Terms and Conditions

Welcome to Mapifest. By creating an account or otherwise using the Mapifest platform (the Platform), you agree to these Terms and Conditions. If you do not agree with them, please do not use the Platform.

1. Free to use

Mapifest is provided free of charge. We do not charge a fee for access to or use of the Platform. We may change what is offered at no cost, or introduce paid features, at any time.

2. Acceptable use

You are responsible for how you use the Platform and for any content you create, upload, or publish. You agree not to use the Platform for any purpose that is unlawful, harmful, or otherwise inappropriate. Prohibited uses include, but are not limited to:

• Racist, hateful, or discriminatory content or conduct;
• Sexist content, or harassment or abuse based on sex or gender;
• Doxxing — publishing the private or identifying information of another person without their consent;
• Any illegal activity, or content that is illegal to create, share, or possess;
• Any other use that we consider inappropriate, abusive, or harmful.

These are examples only and the list is not exhaustive.

3. Suspension and revocation of access

Access to the Platform is provided at our discretion. We may suspend, restrict, or permanently revoke your access, and remove any content, at any time and for any reason, with or without notice. This includes any use that breaches these terms, but our right to revoke access is not limited to breaches.

4. No warranty

The Platform is provided on an as-is and as-available basis, without warranties of any kind. We do not guarantee that it will be uninterrupted, error-free, or available at any particular time, and we are not liable for any loss arising from your use of the Platform.

5. Privacy and your personal data

This section explains how we handle your personal data and the rights you have under the European Union General Data Protection Regulation (GDPR). We collect only what we need to run your account and the Platform, and we do not sell your personal data.

Who we are. Mapifest is a product developed and operated by EXIT TRADE AND CARGO OÜ (registry and VAT code EE101711078), Estonia, which is the data controller responsible for your personal data. Because the controller is established in Estonia, in the European Union, the EU GDPR applies. For any privacy or data-protection question, contact us at info@mapifest.com.

What personal data we process:

• Account data — your name and email address, collected when you register and stored in AWS Cognito, together with a record of when you accepted these terms.
• Password — chosen when you confirm your account and stored only in hashed form by AWS Cognito. Mapifest never stores your password in plaintext.
• Content you create — events, points of interest, and any images or audio you upload, stored in AWS S3 with the related metadata in AWS DynamoDB.
• Technical data — your IP address, used to rate-limit sign-up and prevent abuse, and standard server request logs.
• In-app messages and notifications — stored only briefly, with a 7-day time-to-live, after which they expire automatically.
• Web-push subscription — only if you choose to enable browser notifications. This is the technical endpoint needed to deliver them, and it is held in memory only and lost when the service restarts.

Why we process it, and our lawful basis. We process personal data only where the law gives us a valid basis to do so:

• To create and run your account and provide the Platform, including your content and the cookies that keep you signed in — on the basis of performance of a contract with you (Article 6(1)(b)).
• To keep the service secure and prevent abuse and spam, including IP-based rate-limiting, the sign-up bot check, and understanding usage through cookieless aggregate analytics — on the basis of our legitimate interests (Article 6(1)(f)).
• To provide optional features such as browser push notifications — on the basis of your consent (Article 6(1)(a)), which you may withdraw at any time.
• To meet legal requirements, where the law requires us to process or retain certain data — on the basis of a legal obligation (Article 6(1)(c)).

Who we share it with. We do not sell your personal data. We share it only with service providers that process it on our behalf, under contract and on our instructions:

• Amazon Web Services (AWS) — Cognito for accounts and authentication, S3 for media, DynamoDB for metadata and messages, and SES to send the verification-code emails, among related services.
• Cloudflare Turnstile — a privacy-preserving bot check shown on the sign-up form.

International transfers. Some of these providers, notably AWS, may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, to protect your data.

How long we keep it:

• Account data — kept while your account exists, and deleted or anonymised within a reasonable period after you delete your account, unless the law requires us to keep it longer.
• Content you create — kept until you delete it or delete your account.
• In-app messages — expire automatically after 7 days.
• Logs — kept for a limited period for security and troubleshooting.

Your rights. Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data (the right to be forgotten);
• restrict how we process your data;
• data portability — receive the data you provided in a portable, machine-readable format;
• object to processing that relies on our legitimate interests; and
• where we rely on your consent, withdraw that consent at any time, without affecting any processing carried out before you withdrew it.

To exercise any of these rights, contact us at info@mapifest.com.

You also have the right to lodge a complaint with a data-protection supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), and you may also contact the supervisory authority in the country where you live or work.

6. Cookies

Cookies on Mapifest are used only to sign you in and keep you signed in. We set none for a visitor who is not signing in, and none on the public marketing pages. They are set only when you sign in, and only ones that are strictly necessary to provide the service you have signed in to. Mapifest itself sets three:

• A session cookie (named session) — an httpOnly, signed token that keeps you logged in. It is valid for one hour and is replaced automatically while you keep using the Platform. It is scoped to the .mapifest.com domain, so that the Mapifest API recognises you too.
• A refresh cookie (named refresh) — an httpOnly, signed token used only to issue you a new session cookie. It is sent only to the Mapifest admin site, never to the API. It expires once you have not used the admin site for about eight hours, which signs you out.
• A login state cookie (named oauth_state) — a short-lived cookie (about 5 minutes) set during the login redirect to protect against cross-site request forgery, and consumed immediately after you log in.

The sign-in page itself, at auth.mapifest.com, is run for us by Amazon Web Services (AWS Cognito) and sets cookies of its own that signing in requires, among them a sign-in session of about an hour, so that signing in again soon after does not ask for your password. Logging out ends that session too.

We use no advertising, cross-site tracking, or third-party analytics cookies. Our product analytics is cookieless and collects only anonymous, aggregated statistics, such as page views, referrers, and browser types, with no personal data and no cross-site tracking.

Because these cookies are strictly necessary to deliver the authenticated service you have chosen to sign in to, we rely on them without a separate cookie-consent banner. You can decline them by not creating an account, and you remove them by logging out.

7. Changes to these terms

We may update these Terms and Conditions from time to time. Each version has its own effective date and remains available at its own address (for example, /terms-and-conditions/2026-07-16). Continued use of the Platform after an update means that you accept the then-current terms.