Privacy Policy

1. Overview

Airfree Maps is a mapping and geospatial navigation service operated by Airfree Geospatial Pty Ltd (ABN 35 698 093 239), an authorised licensee of Airfree Services Pty Ltd, the intellectual-property and infrastructure company of the Airfree group (which is owned by the parent holding company, Airfree Holdings Pty Ltd).

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Airfree Maps application, website, and related services (collectively, the “Service”). We are committed to handling your data lawfully, transparently, and with respect for your privacy rights under the Privacy Act 1988 (Cth) (Australian Privacy Principles) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Data Controller

The data controller responsible for personal information processed through Airfree Maps is:

3. Data We Collect

We collect the following categories of personal and usage data:

3.1 Location Data

When you use features such as “find my location,” turn-by-turn navigation, or nearby search, we collect your device’s geographic coordinates (latitude and longitude). Location data is used solely to provide the requested mapping function. We do not continuously track your location in the background without your explicit consent. You may revoke location permission at any time through your device settings.

3.2 Search Queries

Search terms you enter (addresses, place names, coordinates, or points of interest) are processed to return relevant results. Queries may be logged in de-identified or pseudonymised form to improve search quality and detect abuse.

3.3 Account Information

If you create an Airfree Maps account, we collect your name, email address, and a hashed password. You may optionally provide a profile picture and display name. Account data is used to authenticate you, personalise your experience (saved places, recent searches), and communicate service updates.

3.4 Map Interactions and Usage Data

We collect anonymised telemetry about how you interact with the map: zoom level, pan gestures, layer toggles, tile requests, and session duration. This data does not identify you individually and is used to improve application performance, prioritise feature development, and detect technical issues. We also collect standard server logs including IP address (which may be pseudonymised after 30 days), browser or app version, operating system, and referring URL.

4. How We Use Your Data

We process your personal information for the following purposes and legal bases:

• Service delivery — providing map tiles, search results, routing, and location features (performance of contract / legitimate interest).
• Account management — authenticating you and maintaining your preferences (performance of contract).
• Service improvement — analysing aggregated usage patterns to optimise performance and develop new features (legitimate interest).
• Security and fraud prevention — detecting and preventing abuse, unauthorised access, and technical attacks (legitimate interest / legal obligation).
• Legal compliance — meeting obligations under applicable law, including responding to lawful government or regulatory requests (legal obligation).
• Communications — sending transactional emails (password resets, account alerts) and, with your consent, product announcements (consent).

We do not sell your personal information to third parties. We do not use your data to build advertising profiles or serve behavioural advertising.

5. Data Storage and Retention

Your data is stored on servers located in Australia. Where data is processed or transferred outside Australia (for example, to cloud infrastructure providers with global point-of-presence), we ensure equivalent protections apply through contractual safeguards consistent with the Australian Privacy Principles and, where applicable, the GDPR Standard Contractual Clauses.

Retention periods:

• Account data — retained for the life of your account plus 30 days after deletion, then permanently erased.
• Location data — session location is discarded at the end of each session unless you save a place or route explicitly.
• Search query logs — retained in pseudonymised form for up to 12 months for quality purposes, then deleted.
• Server logs — raw logs retained for 90 days; IP addresses pseudonymised after 30 days.
• Backups — encrypted backups are retained for up to 60 days, after which they are purged on a rolling basis.

6. Third-Party Services

Airfree Maps relies on the following third-party data providers to deliver map content:

6.1 OpenFreeMap

Map tiles and geospatial layers are served by Airfree’s own internal map infrastructure (the Airfree tileserver, OGC and earth-observation services). No third-party map provider receives your IP address or map requests.

6.2 OpenStreetMap

The underlying map data is sourced from OpenStreetMap (© OpenStreetMap contributors, available under the Open Database Licence). OpenStreetMap data is processed and hosted by us; no personal data is transmitted directly to the OpenStreetMap Foundation during normal map use.

6.3 Infrastructure Providers

We use cloud infrastructure and hosting providers (including but not limited to managed Kubernetes and object-storage services) subject to data processing agreements. These providers act as data processors under our instruction and are not permitted to use your data for their own purposes.

7. Cookies and Local Storage

Airfree Maps uses the following types of browser storage:

• Strictly necessary cookies — session authentication tokens required for logged-in features. These cannot be disabled without breaking the Service.
• Local storage — map preferences (default zoom, layer selections, recent searches) stored locally on your device. This data never leaves your device unless you are logged in and have sync enabled.
• Analytics (optional) — if you consent, we may use a privacy-preserving analytics tool to collect aggregate usage statistics. No third-party advertising or tracking cookies are used.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you.
• Correction — request that inaccurate or incomplete data be corrected.
• Deletion (right to erasure) — request deletion of your personal data, subject to legal retention obligations.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format (GDPR users).
• Objection — object to processing based on legitimate interest, including for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Complaint — lodge a complaint with your national supervisory authority. In Australia: the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. In the EU/EEA: your local Data Protection Authority.

To exercise any of these rights, contact us at privacy@airfreemaps.com. We will respond within 30 days (or such shorter period as required by applicable law). We may need to verify your identity before processing certain requests.

9. Children’s Privacy

Airfree Maps is not directed at children under the age of 13 (or 16 in jurisdictions that require a higher age threshold for data consent). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information without parental consent, please contact us immediately and we will take steps to delete the data.

10. Security

We apply industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, role-based access controls, and regular security audits. Passwords are stored using bcrypt hashing. Despite these measures, no system is completely secure; we encourage you to use a strong, unique password and to notify us promptly at privacy@airfreemaps.com if you suspect any unauthorised access to your account.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where required by law or where the changes significantly affect your rights, notify you by email or in-app notice at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

12. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact our Privacy team: