Privacy

Who we are

HappyMaps is built and operated by Squared Lemon (Netherlands), also trading as sticky.software and HappyMaps. Reach us at squeeze@squaredlemon.com; we'll provide our registered address on request.

We are the data controller for everything described below.

What we store, in three places

1. Your canvas state lives in a server-side HappyMaps session attached to your browser. It belongs to your browser, not an account. Clear cookies and it's gone.
2. Product telemetry lives in our database, keyed to two ids that are stored inside that same HappyMaps session. Pseudonymous traces of how the tool gets used, so we can see where people get stuck and what to build next.
3. Studio waitlist and Studio purchases, if you sign up at /studio. Email and a few optional answers, plus payment metadata if you buy. See the section below.

Cookies, and why there is no banner

We only use cookies that are strictly necessary to run the site or to remember a choice you made. Nothing else sets a cookie on your device.

• happymaps_session: keeps your canvas open between page loads. The two telemetry ids live inside this session value, not in their own cookies, so they end when the session ends.
• XSRF-TOKEN: standard cross-site request forgery protection on form submissions.
• hm_advanced_mode: remembers whether you have Advanced mode on. Set when you toggle it. Lasts a year.
• hm_advanced_welcomed: remembers that you have already seen the Advanced welcome card so we do not show it again. Lasts about three months.
• hm_anon_optout: only set if you flip the opt-out switch below. It records that choice.

Analytics and feedback on the marketing pages are cookieless (see subprocessors). That is why no banner is shown.

What telemetry captures

• Actions you take: adding objects, moving things, slicing, blanking, exporting.
• Canvas shape: dimensions, panel specs, object counts.
• Any names you have typed for your project or for objects (defaults are "Project 1" and "Screen 1"). We never ask for personal or client information; whatever you put in those fields is your choice and rides along in the snapshot.
• A browser-class tag like chrome-desktop. The raw user-agent is not stored on events.
• The first chunk of your Accept-Language header, e.g. en-GB.
• Two UUIDs stored inside the HappyMaps session: one rotates whenever you reset the canvas, one persists across canvas resets within the same visit. Both die with the session.
• Periodic full-canvas snapshots, captured on export and when you leave the page. Same shape data as above (objects, theme, dimensions). Used to reconstruct what the tool looked like when something went wrong.

What telemetry does not capture

• Your email or your name. We never ask for them.
• Your raw IP address.
• Uploaded files or images.

If you sign up for Studio

The waitlist form at /studio stores your email plus a few optional answers (role, team size, which features matter, free-text notes). If you buy a Studio license, Mollie processes the payment and we keep payment metadata: Mollie payment id, amount, paid_at, and seat count. Refund policy is on the Studio page.

If you sign up while using HappyMaps in the same session, the work you did before signing up gets attached to your account so it isn't lost. Activity from earlier visits cannot be linked to you, by us or by anyone else: the two telemetry ids live inside the HappyMaps session and die with it, so there is no persistent device id that could connect what you did last week to who you are today.

Subprocessors

HappyMaps is hosted and serves email from EU-based infrastructure. Server access logs and email-delivery logs see your IP address (and your email address when we email you) for security and deliverability, kept short-term.

Beyond that, third parties we send data to for specific purposes:

• Mollie, Netherlands: payment processing for Studio purchases. mollie.com/privacy.
• Fathom Analytics: cookieless aggregate visit analytics on the marketing pages. usefathom.com (this is our referral link, which gives us a small credit if you sign up). Their privacy page: usefathom.com/privacy.
• mood.cards (also us, sticky.software): cookieless contextual feedback widget. mood.cards/privacy.

Retention

• Telemetry events: 180 days, then pruned automatically.
• Telemetry snapshots: 30 days, then pruned automatically.
• Aggregated analytics derived from telemetry (counts, funnels, feature usage at a non-identifying level) may be kept longer than the raw events. Aggregates carry no per-session identifiers.
• Waitlist signups: kept until you ask us to delete them, or until Studio launches and you have either onboarded or passed.
• Studio account data: kept while your account is active.
• Web server access logs: kept short-term (up to 14 days) for security and debugging.

Your rights

Under GDPR you can ask us to access, correct, delete, export, or restrict the data we hold about you, and you can object to processing. Email squeeze@squaredlemon.com and we will handle it within 30 days. You also have the right to complain to your national data protection authority (in the Netherlands: autoriteitpersoonsgegevens.nl).

Legal basis: legitimate interest for pseudonymous product telemetry and security logging, contract performance for Studio purchases and account email, and your consent for the waitlist.