Cookie Policy

Effective Date: 2026-07-09 · Document ID: CP-MMA-001 · Contact: info@mapsted.com · Contact UsVersion: 1.0

Document ID: CP-MMA-001 Privacy Officer: privacy@mapsted.com

---

1. Overview

This Cookie Policy explains how Mapsted Corp. uses cookies, localStorage, sessionStorage, IndexedDB, Service Worker caches, Cache API entries, and similar browser storage technologies in connection with:

1. This documentation site (docs.mapsted.com/maps-js-api).
2. The outer-page JavaScript bundle (@mapsted/maps-js-api) loaded into the Licensee's embedding page.
3. The inner Mapsted iframe (maps.mapsted.com) loaded by the Software inside the Licensee's page.

These three contexts operate on different origins and therefore have separate storage scopes. This policy addresses each in turn.

The storage inventory below reflects the Software's current disclosed behaviour for the outer-page wrapper and the inner map iframe at the date of publication. Mapsted reviews and updates this inventory as part of its ongoing compliance process; Licensees may request the latest inventory from privacy@mapsted.com.

2. Definitions

• Cookie: A small text file stored in the user's browser by an HTTP Set-Cookie response header or via document.cookie.
• localStorage: A browser API that stores key-value pairs with no expiry date, persisting until explicitly cleared.
• sessionStorage: A browser API that stores key-value pairs for the duration of the browser tab or window session only.
• IndexedDB: A low-level browser API for storing structured data, including files and blobs, client-side.
• Service Worker cache: Storage managed by a Service Worker script via the Cache API, used for offline and performance caching.
• Cache API: A programmatic interface for storing and retrieving network request/response pairs in the browser.
• First-party storage: Storage set by the domain the user is directly visiting.
• Third-party storage: Storage set by a domain other than the page the user is directly visiting (in this context, the Mapsted iframe domain).
• IAB TCF categories: The five standard storage-purpose categories defined by the IAB Europe Transparency and Consent Framework: Strictly Necessary, Functional, Analytics, Marketing, and Consent-dependent (purpose-specific consent).

3. The Documentation Site (docs.mapsted.com/maps-js-api)

The documentation site is a static site built with VitePress. It sets the following storage:

Item	Type	IAB TCF Category	Purpose	Retention	Legal Basis
vitepress-theme-appearance	localStorage	Functional	Stores the user's light/dark-mode preference	Until cleared by user	Consent required — see note below
VitePress search index cache	localStorage	Strictly Necessary	Caches the local search index to avoid re-downloading on each visit	Until cleared by user or index version changes	Legitimate interest / strictly necessary for the feature the user requested
Code block language preference	localStorage	Functional	Remembers the user's last-selected code language tab (e.g., TypeScript vs. JavaScript)	Until cleared by user	Consent required — see note below

Consent note (ePrivacy / Québec Law 25): Preference-storage items (theme, code-language tab) are not automatically exempt from consent requirements. Under ePrivacy Directive Art. 5(3) and Québec Law 25 s. 8, storing or accessing information on a user's device requires the user's free, specific, informed, and unambiguous consent unless that storage is strictly necessary to provide a service explicitly requested by the user. A theme preference or code-tab selection does not meet the strictly-necessary threshold. Licensees deploying this documentation in EU/UK/Québec contexts should ensure a compliant consent notice is in place.

Cookie-wall prohibition: Access to the documentation site, its content, and the @mapsted/maps-js-api documentation will not be made conditional on a user's consent to non-strictly-necessary storage. Refusing consent for preference or analytics storage will not prevent access to any documentation content.

No advertising, tracking, or cross-site analytics cookies are knowingly set by the documentation site.

4. The Outer-Page JavaScript Bundle (Licensee's Page)

The @mapsted/maps-js-api bundle, when loaded into the Licensee's page, is stateless with respect to browser storage in the Licensee's page origin. It does not set any cookies, localStorage entries, or sessionStorage entries in the Licensee's page origin.

The Software creates an <iframe> element pointing to maps.mapsted.com. Storage set within that iframe operates under the maps.mapsted.com origin — see Section 5 below.

4.1 init() and Consent Gate (EU / UK / Québec Licensees)

When the Software is deployed in a jurisdiction subject to ePrivacy Directive Art. 5(3), the UK Privacy and Electronic Communications Regulations (PECR), or Québec Law 25, Licensees must not call init() until the end user has been presented with a compliant cookie/storage consent notice and has provided the legally required consent for any non-strictly-necessary storage categories.

Calling init() immediately on page load — without waiting for consent — will cause the maps.mapsted.com iframe to load and potentially write storage before the user has consented, placing the Licensee in breach of applicable ePrivacy law.

Recommended pattern: Gate init() inside a callback from the Licensee's CMP (Consent Management Platform) that fires only after the user has granted the relevant consent, or after a strictly-necessary-only analysis has been documented and approved by legal counsel.

