Privacy policy

MapAndMove.se values your privacy. This policy describes what personal data we process, why, on what legal basis, how long it is kept and what rights you have under the General Data Protection Regulation (GDPR).

The policy covers the website mapandmove.se with its subdomains and the services we offer there. It does not cover websites we link to, which have their own policies.

For the rules on how you may use the site, see our terms of use. For storage in your browser, see our cookie policy.

Last updated: 4 November 2026.

The controller responsible for the processing is:

MapAndMove. Email kontakt@mapandmove.se.

We have no data protection officer. The requirement in Article 37 does not apply to activity of our type and scale, since we are not a public authority, do not carry out regular and systematic monitoring on a large scale and do not process special categories of data on a large scale.

You can use virtually the whole site without providing any data at all. An account is optional and needs only an email address, and we never ask for your name, personal identity number or address for you to view the map or the statistics. The following categories occur:

• Visitor statistics that we cannot link to you as a person: which pages are visited and for how long, type of device and browser, which country the visit comes from, where you came from, how far down you scrolled, whether you use light or dark mode and which language the page is shown in, how fast the page loaded, error messages from the site's own scripts, addresses on the site that did not exist, the name of websites you click through to (never the rest of the address), and anonymous interaction events such as which indicators, filters and map layers are used and which kind of search result you chose. What you type in search fields and forms is never sent. Each event is listed with its content and count on Visit data
• Technical data in the web server's operational logs: IP address, timestamp, the requested address including any parameters, response code, data volume, referring page and browser string
• Data you provide yourself: email address for accounts, newsletters and mushroom alerts, what you save in an account, the content of messages you send via feedback or contact forms, home municipality in Kommunkampen, text you write in our AI features, images you upload, and order details when buying a property report

We do not buy personal data, do not retrieve it from registers and do not combine it with other sources. Almost all data comes from you or from your browser's contact with our server.

Don't want to be counted at all? Press the button, and the site sends nothing about your visits from this browser. If the browser has Global Privacy Control switched on, you are never counted, without having to do anything. Everything we count is openly shown at Visit data.

Don't count my visits

Data about someone other than you. In three cases we do process data we received from someone other than the person it concerns. If someone uploads an image in which you are recognisable, or mentions you in a message to us, the categories are image and free text respectively, and the legal basis is legitimate interest (art. 6.1 f) in being able to publish local history material and correct errors that are pointed out. If the map shows a paid placement with contact details for a named person, the basis is the legitimate interest of us and the advertiser in being able to reach each other. We normally have no contact details for you and therefore cannot inform you personally (art. 14.5 b), and this text is then that information. You have the same rights as everyone else, see the section on your rights, and we remove the material on request.

We do not process special categories of personal data (for example health, ethnicity, political opinion or religious belief) and ask you not to provide such data in free text fields.

Each processing operation has a defined purpose and a legal basis under Article 6:

• Visitor statistics, to understand how the site is used and improve it. Basis: legitimate interest (art. 6.1 f)
• Operational logs, for operation, troubleshooting, security and to detect abuse such as automated mass downloading, and for anonymous totals of which map areas are viewed. Basis: legitimate interest (art. 6.1 f)
• Newsletter, to send the mailings you signed up for. Basis: consent (art. 6.1 a), confirmed by double opt-in and revocable at any time
• Feedback and contact, to be able to reply to you and correct errors you point out. Basis: legitimate interest (art. 6.1 f)
• Image uploads, to be able to review and publish the contribution. Basis: consent (art. 6.1 a), which you give by uploading
• Purchase of a property report, to perform the order. Basis: contract (art. 6.1 b), and for the accounting a legal obligation (art. 6.1 c)
• Account and login emails, to sign you in and let what you save follow you to your devices. Basis: contract (Art. 6.1 b)
• Mushroom alerts, to email you when conditions are good for mushrooms. Basis: consent (Art. 6.1 a), confirmed by email and revocable at any time
• The municipality cup, to show the leaderboard. Basis: legitimate interest (Art. 6.1 f)
• AI features, to interpret what you type and limit the number of questions. Basis: legitimate interest (Art. 6.1 f)

You do not need to provide any data to use the map, the statistics or any other part of the site. For accounts, newsletters, mushroom alerts and report purchases the email address is necessary: without it we cannot sign you in, send the mailing or deliver the report, and the purchase cannot be completed.

Where we rely on legitimate interest we have weighed our interest against your privacy, one processing operation at a time. For the operational logs the interest is being able to run and troubleshoot the server and detect abuse such as automated bulk downloading, which recital 49 of the General Data Protection Regulation explicitly identifies. For the visitor statistics the interest is seeing which pages are used and improving them. For feedback and contact it is being able to answer you and correct what you point out.

The intrusion into your privacy is small: the statistics are collected without cookies and without storing your IP address, they are never broken down to an individual visitor, and we cannot follow you between visits or between websites. We nevertheless treat them as personal data for as long as it cannot be ruled out that an individual could be distinguished, and rely on legitimate interest in doing so. The operational logs contain IP addresses but are not used to build profiles and are not linked to any other data about you. None of the processing is used for marketing directed at you.

