Privacy Policy

This policy explains how saasworldmap.com ("we") handles personal data on saasworldmap.com and its API. It applies to anyone who visits the map, makes an account, lists a product, stakes a country, or joins the mailing list.

It does not cover the products advertised on the map. Following a link from a country panel takes you to somebody else’s site, under somebody else’s policy.

All of it comes from you, or from the act of using the site. We do not buy data about you from anyone.

• Your account — your name and email address, and the account identifier and profile picture Google returns to us when you sign in. We hold no passwords at all — signing in with Google is the only way into an account — and we never receive your Google password.
• Your products — the name, domain, link, category, tagline and logo image you enter for each product you list.
• Your stakes — which countries a product has staked, the amount of each stake, and when it was placed or raised.
• Activity history — an append-only log of claims, top-ups, lead changes and withdrawals, so the ticker on the globe can show what has been happening.
• The mailing list — your email address and where on the site you signed up, if you choose to join it.
• Technical data — your IP address and ordinary request metadata, which our rate limiters use to keep one visitor from drowning the API; a session cookie during sign-in; and a sign-in token plus a few panel preferences kept in your browser’s local storage.

We do not process card or bank details. Nothing on the map is charged today, and if that changes a payment provider will handle those details directly — this policy will be updated before it does.

Worth being blunt about, because a map nobody can read is not a map. Once a product holds a stake, the following is visible to every visitor and to anyone using the public API:

• the product’s name, domain, link, tagline, logo and category
• every country it has staked, the amount of each stake, and its rank there
• its appearances in the leaderboard and in the activity ticker

Your name, your email address and your account details are not shown anywhere on the map. If you would rather a product were not public, remove its listing — but note that the activity log keeps a record of stakes that were placed, since that history is what makes past lead changes make sense.

• running the map: ranking stakes, drawing countries, and showing who leads where
• signing you in and keeping your session alive
• letting you manage your products and your stakes
• answering you when you write to us
• keeping the site up — rate limiting, abuse and fraud prevention, debugging, backups
• sending the newsletter, if you asked for it, and only until you ask us to stop
• aggregate statistics about how the map is used, which never identify anyone

We do not use your data to build advertising profiles, and we run no third-party advertising or analytics trackers on the site.

Where the GDPR or a similar law applies to you, we rely on:

• Performance of a contract — account details, products and stakes — we cannot give you the service without them.
• Legitimate interests — security, rate limiting, abuse prevention, and understanding usage in aggregate.
• Consent — the mailing list, which you can withdraw at any time.
• Legal obligation — anything we are required to keep or disclose by law.

We use no advertising or cross-site tracking cookies. What we do use:

• A session cookie — set by the Google sign-in handshake. It expires when the session does.
• A sign-in token — kept in your browser’s local storage so you are not asked to sign in on every visit. Signing out removes it.
• Panel preferences — which cards you left open on the globe, also in local storage. They never leave your browser.

Clearing your browser’s site data removes all three, and signs you out.

We do not sell personal data, and we do not share it for anyone else’s marketing. It reaches other companies only where they run part of the service for us, under contract and only for that purpose:

• Hosting and database providers — who store the data the site runs on.
• Cloudflare R2 — object storage for the product logos you upload.
• Google — when you sign in, and only to confirm who you are.
• Email delivery — to send account and mailing-list email.

We may also disclose data where the law requires it, or where it is necessary to establish or defend a legal claim, or to protect the safety of a person or of the service. If the site were ever sold or merged, account data would move with it, and you would be told before that happened.

Google is the only way to sign in, and we keep no passwords of our own. Here is exactly what happens when you use it.

• What we receive — from Google, under the "profile" and "email" scopes only: your name, your email address, your profile picture and your Google account identifier. We ask for nothing else, and we never receive your password.
• What we do with it — we find your saasworldmap.com account by email address, or create one if there is none, and we sign you in. Your name and picture identify you inside your own account; your email address is how we contact you about the service.
• What we do not do with it — we do not use it for advertising, we do not sell or rent it, we do not transfer it to anyone except the service providers listed above who need it to run the site for us, and we do not use it to build a profile of you or to train any model.
• How long we keep it — while your account exists. Deleting your account deletes it.

saasworldmap.com’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect us from your Google account at any time at myaccount.google.com/permissions. Doing so stops future sign-ins; to remove the data we already hold, delete your account as described below.

• Account data — for as long as your account exists, and for a short period afterwards in backups.
• Products and stakes — for as long as they are listed. Withdrawn stakes stay in the activity log as history.
• Activity log entries — kept indefinitely — they are the record of what happened on the map, and they carry no more than a product name, a country and an amount.
• Mailing list — until you unsubscribe. We then flag the address as unsubscribed rather than deleting the row, so a later import cannot silently add you back.
• Rate-limit and security records — a short rolling window, then discarded.

Write to privacy@saasworldmap.com from the address on your account, with "delete my account" as the subject. We delete the account, its products and its stakes within 30 days, and confirm when it is done. Backups age out within a further 30 days.

What survives is described under “How long we keep it”: entries in the public activity log keep a product name, a country and an amount, so the record of what happened on the map still makes sense. They carry no name, no email address and no account identifier.

Write to privacy@saasworldmap.com from the address on your account and we will act on any of these, free of charge, within 30 days:

• a copy of the personal data we hold about you
• correction of anything wrong — most of it you can also edit yourself
• deletion of your account and its products, subject to what “How long we keep it” says about the activity log
• a machine-readable export of your data
• restriction of, or objection to, our processing
• withdrawal of consent to the mailing list — every newsletter also carries an unsubscribe link

If you are in the UK, the EU or another region with a data protection authority, you may also complain to it. We would rather you told us first.

We hold no passwords at all — sign-in goes through Google, so there is nothing of that kind here to steal. Traffic runs over HTTPS, the API is rate limited, sessions are signed, and administrative access is restricted to accounts that need it. No service can promise perfect security, and we do not. If a breach ever affects your data, we will tell you and the relevant authority as quickly as the law requires.

The site is for people running a product, and is not directed at children. Do not make an account if you are under 16. If we learn that we hold data about a child, we delete it.

Our providers operate in several countries, so your data may be processed outside the one you live in. Where personal data leaves the UK or the European Economic Area, we rely on standard contractual clauses or an equivalent safeguard.

When this policy changes, the date at the top changes with it. If a change materially affects how we use your data, we will say so on the site or by email before it takes effect. Carrying on using the site after that is how you accept the new version.

Questions about this policy, or a request under “Your rights”: privacy@saasworldmap.com. Anything else: hello@saasworldmap.com.