Privacy Policy
Last updated: 2026-10-12
The short version
We collect the minimum we need to make your poster and get it to you.
If you connect Strava, we read the activity you choose so we can draw its route. We do not read your whole account, we do not show your data to anyone else, and we do not sell it to anybody, ever.
We keep your order details so we can reprint if something goes wrong. You can ask us to delete everything at any time and we will.
1. Who we are
Elevated Trail Maps ("ETM", "we", "us") sells printed and digital trail posters at elevatedtrailmaps.com.
Operated by: Claudio Afonso, trading as New Age Design Co., a sole proprietorship registered in British Columbia, Canada
Location: British Columbia, Canada
Accountable for privacy: Claudio Afonso
Privacy contact: privacy@elevatedtrailmaps.com
Postal address:
PO Box 30042
North Vancouver RPO Parkgate VLG
BC V7H 2Y8
Canada
This policy applies to elevatedtrailmaps.com and everything we do through it. It does not apply to Strava, Etsy, or any other site we link to. Those have their own policies.
2. What we collect
2.1 What you give us directly
| What | When | Why |
|---|---|---|
| Email address | At checkout, or when you subscribe | Order confirmation, delivery updates, support |
| Shipping name and address | At checkout, for physical orders | To ship your poster |
| Poster title and any custom text | In the builder | It gets printed on your poster |
| Support messages | When you contact us | To answer you |
2.2 Route and activity data
If you use the custom poster builder, we collect the route of the activity you choose. That means GPS coordinates, distance, elevation gain, moving time, and the activity name and date.
There are two ways this reaches us:
Connecting Strava. You are sent to Strava to sign in. We never see your Strava password. Strava gives us a token that lets us read your activity list and the details of activities you select. We request the minimum scope we need to do that. We do not post to Strava, we do not read your followers, your messages, your segments, or anyone else's activities.
Uploading a GPX file. You upload the file yourself and we read the route out of it. Nothing is connected to any account.
2.3 Payment information
We do not see, handle, or store your card number. Payments run through Stripe, which is PCI-DSS compliant. Stripe tells us whether a payment succeeded, the amount, and a reference number. That is all we get.
2.4 Collected automatically
Standard server logs from our hosting provider: IP address, browser type, pages requested, timestamps. We use these to keep the site running and to investigate faults.
2.5 What we do not collect
We do not require an account. We do not build profiles of you, and we do not combine your Strava data with anything else. We do not sell your personal information.
3. Why we collect it
We use your information only for these purposes:
- To make and deliver your order. Rendering the poster, sending the print file to our print partner, shipping it, emailing you a confirmation and tracking link.
- To support you. Answering questions, resolving problems, processing refunds and reprints.
- To reprint if something goes wrong. If your poster arrives damaged or misprinted, we need the original file to reprint it.
- To keep the site working. Diagnosing errors, preventing fraud and abuse.
- To email you, if you asked us to. Only if you subscribed. Every marketing email has an unsubscribe link and we honour it.
We do not use your data for anything else. Specifically, we do not use it to train artificial intelligence or machine learning models, and we do not perform analytics on route data. Strava's API terms prohibit both, and we would not do it anyway.
4. Consent, and how to withdraw it
For most of what we collect, your consent is given by using the service. You enter a shipping address because you want the poster shipped.
For Strava, consent is explicit. You authorise the connection on Strava's own screen, and you can revoke it at any time.
To withdraw consent:
- Strava: go to your Strava account settings, under My Apps, and revoke access for Elevated Trail Maps. This immediately stops us reading anything further. To also delete what we already hold, email us (see section 9).
- Marketing email: email us and we will remove you from the list. We have not sent any marketing email yet; once we do, every one will carry an unsubscribe link.
- Everything else: email privacy@elevatedtrailmaps.com and ask.
Withdrawing consent does not affect anything we did lawfully before you withdrew it. If you withdraw consent while an order is in production, we may need to finish or cancel that order, and we will tell you which.
