Last updated: October 7, 2026
Odisea.ai UG (haftungsbeschränkt), Eschersheimer Landstraße 42, 60322 Frankfurt am Main, Germany, is responsible for the processing described in this policy. Contact [email protected]. Company registration and representative details are in our legal notice.
This policy covers the website, Map Maker and published web maps, and the Odisea iOS and Android mobile apps. They have different capabilities. Collection depends on the product, app version, account eligibility and features you actually use; a feature described here is not available to every user.
Map Maker processes account details and the maps, routes, documents, images, links and text you submit to create, edit, import, publish or embed content. Website billing and browser privacy choices are separate from mobile-app purchases and device permissions.
Mobile apps process information needed for exploration, tours, audio, downloads, purchases and optional location features. Voice assistance and creator uploads operate only where enabled. Browsing a published map in a mobile app does not itself upload photos or enable Map Maker authoring.
We may collect information about you in a variety of ways. The information we may collect on the Site and App includes:
Our mobile applications (iOS and Android) may request specific permissions to provide functionality. Requested permissions can differ by platform and release version. You can revoke permissions at any time through your device settings.
Purpose: To show your position on the map, discover nearby landmarks, and provide location-based features.
Data Collected: Your device's current location (latitude and longitude).
How We Use It: Location data is used to:
Storage: Location data is processed in real time for core features and may be stored only when required to deliver features you explicitly use.
Control: You can revoke location permissions at any time through your device settings. Note that some features may be limited without location access.
Website tour discovery: On the tours page, our hosting infrastructure may provide Odisea with an approximate city, region, and coordinates derived from the request's IP address. We use this coarse area only to order nearby tour suggestions; the feature does not save the raw IP address or derived area to a user profile or browser storage. Precise browser location is requested only after you select Use my location, and is processed to return nearby results. You can instead choose a city manually, and the complete tour catalog remains available without sharing location.
Map Maker uses files you select in the browser. Mobile versions with creator tools may request camera or photo-library access when you choose to add a photo; some creator tools are restricted to authorised accounts. Versions with Live Guide may request microphone access for the conversation you start. Captured or selected media, voice input and resulting text may be transmitted to the backend and the relevant processing providers to deliver that feature.
iOS and Android permissions differ by version and feature. Location permission supports nearby discovery and maps; camera, selected-photo access and microphone permission support the optional features described above. A permission prompt does not mean every account can use the corresponding feature. You may deny or revoke optional permissions in device or browser settings and continue using features that do not depend on them. Permission to access a device feature is not consent to all other processing described in this policy.
We use the information we collect to provide, maintain, and improve our services, including to:
We store uploaded content and associated account, source and upload-time information to operate the selected feature and help address rights or security complaints. A user-upload label describes the upload source; it does not establish who owns the copyright. The Terms of Service explain the permissions required to submit content and our limited service licence.
Publishing content can make selected images, covers, markers, captions, descriptions, map locations and creator profile information visible to anyone viewing the public map, tour or embed, including people without an account. Search engines or recipients may make independent copies. Unpublishing or deleting cannot recall those copies. Do not publish private or sensitive information about yourself or other people without a lawful basis.
Original files may contain metadata such as GPS coordinates and capture dates. Supported photo-import workflows may read that information for placement or organisation. Do not assume metadata is removed from every uploaded original; remove information you do not wish to share before upload. AI analysis is used where you request an enabled feature, such as interpreting an image or document.
Copyright and other content reports may contain reporter contact details, content references, supporting evidence and correspondence. We use these to investigate and communicate decisions. Relevant details may be shared with the affected uploader where necessary, but we do not automatically publish reporter contact details or disclose a user's identity to every claimant. Report concerns through our content-reporting page.
Where an organisation uses Map Maker to process personal data on behalf of others, its own controller duties and any required data-processing agreement remain separate. Uploading an image is not a waiver of the privacy rights of people shown in it.
Odisea does not use advertising or marketing cookies. Odisea's own browser storage is used only when it is necessary to provide authentication, remember an explicit language or privacy choice, or support a feature you deliberately use, such as saving a draft. Optional Mapbox storage is described below and is not enabled on marketing pages before you allow it.
odisea_lang cookie may be stored for up to one year after you explicitly select a language.odisea_mapbox_consentcookie remembers for up to six months whether you allowed Mapbox maps. It is used only to apply and remember your privacy choice.While you use a signed-in dashboard, Odisea keeps a first-party, account-linked support timeline with bounded page categories, recent interaction markers and successful workflow changes. It also includes account, billing, Map Maker and tour activity. Staff can use this history to help with support requests and diagnose service problems. It excludes dashboard DOM, replay, form text, private URLs and map content. No new analytics cookie or browser storage is used for this account activity.