Our assessment is that you can reasonably expect this processing when you visit a website.

You have the right to object to this processing at any time. Email kontakt@mapandmove.se, and we will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests.

We do not keep data longer than the purpose requires:

• The web server's operational logs: is rotated daily and deleted after 14 days. The same applies to the server's system log, where the same data may appear. The totals of viewed map areas contain no personal data and are kept until further notice
• Visitor statistics: is stored in Plausible for 25 months and then deleted automatically. It is only shown aggregated and never broken down to an individual visitor
• Newsletter address: an unconfirmed signup never becomes a recipient. A confirmed address is kept until you end the subscription, after which it is deleted entirely
• Account: an account unused for 24 months is deleted automatically, along with everything saved in it. You can delete it yourself at any time on the Account page
• Messages sent via the feedback and contact forms: deleted automatically after 24 months. You may request earlier deletion
• Uploaded images: rejected contributions have their images deleted immediately on rejection. Approved images remain for as long as they are published, and are removed when you ask us to
• Report PDF: deleted automatically after 30 days. The email address in the order: anonymised automatically after 12 months
• Municipality cup scores: deleted automatically after 90 days
• Accounting records for purchases: kept through the seventh year after the end of the calendar year in which the financial year ended, under chapter 7, section 2 of the Swedish Accounting Act (1999:1078). That obligation takes precedence over a request for erasure

MapAndMove.se sets no cookies for statistics, advertising or tracking. The only cookie is mm_skal, which is only set if you yourself choose the site's old or new look and which remembers the choice for 30 days. Your settings and saved material are in the browser's local storage and stay on your device as long as you do not sign in. With an account, what you save is synced encrypted to our server, see section 10. Read more in our cookie policy.

We never sell personal data and do not pass it on for anyone else's marketing. The following recipients process data on our behalf or receive it as a consequence of the site being delivered:

• HostUp (Stockholm): our server provider. The website, the database, the statistics and the journey planner run there. Processor
• Plausible Analytics: visitor statistics, which we host ourselves at stats.mapandmove.se. Without cookies and without IP logging. No data is shared with Plausible's company
• The Swedish Public Employment Service (Platsbanken): supplies the job vacancies on a municipality's labour market page. Your browser fetches them directly from their open API when you open the page, and they then see your IP address. All we send along is the municipality code, never anything about you
• Wikimedia Commons: supplies photographs on locality pages and in the map's place cards. Your browser fetches them directly from Wikimedia's servers, which then see your IP address. We never send anything about you
• Mapillary (Meta, USA): supplies the street photo in the map's point card. When you click a place, our server asks Mapillary for the nearest photo and fetches the image, so they receive the coordinate but never your IP address or anything else about you. If you click the image, the photo opens on Mapillary in a new tab, and they then see your IP address and their own terms apply
• Brevo: sends newsletters, mushroom alerts and delivery emails, and is the fallback for login emails. Receives the recipient's email address. Processor
• Migadu (Switzerland): sends the login emails and receives the recipient's email address when doing so. Processor
• Anthropic (USA): the language model Claude Haiku interprets what you type in Ask the map. Receives your question and what the map is showing at that moment, never your IP address or anything else about you
• OpenRouter (USA): passes text to the language model TypeSafe Jev. It is the fallback for Ask the map and interprets search terms with no results on older pages. Receives the text, never your IP address or anything else about you
• Payment provider for report purchases: processes your payment details as an independent controller. We never see or store card details

We may also have to disclose data if we are required to do so by law or by a decision of a public authority.

Map tiles, search, journey planning and municipal data run on our own server. The map is built on open data from sources including OpenStreetMap, but is not fetched from their servers when you use the site, so they receive no information about your visit.

Our server is located in Sweden and our intention is for the data to stay within the EU and EEA.

Three of our suppliers are international: Brevo may process data outside the EU and EEA, and Anthropic and OpenRouter are based in the USA and receive what you type in Ask the map and, on older pages, search terms with no results. Mapillary is owned by Meta in the USA and receives only the coordinate of the place you clicked, nothing about you. Migadu is based in Switzerland, which has an adequacy decision from the European Commission. To the extent a transfer takes place it relies on the European Commission's standard contractual clauses or an adequacy decision. If you would like a copy of the safeguards, contact us.

Most features on the site require no login and leave no trace with us. These are the exceptions:

