Privacy

What this website keeps on your device, what we receive when you order, and who else handles it.

What this website keeps on your device

To work properly, the site keeps a few things in your own browser: your light or dark choice, the items in your bag, the GPX files and photos you chose for them (until you pay), the delivery country you last chose, the order form you are filling in, and, once you go to checkout, your order number and the details of that checkout (for this browser tab only), so the checkout page can show it and the thank-you page can tidy your bag. These stay on your device until they are sent as described below.

Your GPX files and photos

A GPX file you choose on the order form is read in your browser to draw the preview. When you press Pay, it is uploaded securely to our website host, together with your photos, so that we can make your piece. Photos are saved again on your device before they are uploaded, at close to their original quality, without the location and camera details a phone stores inside them. A GPX route can show where you start and finish, which might be near your home. If you would rather not upload it, paste a route link (Strava, Garmin Connect, Komoot, AllTrails, etc.) instead, or email us.

Files for an order that is not paid for are deleted automatically, within about a week at the latest. Once an order is paid, its files are saved to our private Google Drive and deleted from the website host.

When your piece arrives, reply to let us know you are happy with it. We then email you the photos you sent us and delete our copies of your photos and route files. If we do not hear from you, we delete them 30 days after we post your order. Deleted files stay in our Google Drive bin for up to 30 more days before Google removes them for good.

What we receive when you order

The details you enter on the order form and at checkout: what you ordered, the event details for your piece, your name, email address and delivery address (and a phone number for deliveries outside the UK), and any GPX files, links or photos you add. We use them to make and deliver your order, to email you about it, and to meet our legal and accounting duties.

When you send us a message

The message form on our Contact page emails us your name, email address, message, any order number and any files you attach (photos are made smaller on your device first). We use them only to answer you, and they stay in our inbox like any other email. To stop the form being misused, our website host keeps a short-lived count of messages sent from each connection, stored as a scrambled code rather than your IP address, and deletes it within two days.

When you write a review

The review form on our Reviews page sends us your review, star rating, the name and place you want shown, the frame and race or route if you give them, any photos you add, your email address and any order number. Photos are made smaller on your device first, and the location and camera details that phones store inside them are removed. We keep these on our website host so that we can check the review, and email them to ourselves. If we publish your review, it appears on our website with the name, place, frame, race or route, the month you wrote it and the photos we have chosen to show. Photos we do not show, and the photos of a review we decline or remove, are deleted from our website host. Your email address and order number are never shown, and we delete them from the website host when we publish or decline the review (a review we have not answered is deleted after 90 days). They stay in our inbox like any other email. We rely on your agreement to show your review, and you can ask us to change or remove it at any time. As with the message form, a short-lived scrambled count of reviews sent from each connection stops the form being misused and is deleted within two days.

Who else handles your information

Stripe takes your payment. Its secure boxes on our checkout page collect your email address, delivery address and payment details (or Apple Pay, Google Pay or another wallet passes them on), and Stripe uses Google's address suggestions as you type your address. We never see your card details, and Stripe's privacy policy applies to what it collects. Netlify hosts this website and keeps your uploaded files for a short time and the reviews you send us, as described above, and may keep standard server logs such as IP addresses for security. Google (Google Workspace) sends our order emails, holds our inbox, which includes your order details, and stores your files in our private Google Drive. Delivery companies receive your name, address and phone number so they can deliver your piece. If you message us on Instagram, that message is handled by Instagram (Meta). When you add a GPX file, your browser downloads the map tiles for the area around your route from OpenFreeMap, a free map service built on OpenStreetMap, so that the coast, lochs, rivers and streets can be drawn on the preview. Only the tile numbers for that area are asked for, never the file itself, and the service sees your IP address as any website does.

After you pay, Google may offer you an optional Google Customer Reviews survey. To make the offer, we pass Google your order number, email address, delivery country and expected delivery date. Google only emails you the survey if you choose to take part, and it runs the survey under its own privacy policy.

Some of these services handle information outside the UK. Where they do, the law requires safeguards, which their own privacy policies explain.

Cookies and tracking

This website does not use advertising or analytics cookies. On the checkout page only, Stripe sets its own cookies to help prevent fraud and keep the payment secure; they are needed for paying online. On the thank-you page, Google may set its own cookies when it shows the Google Customer Reviews offer.

How long we keep things

Your photos and route files are deleted as described under "Your GPX files and photos" above. We keep the other order details, including the order email, for as long as we need them to make and deliver your order, deal with any problem with it, and meet our legal and accounting duties. Published reviews stay on our website until you ask us to remove them or we stop showing reviews.

Your rights

Under UK data protection law you can ask to see, correct or delete the personal information we hold about you, or object to how we use it. Email info@toporoute3d.com or message us on Instagram (@toporoute) and we will help. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Who we are

TopoRoute, 28 Tennyson Gardens, Glasgow, G72 0BE