Privacy Policy

Last updated: 17 August 2026 · Template — review with a lawyer before public launch.

What we collect

Account email; profile details you provide (name, contact email/phone, organisation info); items you post (title, description, category, photo, the location and date you set); claims and messages; and payment records (handled by Stripe — we never store card details). When you open the map we also receive an approximate, city-level location derived from your IP address by our hosting provider (Vercel), used only to choose the map’s starting view.

Why & legal basis

To operate the Service (contract): show items on the map, run search, enable claims and contact reveal, send transactional emails, and prevent abuse (legitimate interest). Photos are stripped of EXIF/GPS metadata on upload. The IP-derived approximate location is used transiently, for that single page load, to start the map somewhere useful (legitimate interest); it is never stored, never written to a cookie, and never shared. Your last map position is remembered only in your own browser (localStorage), and your precise device location is used only if you tap the locate button and grant permission — we never request it automatically.

Sharing & processors

A finder’s contact details are shared with a claimant only after the finder approves the claim or the claimant pays to unlock. We use these processors: Supabase (database/auth, EU), Stripe (payments), OpenStreetMap, Esri & OpenTopoMap (map tiles), Komoot Photon (place search), Resend (email), Vercel (hosting). We do not sell your data.

Retention

Active items expire after a retention period. We keep records as needed for the Service and legal obligations. When you delete your account we anonymise your personal data (removing name, contact, photos and precise details) while retaining minimal non-identifying records for integrity.

Your rights (GDPR)

You can access and correct your data in your account, and delete your account (which anonymises your personal data) from the account page. For other requests (e.g. data export) contact info@lostandfoundmap.com. You may also lodge a complaint with the Dutch DPA (Autoriteit Persoonsgegevens).

Cookies

We only use strictly necessary cookies: the session cookies that keep you signed in (Supabase Auth) and a session-scoped display preference. We do not use advertising or cross-site tracking cookies. Payments run on Stripe’s own hosted checkout pages. Our traffic analytics (Vercel Analytics) are cookieless and anonymous. Because nothing beyond essential cookies is set, no consent banner is required — if that ever changes, we will ask for consent first.