If we ever change the type of data we collect from Strava, we will tell you and ask for your consent to the new scope before collecting it.
5. Who we share it with
We do not sell your personal information. We have never sold it and we will not.
We share only what each of these providers needs to do its job:
| Provider | What they get | What for | Where |
|---|---|---|---|
| Stripe | Email, billing details, payment info | Processing payments | US / global |
| Gelato | Shipping name and address, the print file | Printing and shipping your poster | Global print network |
| Resend | Email address, order details | Sending order emails | US |
| Vercel | Server log data | Hosting the site | Global |
| Neon | Order records | Database hosting | AWS US West (Oregon), us-west-2 |
| Cloudflare R2 | Your print file | File storage | Global |
| Amazon Web Services | Elevation tile requests covering the geographic area of your route | Rendering terrain contours on your poster | US / global |
Elevation data is requested by our servers, not by your browser. Your IP address and device are never exposed to the elevation data host. What is sent is the geographic area your route covers, with no name, email, or identifier attached to it.
We may also disclose information if the law requires it, for example in response to a valid court order, or if we need to establish or defend a legal claim.
If ETM is ever sold or merged, your information may transfer to the new owner. We would tell you first.
6. Where your data goes
ETM is based in Canada, but our providers operate internationally, and your data will be processed outside Canada, including in the United States and the European Union.
Gelato routes each order to whichever print facility is closest to your delivery address, which means your shipping details go to that facility's country.
While your data is outside Canada it is subject to the laws of that country, and foreign courts and authorities may in some circumstances be able to access it. We remain responsible for your information wherever it is processed, and we use contractual protections with our providers to keep it protected to a comparable standard.
Where personal data is transferred out of the EEA or the UK, that transfer relies on Standard Contractual Clauses or an equivalent approved mechanism.
7. How long we keep things
| What | How long | Why |
|---|---|---|
| Route and activity data from Strava | 12 months after your order | So we can reprint if your poster is damaged or lost |
| Uploaded GPX files | Never uploaded, never stored | Your browser reads the file and sends us only the route coordinates, which are kept as above. The file itself never leaves your device. |
| Print files | 12 months after your order | Same |
| Order records (email, address, amount) | At least 7 years | Canadian tax and business record requirements |
| Poster specification (the title and location you typed, size, colour, finish, which stats you chose) | At least 7 years, with the order record | It is the record of what you actually bought |
| Marketing subscriptions | Until you ask to be removed | Email address only, from the newsletter form |
| Server logs | 1 day | Fault diagnosis. Held and expired by our hosting provider, not by us. |
| Abandoned drafts (poster started but never ordered) | 30 days |
The words you put on your poster (the title and the location line) are kept with the order record for the same seven years, rather than being deleted with the route at twelve months. Both the wording and the route are yours: the title and location start out prefilled from your Strava activity, but you can type anything you like over them, and what you chose to have printed is your own wording rather than a record of where you physically were. The route coordinates, which are that record, are deleted on the twelve-month schedule above, along with the distance, elevation and time figures calculated from them.
Your builder draft is also saved in your own browser's local storage so you do not lose your work if you navigate away. That copy sits on your device, not our servers, and clearing your browser data removes it.
If you never place an order, we delete route data we hold for you within 30 days.
8. Strava, specifically
What we take from Strava. Your name and profile identifier, your list of activities, and for the activities you choose: the route polyline, distance, elevation, moving time, activity type, name and date.
How we take it. Through Strava's official API, using a token you authorised. We never ask for or see your Strava password.
Who sees it. Only you. We do not display your Strava data to any other user, we do not publish it, and we do not put it in a public gallery. This applies even to activities you have set to public on Strava.
Deleting Strava activities. If you delete an activity on Strava, we stop using it within 48 hours. If you have already ordered a poster of that activity, we will still print and ship what you paid for.