• The newsletter: when you sign up we send an email with a confirmation link. Only once you have clicked it do we store the address as a recipient, and without that click we send nothing. Every mailing contains a link that ends the subscription immediately and deletes the address from the list
• Feedback and contact: your message is stored together with your IP address, your browser string, which municipality the comment concerns and any email address you provide. Do not write sensitive information in the free text field
• Photo uploads to the digital museum: images are reviewed manually before publication. Location data and other hidden information in the image file (EXIF) is removed automatically on upload, so the photographer's position never travels with it. Do not upload images in which people are recognisable without their consent
• My location on the map: your position is retrieved by the browser only when you click the button yourself and is used to centre the map. If you drop a pin on your location, the coordinate, rounded to about ten metres, is sent to our own server to look up the name of the place, on the same terms as the journey planner below
• The journey planner: the start and end points are sent to our own journey planning server to calculate travel time. They are not stored in any database, but may appear in the web server's operational logs, which are deleted after 14 days. They never leave our server
• The municipality cup (games): if you pick a home municipality, the municipality code, the game and your daily score are stored together with a random id kept by your browser. No name, email or IP address is stored with the score. Rows are deleted after 90 days
• Mushroom alerts on the map: if you ask for an email when mushroom conditions are good, we store your email address, the map centre rounded to about one kilometre, the distance and the species you chose. The emails are sent via Brevo. A request not confirmed within 7 days is deleted, and every email has a link that ends the alert and deletes the row immediately. If you answer whether you found mushrooms, the answer is stored without any link to your address
• Account (optional): if you sign in with email we do not store the address, only a one-way fingerprint of it that cannot be traced back to the address, and what you have saved on the map (municipalities, map pins, views, drawn areas and anything else you saved yourself), encrypted on your device, so that it follows you to your other devices. The login email is sent via Migadu, which receives the address when doing so. The link and the code are valid for 15 minutes and work once. On the Account page you can delete the account, and everything then disappears immediately
• Ask the map and other AI features: what you type in Ask the map is sent via our server to Anthropic together with what the map is showing at that moment (zoom, centre point, municipality and active layers). If Anthropic does not answer, the parts of the question the map could not read go to OpenRouter, and so do search terms with no results in the search box on older pages. The text is not logged by us. The answer to a question may be kept for one day under a one-way fingerprint of the question, and to limit the number of questions we keep a fingerprint of your IP address that changes every day. Do not write personal data in the question. Under NO AI on the Account page you can turn off the AI in Ask the map

Saved municipalities, pins, notes and map settings are stored in your own browser, and with us only if you sign in with an account (see above). If you move them to another device with the "continue on another device" link, the content is in the part of the link's address after #. The browser never sends that part to any server, and our visitor statistics send only the page's address without it. So the content does not pass through us, but anyone who gets the link can read it, so only share it with someone you want to see the content.

We may share aggregated statistics with each Swedish municipality via a private link: number of visitors and page views on the municipality's pages, time on page, which pages were read most, where the visitors came from and which kinds of devices they used. The data never contains personal data and cannot be used to identify individual visitors. It is therefore not a disclosure of personal data within the meaning of the GDPR.

When you order a property report, we process the following data, with a contract as the legal basis (GDPR art. 6.1 b):

• Email address: used to deliver the report and the order confirmation. Anonymised in the order after 12 months
• Order details (property designation, amount, timestamp, consent): kept as records for accounting and support
• The report PDF: stored for 30 days for delivery and resending, then deleted automatically
• Processors: the delivery email is sent via Brevo. The payment provider processes your payment details as an independent controller, and we never see or store card details

A property report describes a property, not a person. We make no searches on owners or residents and the report contains no personal data about them.

Would you like us to delete your order details early? Contact kontakt@mapandmove.se and state your order reference. We must however retain the accounting records for seven years.

We make no automated decisions producing legal effects concerning you or similarly significantly affecting you, and we do not profile you. Quizzes, tags and matches are calculated in your own browser from what you click yourself, and the result is not stored with us.

The site is not directed at children and we do not knowingly collect data about children under 13. If we discover that we have received such data, we delete it.

We take technical and organisational measures under Article 32. All traffic is encrypted over HTTPS. The server is accessed only with key-based login, never with a password, and all data in the administration interface requires a separate login. Uploaded images are re-encoded so that hidden information in the file is removed, and the forms are protected against automated abuse.

If a personal data breach occurs that is likely to result in a risk to your rights, we report it to the Swedish Authority for Privacy Protection within 72 hours, and inform you directly if the risk is high.

Under GDPR, you have the right to:

• Find out whether we process data about you and receive a copy of it (right of access, art. 15)
• Have inaccurate data corrected and incomplete data completed (art. 16)
• Have your data erased when it is no longer needed (art. 17)
• Request that processing be restricted while an objection or rectification is examined (art. 18)
• Object to processing based on legitimate interest (art. 21)
• Receive the data you provided yourself in a machine-readable format or have it transferred to someone else (art. 20)
• Withdraw a consent at any time, without affecting processing already carried out (art. 7.3)
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy@imy.se

You exercise these rights by emailing kontakt@mapandmove.se. We reply without undue delay and within one month at the latest. If the request is complex we may extend this by two months, and we will then tell you why. It is free of charge.

Since the account does not store your email address and the visitor statistics have no link to individuals, we often cannot tell which data are yours. We may then need something that ties you to the data, such as your order reference or the email address you used. If we cannot identify you we are not obliged to disclose anything, and we never ask for more information than necessary to respond.

We may update this policy as the site changes. The date at the top shows when it was last amended, and the published version is the one that applies. For material changes requiring your consent, we obtain it before the change takes effect.

This policy describes how we process personal data and is not legal advice. The content and figures on the site are covered by the disclaimer in our terms of use.