Privacy Policy

1. Who we are

MapMySeats is a seating-plan tool, run by a sole trader based in the United Kingdom. We are the data controller for the personal data described in this policy, except where section 4 says otherwise. Contact us at [email protected].

This policy covers the website at mapmyseats.com and the planner application served from it. It does not cover any other site we link to.

2. The short version

• An account needs an email address and a password, and nothing else. You can start a plan before you make one, and it moves across with you when you do.
• We store what you type into a plan: the room, the tables, and your guest list.
• We do not sell data, we do not run advertising, and we do not use analytics or tracking cookies.
• We limit how often requests can be made, to keep bots out. There is no CAPTCHA and no browser fingerprinting.
• You can export everything as CSV or JSON at any time, and deleting a plan deletes it.

3. What we collect

Plan content: the data you type in

Everything in a seating plan is stored on our servers so it is there when you come back:

• Event details: the plan name, event type, event date, venue name and, on the Professional package, the client name and folder you file the plan under.
• The room: tables, chairs, doors, dance floors, labels and any floor-plan image you upload as a background.
• Guests: names, side, guest type, whether they have replied, VIP flag, meal choice, dietary requirements, accessibility needs, email address, phone number, free-text notes, tags, and which seat they are in.
• Revision history: up to the last 50 autosaved versions of a plan, so an accidental change can be undone.

Account data: what signing up involves

You can build a plan before you make an account. When you do make one, we hold:

• Your email address, and a display name if you give one. The address is how you sign in, how we send you a password reset, and how we would reach you about your account.
• A hash of your password, never the password itself. It is hashed with Argon2id, which is designed so the original cannot be worked back out.
• Sign-in records: the time of your last sign-in and the IP address it came from, and a row for each browser you asked to stay signed in on, holding that browser’s user-agent string, its IP address and when it was last used. This is what lets you see and sign out your other devices, and what makes a strange sign-in visible.
• Single-use tokens for verifying your address, resetting a password or changing an email address. Only a hash of each one is stored, and each expires.
• A Google account identifier, if you choose to sign in with Google.
• Whether you agreed to these terms, and when, and whether you opted in to any email that is not about your account.

Technical data: collected automatically

• Server logs. Our web server records the IP address, date and time, the page requested, the response code, the referring page and the browser user-agent string. These logs exist for security and fault-finding.
• Error logs. If something breaks, the error message and the file and line it came from are written to a log. Plan content is not written to error logs.
• Cloudflare edge data. See section 7.

What we deliberately do not collect

No analytics, no advertising or tracking pixels, no fingerprinting, no session recording, no social-media buttons that phone home, and no marketing profile. An account asks for an email address and a password, and that is all: we do not ask for your real name, your address, your phone number or your date of birth, and you can look at the planner before giving us anything.

4. Your guests’ data

Most of the personal data in MapMySeats is not about you. It is about the people you are seating. That matters legally, and it changes who is responsible for what.

Two fields deserve particular care because they are special category data under UK GDPR, which the law treats as more sensitive:

• Dietary requirements can reveal religious belief (halal, kosher) or health (coeliac, allergies).
• Accessibility needs reveal health or disability information.

We recommend recording only what the caterer and the venue actually need on the day, and using the notes field sparingly. You do not need to write down a guest’s diagnosis to seat them near a door.

If a guest asks you to correct or remove their details, you can do it yourself in the guest list. If a guest contacts us directly about a plan we hold, we will point them to you, because we have no way to identify whose plan they are in or to verify their request.

5. Why we may use it, and our lawful bases

Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights, and limited what we collect accordingly, which is why there is no analytics on this site.

6. Cookies and local storage

We set no advertising or analytics cookies, so there is no consent banner to click away. The cookies below are strictly necessary: the site cannot do its job without them, and under the Privacy and Electronic Communications Regulations they are exempt from consent.

The planner also uses your browser’s local storage to remember interface preferences. That data stays in your browser and is never sent to us as a profile. The demo plan runs entirely in your browser and is never saved to our servers at all.

7. Cloudflare and abuse prevention

mapmyseats.com sits behind Cloudflare, which acts as a reverse proxy in front of our servers. Every request therefore passes through Cloudflare’s network, which sees your IP address, the URL requested and your browser headers. Cloudflare uses this to serve content quickly, to filter malicious traffic and to absorb denial-of-service attacks. Cloudflare acts as our processor and is contractually bound to use the data only for these purposes.