With your consent, we use PostHog Cloud EU to measure public-site page views, permitted interactions, and errors with a pseudonymous identifier. Optional signed-in PostHog product analytics uses a separate choice and measures bounded dashboard and Map Maker events without dashboard DOM, form text, map content, email addresses or private IDs. PostHog may also create a masked session replay for a 20% sample of eligible public sessions. Authentication and dashboard routes are excluded from replay. Input, textarea, and editable-field text is masked; iframes, video, audio, and canvas content is blocked; request headers and bodies are not recorded.
With the same consent, we use Ahrefs Web Analytics for aggregated website analytics. Our own public map-view measurement remains separate and uses only an in-memory identifier that disappears when the page is closed and is never written to browser storage.
You can reject either analytics choice without losing website access and change your choices at any time with the persistent Cookie settingsbutton. Withdrawing public analytics clears PostHog's local analytics state, returns public pages to the cookieless visit counting described above, and reloads the page so Ahrefs is no longer loaded. Withdrawing signed-in PostHog product analytics stops that optional collection; the first-party account activity described above continues while you use the signed-in service.
The complete browser-storage inventory, including purposes, providers, and durations, is available in our Cookie Policy.
We do not share your personal information with third parties except under the circumstances described in this policy. We do not sell your personal information or share it with third parties for their own advertising purposes. Content you choose to publish is disclosed to its audience as described above; service providers also process data for the requested features.
We may share information in the following situations:
Odisea operates its backend and database on OVH infrastructure. Cloudflare R2 stores and delivers media used by supported features. These infrastructure providers process the content and technical information needed to host, secure and deliver the service. For paid Map Maker website plans, Stripe processes checkout, billing and subscription information; Odisea receives the payment status and references needed to manage access rather than full payment-card details. Mobile store purchases are described under RevenueCat below.
During our account-system transition, Supabase may process a sign-in for an existing password account that has not yet been migrated to Odisea's authentication system. New website accounts and current product data are stored by Odisea's own backend, not in Supabase. The temporary legacy authentication bridge may process:
Supabase adheres to strict privacy and security standards. For more information, you can refer to Supabase's privacy policy.
Our app uses Google Sign-In to provide a secure and convenient way to create an account and log in. When you use Google Sign-In, we may receive information from your Google account, such as your name and email address, to create your Odisea AI profile. Google's privacy policy applies to your use of this service. You can review it at https://policies.google.com/privacy.
Our Site and App use Mapbox services for map rendering and location features. Map-related requests may include location context and technical metadata required to deliver maps, geocoding, and navigation functionality.
Mapbox GL JS uses browser local storage entries whose names begin with mapbox.eventData. Mapbox states that these entries include a randomly generated identifier used for aggregate usage statistics and local telemetry metadata, and are not used for advertising or end-user profiling. Odisea disables Mapbox's optional detailed performance-metrics collection; billing-related map events still occur. Marketing pages do not load an interactive Mapbox map until you explicitly allow it. You can reopen the map privacy controls to stop Mapbox and remove those entries from your browser.
For more information, you can review the Mapbox GL JS browser storage disclosure, the Mapbox Privacy Policy and Mapbox Terms of Service.
To provide our AI-powered features, we utilize various third-party AI models and services. When you use these features, the content you provide (such as text prompts, selected documents or images, and voice input where supported) may be sent to the providers needed for the requested feature. We do not deliberately send account credentials or account contact details as AI input, but content you submit can itself contain personal data. Avoid sensitive information unless necessary and lawful for the feature. As we continually work to improve our services, the specific AI providers we use may change over time.
Our app uses ElevenLabs to provide text-to-speech functionality. When you use this feature, the text you provide is sent to ElevenLabs to be converted into audio. For more information on their data practices, please review the ElevenLabs Privacy Policy.
We use Sentry for error monitoring and crash reporting to help us identify and fix issues within the App. Sentry may collect device information, IP addresses, and details about errors that occur. For more information, see Sentry's Privacy Policy.
On the website, we use Sentry (EU data region) to learn about errors that break pages, independently of your analytics choice. An error report contains the error message and stack trace, the page URL, and your browser and operating system. Reports are sent through odisea.ai rather than from your browser to Sentry directly, IP addresses are not stored, and no cookies or browser storage are used. There is no session replay or performance tracing. Our legal basis is our legitimate interest in keeping the website working (GDPR Article 6(1)(f)).
