Privacy Policy

OSRMRoute is a trading name of MAMMADOFF AGENCY LLC (TIN 7200653321), Baku, Azerbaijan. This Policy covers our marketing sites, developer APIs, dashboard and SDKs.

We are the controller of the personal data described in this Policy. For personal data of your end users that you send to our geocoding, routing, matrix, optimization or places endpoints, you are the controller and we act as your processor under our Data Processing Addendum (DPA).

Privacy contact: [email protected]. If you are in the EEA or the United Kingdom and require the contact details of our data-protection representative, or wish to raise any data-protection matter, please email [email protected].

We collect the following categories of data:

• Account data — the email address you register with and a securely hashed version of your password (never stored in plain text).
• Profile & billing data — optional name/company and billing details; card/payment data is handled by our payment processor and is never stored on our servers.
• API keys and configuration — the keys you generate and their plan, limits and restriction settings.
• Request metadata — for each API request we log the API key ID, the requested endpoint/path, the source IP address, the HTTP status, the response latency and a timestamp (and user-agent for website requests).
• Query content — the coordinates, addresses and search terms you send, processed to return results (see Section 3).
• Cookies & similar — a strictly necessary authentication cookie and, with consent, analytics cookies (Section 5).
• We do not buy, rent or enrich personal data from data brokers.

When you call our geocoding, routing, matrix, optimization or places endpoints, the addresses, place names and coordinates you submit may contain personal data of your end users, and may reveal a person’s location, home or workplace. We treat such location data with elevated care.

For that query content you are the controller and we are your processor, processing it only to return results and to operate, secure and meter the Service, under our DPA. We do not sell query content, do not use it to build or maintain end-user profiles, and do not use it to train AI or machine-learning systems. Query content is processed transiently to produce a result and is not retained as a separate profile.

You are responsible for having a lawful basis to submit such data and for providing any required notices to your end users.

We process personal data for the purposes and on the legal bases below (Article 6 EU/UK GDPR, where it applies to you). Where we rely on legitimate interests, we balance them against your rights and freedoms. For query content, the legal basis for the underlying personal data is your responsibility as controller.

We use the cookies below. Analytics cookies load only after you accept them in our cookie banner; you can withdraw consent at any time by clearing the site’s storage. The dashboard may not function without the authentication cookie.

We honor the Global Privacy Control (GPC) and “Do Not Track” signals as an opt-out of any analytics that could be considered a “sale” or “share”; we do not run advertising cookies or cross-context behavioral advertising.

We do not sell personal data. We share it only with the sub-processors and parties below, under confidentiality and data-protection obligations. A current sub-processor list is available on request at [email protected].

We also disclose data to authorities or third parties where required by law, legal process, or to protect rights, safety and security, and to a successor in a merger, acquisition or asset sale (subject to this Policy).

We are established in Azerbaijan, a country outside the EEA/UK. Where we or our sub-processors transfer personal data out of the EEA, the UK or Switzerland, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (2021/914), the UK International Data Transfer Agreement or Addendum, and the Swiss amendments, or an adequacy decision where available.

Transfers of EEA/UK personal data to MAMMADOFF AGENCY LLC in Azerbaijan are covered by the Standard Contractual Clauses in our DPA. Where our US-based sub-processors are certified under the EU-US Data Privacy Framework, that provides an additional safeguard.

We keep personal data only as long as necessary for the purposes above. Indicative periods:

We use technical and organizational measures to protect personal data, including password hashing, encrypted transport (HTTPS/TLS), scoped access controls, per-key restriction controls, network isolation of our databases and least-privilege access for staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If the GDPR or UK GDPR applies to you, you have the rights to access, rectification, erasure, restriction, objection, portability, and to withdraw consent at any time without affecting prior processing. To exercise them, email [email protected]. You also have the right to lodge a complaint with your local supervisory authority (for example, your national data protection authority; UK residents may contact the ICO).

Notice at collection: we collect the categories in Section 2 for the purposes in Section 4; we retain them per Section 8; and we do NOT sell or “share” personal data as those terms are defined under the CCPA/CPRA. Precise geolocation submitted as query content is treated as sensitive personal information and processed only to provide the Service.

If you are a resident of California (CCPA/CPRA) or a state with a comparable law (including Virginia, Colorado, Connecticut, Texas, Utah and Oregon), you may have the rights to know/access, delete, correct, opt out of sale/sharing and targeted advertising, limit the use of sensitive personal information, and to non-discrimination for exercising your rights. Where a request is denied, you may appeal by replying to our response; we will respond within the period required by your state’s law.

To exercise these rights, email [email protected]. We may need to verify your identity, and you may use an authorized agent with proof of authorization.

We do not carry out automated decision-making that produces legal or similarly significant effects on individuals within the meaning of Article 22 GDPR, and we do not profile your end users.

The Service is a developer/business product not directed to children. We do not knowingly collect personal data from children under 16 (EEA) or under 13 (US/COPPA, UK). If you believe a child has provided us data, contact us and we will delete it.

If a personal data breach affects data for which we are the controller, we will notify the relevant supervisory authority and affected individuals as and where required by law (including the GDPR’s 72-hour authority-notification standard and applicable US state breach-notification laws). Our obligations as a processor are set out in the DPA.

Our results derive from open datasets, principally OpenStreetMap (ODbL) and Overture Maps. Reverse geocoding and places search can return information that appears in those public datasets (for example a business name or a building address) that we did not receive from you. We are not the controller of that upstream source data; requests to change a map feature should be directed to the relevant open-data project (e.g. openstreetmap.org).

We may update this Policy from time to time. We will post the updated version with a new “last updated” date and, for material changes, provide advance notice by email or in the dashboard before they take effect.

Data controller: MAMMADOFF AGENCY LLC (TIN 7200653321), Baku, Azerbaijan. Privacy contact: [email protected]. EEA/UK users may request our data-protection representative details at the same address and have the right to complain to their local supervisory authority. See also our Data Processing Addendum.