Privacy Policy
Last updated 22 October 2026
Marshalmap helps event organisers run their crews from a live venue map. This page explains what personal data the service handles, why, how long it is kept, who helps us run it, and how you can use your rights under the GDPR.
Who is responsible
Marshalmap is run by Nordcam AS, organisation number 938 070 040, Olav Magnussons veg 16D, 7046 Trondheim, Norway. Nordcam AS is the data controller for the data described below where it says so. Privacy questions and requests: privacy@marshalmap.com.
- For your account, agency and billing details, Marshalmap is the controller: we decide how that data is used.
- For what goes into an event (crew lists, incidents, reports, photos, chat), the organiser who runs the event is the controller and Marshalmap processes it on their behalf, as set out in our Data Processing Agreement. If you work at an event and have a question about its data, ask the organiser first; we help them answer.
What we handle
- Account: your name, email address and, if you use it, your Google profile picture. Passwords are stored only as a secure hash; with "Sign in with Google" we never see your Google password.
- Event content added by organisers and crew: roles, teams and positions on the venue map; incidents, tasks and their status history; written incident reports and photos; private chat messages between crew. Incident details can include health information (for example, a medical incident), which organisers should record only as far as needed.
- Agencies: the agency name and logo, its members and pending invitations (the invited email address).
- Billing: what was bought, the amount, dates and payment references. Card details are handled by Paddle and never reach us.
- Technical: error reports when something breaks, aggregate visitor statistics (pages viewed, referrer, device type, country) and short-lived server logs. Marshalmap does not track your location and does not use advertising cookies.
Why, and on what legal basis
- To provide the service you or your organisation signed up for (contract).
- To keep it secure and working: error reports, logs, abuse prevention (legitimate interest).
- To understand how the site is used, from aggregate statistics only (legitimate interest).
- To keep payment records as Norwegian bookkeeping law requires (legal obligation).
- Event content is processed only on the organiser's instructions (see the DPA).
How long we keep it
| Data | Kept for |
|---|---|
| Free events (map, log, reports, photos, chat, teams) | 6 months after the event's end date (or its last change, if it has no end date) |
| Paid events (with a pass, or under an active agency plan) | 24 months after the event's end date |
| Your account | Until you delete it, or 3 years after your last sign-in |
| Agencies | Until 12 months after the agency has no events and no active plan |
| Unanswered agency invitations | 14 days |
| In-app notifications | 90 days |
| Payment records | 5 years after the end of the financial year |
| Demo events | 1 hour |
| Backups and server logs | Deleted data disappears within 7 days |
Event admins get an email and a notice in the app 30 days before an event is deleted, so there is time to export the PDF debrief and incident log; the same warning goes out before an inactive account or an unused agency is deleted. Event admins can delete an event, and you can delete your account, at any time.
When an account is deleted, its name, email and private chat messages are removed. Entries the person made in events that still exist (for example, incidents they logged) stay for the organiser's records, shown as "Former member". Payment records are kept separately for the bookkeeping period, even after the event, agency or account is deleted.
Who helps us run Marshalmap
These services handle personal data for us, only for the purposes listed:
| Service | Purpose | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | EU (Frankfurt, Germany) |
| Lovable | Hosting the app, error reports and visitor statistics | Sweden; the app is delivered through Cloudflare's network in Europe and worldwide |
| Paddle | Payments, invoices and tax (merchant of record) | EU and United States |
| Resend | Emails such as deletion warnings | EU region |
| "Sign in with Google", only if you choose it | Global |
Where data is handled outside the EU/EEA, we rely on an EU adequacy decision or the EU Standard Contractual Clauses. We never sell personal data.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how it is used, and receive it in a portable format. You can download a copy of your own data yourself at any time: open the account menu (your avatar, top right) and choose Download my data; you can also delete your account there. For anything else, write to privacy@marshalmap.com. For event content, the organiser decides; we pass such requests on and help them answer. You can also complain to the Norwegian Data Protection Authority, Datatilsynet, or the authority where you live.
Security
Data is stored in the EU and encrypted in transit. Access is limited by role: crew see only the events they belong to, private messages are visible only to their two participants, and events become read-only after they are archived or their pass ends.
Cookies and browser storage
Marshalmap stores your sign-in session, your light or dark theme choice and your setup progress in your browser. These are needed for the app to work and are not used for advertising or tracking across sites.
Children
Marshalmap is meant for people aged 16 and over.
Changes
If this policy changes in a way that matters, we will update the date above and tell account holders in the app or by email before the change applies.