See Section 9 for "California Notice At Collection"
Mapbox ensures that the transfer of personal data offers an adequate level of protection and security, for instance by entering into the appropriate agreements that continuously ensure the same level of protective measures as set forth in applicable data protection laws and regulations and, if required, standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission (Art. 46 GDPR) or other applicable regulators or legislators.
ADDITIONAL INFORMATION FOR INDIVIDUALS OUTSIDE THE UNITED STATES
Some countries require that companies only process personal data if they have a “legal basis” (or justifiable need) to process personal data. To the extent those laws apply, Mapbox’s legal bases for processing personal data are as follows:
Devices have settings to delete stored cookies and most browsers have the option to decline cookies. However, certain parts of Mapbox’s website (including pages that require login) will not be accessible if Mapbox cookies (first party cookies) are not accepted. In contrast, third-party cookies set by third parties for marketing and analytics purposes on Mapbox’s website can be disabled, in principle, without affecting access. For information about cookies on Mapbox’s website and how to change browser cookie settings, please visit the Mapbox website here.
To exercise your right to deletion of personal data, please complete the form here. For any other rights, please contact Mapbox at firstname.lastname@example.org. In your email include name, and request or question. To protect privacy, Mapbox will take steps to verify the identity of the requestor before fulfilling the request. Mapbox will process such requests in accordance with applicable laws. Although we encourage you to contact us if you have questions or complaints, you also have the right to lodge a complaint in the EU and UK with the appropriate supervisory authority in your jurisdiction. In some cases, these rights may be subject to exceptions, as permitted by applicable law.
Personal Data Mapbox May Receive
How Mapbox Uses Personal Data
To Whom Mapbox May Disclose Personal Data
Last Updated: December 2022
No. Mapbox is an API and SDK platform company. Mapbox customer end user applications send structured requests to Mapbox and then receive (from Mapbox) the requested information (e.g., a specific map tile or route from A to B).
No. However, some customers do choose to upload map data to Mapbox for distribution to their end users. Customers may elect to use Mapbox Upload APIs (currently, Uploads, Tilesets and Datasets), although customers may also technically restrict their developers from using the Upload APIs through token scoping.
Data Processor. Mapbox’s Data Processing Addendum (“DPA”) is incorporated into any applicable agreement with its customers and scoped broadly enough to encompass many global privacy laws. Mapbox's goal is to provide transparency about the data entrusted to it, how such data is used, and the technical and organizational measures designed to protect such data.
Yes. Mapbox is SOC2 Type 2 certified and its summary SOC3 report is available for customer review. Upon request and execution of an NDA, Mapbox may share a copy of its latest SOC2 report.
Mapbox takes privacy and data security very seriously and implements processes designed to operate in compliance with: VCDPA (Virginia, USA), UK-GDPR (UK), GDPR (Europe), CTDPA (Connecticut, USA), CCPA and its implementing regulations including CPRA (California, USA, and APPI (Japan), among many other important jurisdictions.
Mapbox runs a global data protection program, based on privacy by design, which includes monitoring for upcoming privacy laws and regulations to assess whether its practices may need to be adjusted to maintain compliance; product/service privacy reviews; data breach response processes; and operationalized technical and organizational measures designed to ensure the security of the personal data it receives including: security audits and SOC2 certification; encryption of IP addresses in transit and at rest; pseudonymization of personal data (where applicable); strict access control with logging; limited data retention periods.
In some jurisdictions consent from the end user may be required to collect and process location based data (e.g., Virginia and Connecticut). To the extent customer’s end users are in such locations and customer’s application is implicated by these laws, customer shall obtain end users' affirmative express consent before making available to such end users Mapbox products/services within the customer’s licensed application that collects or processes location data. Additionally, customers shall at all times allow end users to opt out of location data sharing using one of the methods described in Mapbox’s developer documentation.
Please see Mapbox DPA, Schedule B to learn what personal data may be collected and how it is used. Mapbox applies the principle of data minimization to product development and operations in an effort to ensure the least amount of personal data is collected from the outset. Regarding the limited personal dataset that Mapbox processes, it has implemented a number of technical and organization measures designed to ensure data protection, including prompt deletion of raw log files that contain IP addresses and billing IDs. For billing IDs, which need to be retained for accounting and billing purposes, Mapbox deploys regular ID rotation and 1-way hashing to minimize the ability to track user requests over time. In addition, Mapbox operates strict de-identification procedures, such as clipping traces, for telemetry events that send location data.
Transmission of information across the Internet requires the presence of IP addresses, which define where information will be sent and where such data is coming from. When end users engage with applications that access Mapbox products/services over the Internet, the end user necessarily discloses their current IP address to one or more Mapbox servers.
The United States. However, for performance purposes, Mapbox regularly caches content on its AWS CDN network located in various regions. When content is unavailable in the CDN cache or where the API service requires custom calculations, the requests are routed to the US for processing. Mapbox also utilizes the services of employees who work for Mapbox wholly-owned subsidiaries in order to support, develop and provide its products/services.
No. Mapbox’s products/services store and serve source data from an AWS primary region in the US. Data is sometimes cached and served out of various regions outside the US for performance reasons, as described in the questions/response above, but Mapbox cannot serve its data from one limited geographic region. To safeguard such transfers to the US and other regions, please see Mapbox's DPA, Schedule C, which includes the Standard Contractual Clauses released in 2021 by the European Commission.
No. Mapbox does not sell personal data or build targeted profiles with personal data processed through its products/services.
No. For customers on a monthly active user (“MAU”) billing model, Mapbox maintains counts of such MAUs for billing purposes only. Mapbox does not (and cannot) track an end user’s activity across such 30 day billing cycles.
Mapbox welcomes any further questions you may have regarding its ongoing commitment to privacy and data security. Please contact Mapbox’s privacy office at email@example.com.
Please subscribe below: