Privacy policy

The data controller for this website is The Plot Room. The studio operates from the United Kingdom.

Privacy questions and requests about your information can be sent through the contact page or to queries@theplotroom.com. Include enough detail to find the relevant order, upload or enquiry, such as the order reference or the email address you used. Do not send identity documents unless they are specifically requested.

When you send an enquiry

The contact form collects your name, email address, subject and message. The commission form collects the type and quantity of work, size, paper and ink choices, any wording, deadline, budget band, brief, your name, email address, optional phone number and how you heard about the studio. Enquiries are emailed to the studio's mailbox with a reference number; the website itself keeps no copy.

When you design a custom map

The map designer runs in your browser. The place name you search for, and the coordinates of the map centre when you drag the map, are sent through this site's server to the Nominatim place service so a place name can be shown. Moving the map requests the map tiles for the area shown from OpenFreeMap. Nothing is linked to you until you add the design to the basket and order it.

When you upload a GPX file

A GPX file is a record of where you went. It usually contains location points with timestamps and elevation, and often the name of the activity. When you upload one, the site stores the file itself, its filename, size and a checksum, the statistics it works out (distance, ascent and descent, duration, start time and the area covered), a simplified copy of the track for the on-screen preview, a hashed form of your IP address, and a random access token. The file is kept in private storage under a random name; it is never available at a public web address, and only someone holding the token that was returned to your browser can read its preview data.

When you order

When you go to checkout the site sends your basket to Shopify, which runs the shop's checkout, payments and order records. On Shopify's checkout page you give your email address, name, delivery address, phone number and payment details; the card or wallet details stay with Shopify and its payment providers and are never seen or stored by this website.

Shopify then holds the order: the order number, your name, email address, phone number and delivery address, the items and prices, the amount paid and any refund, the dispatch and tracking details, and the emails it sends you about the order. For a custom map or a route map the order line also carries the design summary (place, sheet, frame and every line of wording including any name, degree, honours and years) and a private link to the full design file and, for a route map, to your GPX file, which this website keeps in private storage so the studio can make the piece.

When you join the mailing list

The sign-up form adds your email address to the studio's customer list in Shopify, marked as agreeing to marketing email. Every mailing carries an unsubscribe link.

Technical information

• Your IP address is used to limit how often forms, uploads and checkout can be used. It is hashed with a secret and counted in memory for a few minutes; it is never written to storage.
• Each request is given a random request id, which appears in the server logs so that a problem can be traced.
• The hosting provider keeps ordinary server logs (IP address, browser type, requested page, time and response status) to run and protect the service.
• Visit counting happens only if you accept it in the analytics banner; see section 07.

The forms do not ask for special-category information. Please do not include health, biometric, religious, political or similarly sensitive information in free-text fields or in file names unless it is genuinely needed for the request.

The information is used for the following purposes:

• Performing the contract with you: pricing the basket, taking the order and payment through Shopify, storing your design and GPX file so the piece can be made, preparing and correcting the proof, making and delivering the piece, sending the confirmation, dispatch and refund emails, and dealing with changes, returns, faults and questions.
• Steps you ask for before a contract: answering contact and commission enquiries, and validating and previewing a GPX file you upload before you decide to order.
• Legal obligations: keeping accounting and tax records, honouring consumer rights, processing refunds and responding to lawful requests from authorities.
• Legitimate interests: keeping the site secure and reliable (rate limits, hashed IP addresses, request ids, error monitoring and server logs), preventing fraud and misuse, keeping business records, and establishing, exercising or defending legal claims. These interests are weighed against your interests, and none of them involves profiling or selling your information.
• Consent: the mailing list, and analytics (only after you accept in the banner). You can withdraw consent at any time: use the unsubscribe link in any mailing, or change your analytics choice in section 07. Withdrawal does not affect processing that happened before it.

Shopify requires an email address, name, delivery address and payment details to place an order. Required enquiry fields are needed to answer you. Without them the studio cannot provide the service. Fields marked optional can be left blank.

Information is shared only with the services needed to run the site and fulfil your order, and where the law requires it. Each of the following acts under a contract or terms that restrict what it may do with the information:

• Shopify runs the checkout, takes the payment (through Shopify Payments, PayPal and the wallets it offers) and keeps the order records. It receives your email address, name, delivery address, phone number, payment details, the order lines and amounts, and the design summary on custom lines. Shopify also uses payment information for its own fraud prevention and legal duties under its own privacy policy.
• Resend delivers contact and commission enquiries to the studio's mailbox. It handles the addresses, subjects and contents of those emails.
• Cloudflare stores uploaded GPX files and saved designs in private object storage (R2). Your browser sends the file to Cloudflare directly using a short-lived signed link, so Cloudflare also sees your connection details for that request.
• OpenAI Sites (Cloudflare hosting) hosts the website and processes every request to it, including the server logs.
• Nominatim, run by the OpenStreetMap Foundation, receives the place names you search for and the coordinates of the map centre. The requests come from this site's server under the studio's own identity, so Nominatim does not receive your IP address or anything that identifies you.
• OpenFreeMap supplies the map tiles the designer and route preview draw. Your browser requests them directly, so OpenFreeMap sees your connection details and which map areas you view. The map data is derived from OpenStreetMap.
• Delivery carriers receive your name, delivery address, and where the carrier needs it your phone number or email address for delivery notifications, together with the tracking reference. The carrier used is named in your dispatch email.
• Professional advisers, insurers, the studio's bank, payment dispute services, regulators, courts and law enforcement may receive relevant information where it is necessary to protect the studio's rights or legally required.