We use TelemetryDeck for privacy-friendly App product analytics. We send app-defined events and context that help us understand onboarding, tour, audio, offline-download, purchase, and reliability flows. Depending on the feature used, that context may include app and operating-system versions, device type, selected language, broad account or subscription state, timing and outcome categories, and coarse location or region when location is available. We do not send names, email addresses, user-created content, request or response bodies, or full error messages. TelemetryDeck uses an installation identifier that is hashed on the device and again by its service, and states that it does not store IP addresses. For more information, see TelemetryDeck's Privacy Policy.
The current iOS App also sends the app-defined product and reliability events described above to PostHog Cloud EU. These events can include an anonymous installation identifier and App session identifier, app build and distribution channel, device and operating-system context, selected language, onboarding state, broad account and subscription state, tour, stop, audio, download, purchase, and location-permission interactions, elapsed timings, and broad outcome or failure categories. When location is available, analytics coordinates are rounded to two decimal places and may be accompanied by country or administrative-region information.
The PostHog iOS SDK stores its anonymous installation identifier and a limited queue of pending events on the device so events can be retried after an offline period. PostHog may process the request IP address as technical network metadata. We do not use this integration for advertising or cross-app tracking, and we do not send names, email addresses, precise analytics location, typed or spoken content, URLs, request or response bodies, or full error messages. Person profiles, automatic screen and app lifecycle capture, element autocapture, session replay, surveys, and feature flags are disabled in the iOS integration. For more information, see PostHog's Privacy Policy.
We use RevenueCat to manage in-app subscriptions. When you make a purchase, RevenueCat processes subscription information on our behalf. It does not process or store payment card information, which is handled directly by the Apple App Store or Google Play Store. You can review RevenueCat's Privacy Policy for more details.
Where live voice features are enabled, LiveKit provides real-time session transport. It processes the audio and session information transmitted when you start that feature. Availability varies between mobile versions and accounts; ordinary tour playback does not start a live microphone session. For more details on their data practices, please see the LiveKit Privacy Policy.
We use Resend.com to send our newsletter and other important communications. For more detailed information about how Resend.com handles data, please refer to their privacy policy at https://resend.com/legal/privacy-policy.
We retain your personal data only for as long as is necessary to provide our services to you and for our legitimate and essential business purposes, such as maintaining the performance of the App, making data-driven business decisions about new features, complying with our legal obligations, and resolving disputes. We will retain your user account data for as long as your account is active.
If you request account deletion, we delete your account and associated user data, subject to necessary retention exceptions. Unpublishing removes public visibility but does not itself delete account content. Deleted data may remain temporarily in restricted backups until the relevant backup cycle expires. Limited accounting, security and rights-complaint records may be retained where required by law or necessary for a substantiated legal claim, with access restricted to that purpose. Retention criteria include the life of the account or requested feature, applicable statutory periods and the duration of the relevant dispute; we do not keep all uploads indefinitely merely because a future claim is possible.
You can request account deletion directly in the mobile app via Settings > Delete Account, or through our account deletion page.
We implement appropriate technical and organizational measures to protect your personal information against unauthorized or unlawful processing, accidental loss, destruction, or damage.
Your information may be transferred to, and maintained on, computers located outside the European Economic Area, including where a provider or its authorised support or subprocessors operate in another country. Such transfers require an applicable GDPR transfer basis, such as an adequacy decision covering the recipient or standard contractual clauses with any necessary supplementary safeguards. Device permission or agreement to these terms is not a substitute for those safeguards. Contact us for information about the recipients and transfer safeguards applicable to your use, and to request a copy of the relevant safeguards.
Depending on your location and subject to applicable law, you have certain rights regarding your personal data. These may include the right to:
To exercise any of these rights, please contact us at the email address provided below. You may withdraw consent at any time without affecting the lawfulness of earlier processing. You may complain to a supervisory authority, including in your place of residence, work or the alleged infringement. For our Frankfurt establishment, the regional authority is the Hessian Commissioner for Data Protection and Freedom of Information.
You can also request account deletion directly via our account deletion page, or in the app via Settings > Delete Account.
Our services are not intended for users under the age of 13. We do not knowingly collect personal information from children under 13.
We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last updated" date.
If you have any questions about this Privacy Policy, please contact us via our contact page or email us at [email protected]