this is not only sent when something breaks: it reports which map page was opened, your browser and device, and how long each part took. Sentry receives your IP address in the course of that connection.
• If the page hits an error, Sentry also gets a report so we can fix it, which can include a recording of the page state at the moment it broke. It is captured with all text masked and all images and media blocked, so it shows the shape of the page rather than its content. We do not record your screen at any other time.

If you are named or pictured in a map

The estate that made the map decided to put it there, and is the controller for it. Ask them first. If you cannot reach them, email us at hello@bramblemaps.com and we will pass it on and tell you we have.

5 Who else handles it

These are the providers that handle personal data for us. Each one only handles what is listed against it. All but the last two are bound by a written data processing agreement; the exceptions are noted in the table, and neither receives anything identifying a person.

Where data leaves the UK it goes to the EU or the US under the transfer terms in each provider's data processing agreement. We do not sell personal data, and we do not share it for anyone else's marketing. We would disclose it if the law required us to, and we would tell you unless we were forbidden to.

6 How long we keep it

Where a period below says automatically, a scheduled job applies it without anyone asking. The rest we do when asked or when a subscription ends, and the table says which is which rather than leaving you to assume.

7 Cookies and storage

There are three addresses, and they behave differently, so it is worth saying which is which.

bramblemaps.com — this site

Sets no cookies at all. Vercel Web Analytics is cookieless. The demo page remembers in your browser that you have seen it before, so it does not replay its introduction at you.

explore.bramblemaps.com — the maps guests open

Sets no cookies at all either, and nothing stored identifies you. The map does keep a copy of itself on your phone — the stops, their text and where they are — in your browser's local and indexed storage, so that it still works when the signal drops halfway round the grounds, which on most estates it does. That copy is the estate's map, not anything about you, it never leaves your phone, and clearing your browser data removes it.

portal.bramblemaps.com — where a map owner signs in

One cookie, bramble_portal, is set when you sign in: it keeps you signed in for 30 days, is marked HttpOnly so no script can read it, and SameSite=Lax, which stops it being sent by requests another site makes in the background, though it still travels if you follow a link to the portal from elsewhere. It carries nothing but a signed sign-in token. It is re-issued if you change your access code. Signed in to the portal, your browser also keeps a copy of your own project details in local storage so the pages load without re-fetching, along with small preferences such as which notices you have dismissed, and the site may set a short-lived flag in session storage to recover from a failed page load. None of it leaves your browser, and none of it tracks you.

There is no advertising, no tracking cookie and no third-party tracker on any of the three, so we show no cookie banner. That is deliberate. A banner would be a consent request for something we do not do, in front of a visitor standing at a gate trying to open a map.

8 Your rights

Under UK GDPR you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict what we do with it, or hand it over in a portable form. Where we rely on legitimate interests — the signup IP address, the usage counts, error reports — you can object, and we will stop unless we have a compelling reason not to, which we would have to explain.

Email hello@bramblemaps.com. It is free, and we will reply within one month. If your request concerns content inside an estate's map rather than data we hold as controller, we will tell you so and pass it to the estate — see section 1.

If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you raised it with us first, but you do not have to.

9 Changes to this notice

If we change what we collect or who handles it, we will update this page and change the version and date at the top. If a change is significant and we hold your email address because you run a map with us, we will tell you directly rather than leave you to notice.