If you revoke access or delete your Strava account, we permanently delete all Strava-derived data we hold about you within 30 days, and we will confirm in writing when it is done. The only exception is data we are legally required to keep, such as tax records of a completed sale, and if that applies we will tell you exactly what we kept and why.
Strava's own data collection. Strava monitors and collects usage data about how applications like ours use its API, and may use that data for its own business purposes. That is Strava's collection, governed by Strava's privacy policy, not ours.
Exporting your Strava data. You can download all of your own Strava data, free, at any time, using Strava's Bulk Data Export tool in your Strava account settings. Nothing here limits that right.
Strava's own privacy policy is at strava.com/legal/privacy. If anything in this policy appears to conflict with Strava's policy in relation to Strava data, Strava's policy governs.
9. Your rights
Whoever and wherever you are, you can:
- Ask what we hold about you. We will tell you, in a readable form, free of charge.
- Ask us to correct it if it is wrong.
- Ask us to delete it. We will, except for records we are legally required to keep, and we will tell you if that applies.
- Withdraw your consent (see section 4).
- Complain if you think we have handled your information badly.
If you are in the EEA or the UK, you also have the right to receive your data in a portable format, to object to or restrict certain processing, and not to be subject to automated decision-making. We do not make automated decisions about you.
If you are in California, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.
How to exercise any of this: email privacy@elevatedtrailmaps.com. We will respond within 30 days. We will not charge you and we will not make it difficult.
If we get it wrong: you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca, or to your own national data protection authority if you are in the EEA or the UK. We would rather you told us first so we can fix it.
10. Cookies and similar technology
We keep this minimal.
Strictly necessary. Session cookies that keep your cart and builder draft working, and Stripe's cookies which are needed to process payment securely and detect fraud. These cannot be turned off without breaking the site.
Local storage. Your builder draft and cart are saved in your browser so they survive a page reload or the trip to Stripe and back. This never leaves your device. We also record, in your browser only, that your order confirmation has already been counted once, so a page refresh does not report the same purchase twice.
Analytics. We use Google Analytics 4 to understand how the site is used. It sets its own cookies and records which pages you visit and, when you buy, the order total and which posters you bought. It never receives your route data, your elevation data, or your Strava information of any kind. We do not run advertising pixels.
Whether it is on depends on where you are browsing from, which we work out from your IP address and do not store:
- In the European Union, the EEA, the United Kingdom and Quebec, it is off until you choose to turn it on.
- In the rest of Canada and in the United States, it is on unless you turn it off. If your browser sends a Global Privacy Control signal, we treat that as turning it off.
- Anywhere else, or if we cannot tell where you are, it is off until you choose to turn it on.
You can change your choice at any time with "Cookie settings" at the bottom of every page. Turning analytics off takes effect straight away, and we remember your choice for 12 months in a cookie on your device.
We do not sell your personal information, and we do not use these tools to build a profile of you for anyone else.
11. Security
We protect your information with encryption in transit (HTTPS everywhere), access controls on our databases and storage, and credentials that are rotated and never shared.
No system is perfectly secure, and we will not pretend otherwise. If a breach happens that creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner of Canada as the law requires, and we will tell you what happened rather than minimising it.
12. Children
ETM is not directed at children. We do not knowingly collect personal information from anyone under 16. Strava's own service is not available to anyone under 13.
If you believe a child has given us personal information, email privacy@elevatedtrailmaps.com and we will delete it.
13. Changes to this policy
If we change this policy we will update the date at the top. If the change is significant, for example if we start collecting a new type of data, we will tell you directly by email before it takes effect, and where consent is required we will ask for it again.
14. Contact
Privacy questions or requests: privacy@elevatedtrailmaps.com
Everything else: support@elevatedtrailmaps.com
Post:
PO Box 30042
North Vancouver RPO Parkgate VLG
BC V7H 2Y8
Canada
We read every message.