Personal information is never sold and is not shared with advertising networks.

External and social links

External and social links take you away from this website. The destination collects information under its own terms, and this policy does not cover it.

• Orders: order records in Shopify are kept for six years after the end of the tax year in which the order was placed, because they are the studio's accounting records. The studio downloads the design and GPX files for each order and keeps them with the order for the same period, so the piece can be remade or checked.
• GPX uploads and saved designs: a file that fails validation is not kept. Files in the site's private storage have access links that expire after 90 days. Expired files are removed automatically during housekeeping when new files are uploaded. They may remain in private storage between expiry and that next cleanup; you can request earlier deletion.
• Enquiries: contact and commission emails are kept in the studio's mailbox for two years after the last message, unless the enquiry becomes an order, in which case the order retention applies.
• Mailing list: in Shopify until you unsubscribe. After that your address is kept marked as unsubscribed so that it is not emailed again; it is deleted entirely on request.
• Rate-limit counts: hashed IP addresses with a request count, held in memory for at most an hour and never written to storage.
• Server logs and error reports: kept by the hosting provider for their standard periods, which are short and set by them.

Deleted information can persist in a provider's backups for its backup cycle before it disappears from there too. These periods are reviewed against legal obligations and operational need; information that is no longer required is deleted or anonymised.

The site sets no advertising cookies and no third-party tracking cookies. The only cookies and browser storage it uses are:

• ps_consent: a first-party cookie recording whether you accepted or declined analytics. It is set only when you make a choice in the banner, lasts one year, and is not used at all when no analytics service is configured.
• Local storage key plot-room-basket-v3: your basket. A custom-map or route-map line in the basket contains its full configuration, including any personal wording, exact coordinates and the reference to your uploaded file. It stays in your browser until you remove the item, complete an order, or clear the site's data.
• Session storage keys plot-room:map-design:v2 and plot-room:route-upload:v1: the custom-map design you are working on, and the result of your last GPX upload (its statistics, simplified track and access token), so the designer can pick up where you left off. They belong to the current browser tab and are cleared when it closes.
• Shopify's checkout page sets its own cookies for security, fraud prevention and to remember your details, under Shopify's privacy policy.

You can change your analytics choice at any time; the banner appears again so you can accept or decline. Clearing the site's data in your browser removes all of the above.

No analytics service is configured on this deployment, so no analytics script is loaded and no consent banner is shown.

The only analytics the site is built to use is Plausible, a cookieless service that reports aggregated figures only. If it is switched on, it will load only after you accept in a banner, your choice will be kept in the ps_consent cookie for a year, and you will be able to change your analytics choice from this page.

The studio is in the United Kingdom. Some of the providers in section 04 process information in the European Economic Area or the United States, or make it available to their international support teams.

Where information leaves the UK, the transfer relies on the UK adequacy regulations for the destination, on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or on the International Data Transfer Agreement or Addendum approved by the Information Commissioner, which the providers include in their terms. You can ask for details of the safeguard that applies to a particular provider through the contact details in section 01.

Under UK data protection law you have the right to:

• ask whether the studio holds information about you and receive a copy of it;
• have inaccurate or incomplete information corrected;
• ask for information to be deleted where there is no longer a reason to keep it;
• ask for its use to be restricted in certain circumstances;
• object to processing based on legitimate interests, and to any direct marketing at any time;
• receive the information you supplied in a portable form, where the processing is based on consent or contract and carried out by automated means;
• withdraw consent where consent is the basis for a use; and
• complain to the regulator.

Send a request through the contact details in section 01. A request may need proportionate identity checks and enough detail to find the record. The studio normally answers within one month and will explain if the law allows an extension or if a request cannot be met in full.

If you are unhappy with how your information has been handled, please raise it with the studio first so it can be put right. You also have the right to complain to the Information Commissioner's Office at any time through its complaints service or by telephone on 0303 123 1113.

Security

The site is served only over HTTPS with strict transport and content security policies. Payment details are entered with Shopify and never touch this site. Uploaded files are validated as genuine GPX before they are stored, kept under random names in private storage, and read only with their signed access token. IP addresses are hashed before use. No internet service can promise absolute security; if you suspect misuse or an unexpected disclosure, please report it promptly through the contact page.

Children

The shop and its services are for adults and are not directed at children. The studio does not knowingly collect information from children. A parent or guardian who believes a child has supplied personal information should contact the studio so it can be removed.

Automated decisions

The site validates forms and files, calculates prices and delivery charges, applies rate limits and returns map-search results automatically. It does not use profiling or make solely automated decisions that have legal or similarly significant effects on you.

Changes to this policy

This page is updated when the services or practices it describes change. Material changes are highlighted where reasonably practical, and the date at the top identifies the version currently displayed.

Related information is in the terms and conditions, the delivery and returns page and the accessibility statement.