Privacy Notice

Service

Cartova

Customer support

Support and complaints

Cartova controls the personal data processed for the service. Privacy requests can be started through the Support and Complaints page using the contact details on the payment receipt.

• Checkout and support data: email address and messages sent to us.
• Order data: order identifier, purchased city and theme, custom labels and settings, price, currency, timestamps, and download activity.
• Payment metadata: Ziina payment-intent identifiers, payment status, amount, currency, and provider events. Cartova does not receive or store full card numbers or security codes.
• Security and technical data: request time, route, device or browser information, approximate location, server logs, and short-lived hashed network identifiers used to prevent abuse. Cartova does not place advertising cookies.
• Aggregated analytics: page, referrer, country, browser, device, and operating-system data through privacy-focused Vercel Web Analytics. A visit to the non-indexed interest-confirmation page records anonymous purchase intent, without sending an email address or cart contents. Order and payment query parameters are removed before analytics events are sent.

We process data to create and fulfil the customer’s order, verify payment, deliver and recover downloads, send transactional receipts, respond to complaints and privacy requests, secure the service, prevent fraud and abuse, understand aggregate service performance, and meet accounting, tax, consumer-protection, and legal obligations.

We use consent where the law requires it and otherwise process data only where permitted for the requested transaction, compliance obligations, security, or legal claims. Cartova does not currently send promotional email or sell personal data.

Data is disclosed only as needed to providers supporting the service: Ziina for payments; Railway for the API, worker, database, cache, and object storage; Vercel for website hosting and aggregated analytics; Resend for transactional email; and OpenStreetMap-related services for map search and generation.

These providers may process data outside the customer’s country or outside the UAE. We use provider terms, access controls, and other safeguards required for lawful cross-border processing. Map providers receive search or geographic data from Cartova’s server, not the customer’s checkout email.

We retain order, payment, invoice, and related accounting records for the period required by UAE commercial and tax law and for resolving claims. Download files and order-access records are kept while needed to provide the purchased service. Transactional email records and support correspondence are kept only as long as reasonably necessary for delivery, support, security, and legal records.

Rate-limit identifiers expire automatically after their short enforcement windows. Data is deleted or anonymised when it is no longer needed, unless law or the establishment or defence of a legal claim requires continued retention.

Subject to applicable exceptions, a person may ask to be informed about processing, receive a copy of their data in a usable format, correct inaccurate data, request deletion, restrict or stop processing, object where applicable, and withdraw consent where processing relies on consent. Identity may need to be verified before a request is completed.

Start the request through Support and Complaints. A person may also complain to the competent UAE data-protection authority.

Cartova uses access controls, encrypted transport, opaque download links, signed payment webhooks, rate limits, and restricted production credentials. No internet service can promise absolute security. Cartova is not directed to children under 18 and does not knowingly collect their personal data.

Material changes will be posted here with a new effective date. Where required, we will provide additional notice or request consent.