How we limit automated abuse

We do not run a CAPTCHA or any browser-fingerprinting bot check. The points that would otherwise be worth abusing — signing in, signing up, resetting a password, creating a plan and uploading a floor-plan image — are protected by rate limiting instead: we count requests against your account, or against your IP address where you have no account, and refuse the ones over the limit.

That means we store a counter keyed to your account id or IP address, which resets on its own and is deleted within two days. It involves no third party, no cookie and no device fingerprinting. We rely on our legitimate interest in keeping the service available and preventing spam.

Cloudflare’s own privacy notice is at cloudflare.com/privacypolicy.

8. Other services we rely on

We do not sell, rent or trade personal data, and we do not share it with anyone else except where we are legally required to, for example in response to a valid court order, or where it is necessary to establish or defend a legal claim.

9. Sharing and share links

A plan is private by default. You can turn on a read-only share link for the venue, the caterer or your guests. When you do:

• the link contains a 40-character random token that cannot realistically be guessed;
• the page is marked noindex, so search engines should not list it;
• anyone who has the link can see the plan, including guest names and the table each person is on, without signing in;
• you can revoke or regenerate the link at any time, which immediately breaks the old one.

Treat a share link like a key under the mat: fine for the caterer, less fine posted in a public group chat. If you are unsure, revoke it after the event.

10. How long we keep things

• Plans and guest lists: until you delete them. Deleting a plan removes the plan, its guests, its tables and its revision history from the live database. Backups may retain a copy for up to 35 days before they rotate out.
• Archived plans: kept in the same way as active ones, until you delete them. Archiving is a way of tidying your list, not a way of deleting.
• Your account: until you delete it. Deleting your account deletes the plans it holds along with it.
• Sign-in records: a remembered-device row lasts until it expires, or until you sign that device out, or until you change your password, which ends every signed-in session at once.
• Plans not attached to an account: ownership rests on a two-year cookie, so a plan that has not been opened for 24 months may be deleted.
• Uploaded floor-plan images: deleted with the plan they belong to.
• Server and error logs: typically 30 days.
• Rate-limit counters: deleted within 2 days.
• Email you send us: up to 24 months after the conversation ends.

11. How we protect it

• All traffic is served over HTTPS.
• Every database query uses prepared statements, so plan content cannot be used to attack the database.
• Every save requires a per-session anti-forgery token, so another site cannot make changes in your name.
• Uploaded images are checked, size-capped, renamed, and stored in a directory that refuses to execute code.
• Configuration and library directories are not reachable over the web, and directory listing is off.
• Output is escaped everywhere it is displayed, so a guest name cannot become a script.
• Share tokens and owner tokens are generated with a cryptographically secure random source.

No system is perfectly secure. If we ever suffer a breach likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell affected users where the law requires it. If you think you have found a security problem, please email [email protected] before disclosing it publicly.

12. International transfers

Plan data is stored in the United Kingdom. Some of the services in section 8, Cloudflare in particular, operate global networks, so request data may be processed outside the UK and the European Economic Area, including in the United States. Where that happens, the transfer is covered by the UK International Data Transfer Addendum or Standard Contractual Clauses, together with the provider’s own technical safeguards.

13. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify anything inaccurate.
• Erase it, in the circumstances the law allows.
• Restrict or object to processing based on legitimate interests.
• Portability: a copy in a machine-readable format.
• Not be subject to solely automated decisions with legal or similarly significant effects. We do not make any.

In practice, the first few you can do faster yourself than we can: Export → JSON gives you a complete, machine-readable copy of a plan, Export → CSV gives you the guest list, the delete button removes a plan for good, and the account page lets you change your email address, change your password, sign out other devices and delete the account outright.

For anything else, email [email protected] from the address your account uses, so we can tell it is you. We will respond within one month. If you write to us about a plan that was never attached to an account, we may be unable to work out which one is yours, and we will not hand over someone’s guest list on a request we cannot verify.

14. Children

MapMySeats is aimed at adults organising events and is not directed at children. We do not knowingly collect data directly from anyone under 13. Children’s names commonly appear in a guest list, entered by the person planning the event; that data is covered by section 4 and should be kept to the minimum needed to seat and feed them.

15. Changes to this policy

We will update this page when what we do changes. The version number and date at the top always reflect the current text. If a change materially affects how we handle your data, we will show a notice in the app before it takes effect.

16. Contact and complaints

Privacy questions, data-rights requests and anything else: [email protected]. Email is the only route we monitor, so please use it rather than any other contact details you may find elsewhere.

If you are not happy with our answer, you can complain to the UK supervisory authority, the Information Commissioner’s Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you gave us the chance to put it right first.

See also our Terms of Service.