4.2 Access Key Query Parameter

When the Licensee passes an accessKey to init(), the Software appends it as a ?key=<accessKey> query parameter to the iframe src URL (see iframeFactory.ts, line 90–94). This means the access key:

• appears in the iframe src attribute in the page DOM;
• may appear in the browser's navigation history for the iframe;
• may appear in Referer / Referrer-Policy-governed request headers sent by resources loaded within the iframe;
• may be captured in server-side access logs at maps.mapsted.com.

Licensees should treat their accessKey as a semi-public identifier and must not rely on query-parameter obscurity for access control. Mapsted Corp. enforces access control server-side at maps.mapsted.com; however, Licensees should be aware of this exposure when sharing HAR files, browser profiles, or server logs.

4.3 Clipboard Permission

The Software sets allow="clipboard-read; clipboard-write" on the iframe element (see iframeFactory.ts, line 64). This grants the maps.mapsted.com iframe the ability to read from and write to the user's system clipboard, subject to the browser's own Permissions Policy rules and any user-level clipboard permission prompts.

Clipboard access is used by the Mapsted Maps application for copy-to-clipboard features (e.g., copying a share URL or address). No clipboard content is transmitted to Mapsted servers unless the user explicitly triggers a feature that does so.

4.4 sandbox Attribute — Absence Decision

The <iframe> element created by the Software does not carry a sandbox attribute. This is an intentional architectural decision: the sandbox attribute, when applied, restricts same-origin script execution, form submission, and storage access in ways that are incompatible with the Mapsted Maps application's requirements for cross-frame postMessage communication, clipboard access, and persistent storage.

The absence of sandbox means the iframe runs in a full browsing context on the maps.mapsted.com origin. It does not elevate the iframe's privileges above those of any other first-party page on that origin.

ITP / Storage Partitioning relevance: Because the iframe operates on a third-party origin relative to the Licensee's page, it is subject to Safari's Intelligent Tracking Prevention (ITP) and Chromium's third-party storage partitioning. These browser mechanisms partition the iframe's storage so that it cannot share storage with maps.mapsted.com when accessed directly. This partitioning is browser-enforced and independent of the sandbox attribute.

5. The Inner Mapsted Iframe (maps.mapsted.com)

The storage inventory below reflects the Software's current disclosed behaviour for the inner map iframe at the date of publication. Mapsted reviews and updates this inventory as part of its ongoing compliance process; Licensees may request the latest inventory from privacy@mapsted.com.

The inner iframe served at maps.mapsted.com uses the following storage within its own origin:

5.1 Cookies (HTTP Set-Cookie)

Item	Type	IAB TCF Category	Purpose	Retention	Legal Basis
No persistent HTTP cookies are currently set by maps.mapsted.com	—	—	The iframe application manages state via sessionStorage and localStorage rather than HTTP cookies	—	—

5.2 sessionStorage and localStorage

Item	Type	IAB TCF Category	Purpose	Retention	Legal Basis	Server-side copy?
Session identifier	sessionStorage	Strictly Necessary	Maintains session continuity for the duration of the map session (single tab)	Tab/session close	Strictly necessary	Session ID is included in API calls to Mapsted backend; server-side access logs are retained for thirty (30) days
User preferences (e.g., selected floor, language override)	sessionStorage or localStorage	Functional	Restores the user's last state within the same session or across sessions	Session or until cleared	Consent required unless confirmed strictly necessary — see Section 3 consent note	Preference data is not synced to Mapsted servers
Crash telemetry opt-in flag	localStorage	Consent-dependent	Records whether the user has opted into crash telemetry	Until cleared by user	Consent	No (flag only; telemetry payloads transmitted separately under consent and retained for twelve (12) months)

Server-side retention note: Items transmitted to Mapsted backend infrastructure (such as session identifiers included in API calls) are subject to server-side retention periods in addition to the browser-side retention shown above. Server access logs are retained for thirty (30) days. Crash telemetry payloads, where the user has opted in, are retained for twelve (12) months.

5.3 IndexedDB

Item	IAB TCF Category	Purpose	Retention	Legal Basis	Server-side copy?
Map tile and asset cache	Strictly Necessary	Caches map tile data and application assets to support offline rendering and reduce network load	Until cleared by user or cache version update	Strictly necessary for the map functionality requested by the user	No

5.4 Service Worker Registrations

Item	IAB TCF Category	Purpose	Retention	Legal Basis
maps.mapsted.com service worker	Strictly Necessary	Enables offline map rendering and accelerates repeat visits by serving cached map assets	Until the user clears site data or the service worker is updated	Strictly necessary for the offline and performance features of the map application

5.5 Cache API

Cache name	IAB TCF Category	Contents	Eviction policy	Legal Basis
Map asset cache (managed by service worker)	Strictly Necessary	Static application assets (scripts, styles, fonts) and map tile responses	Evicted on service worker update or when the user clears site data	Strictly necessary for map application performance

Because the maps.mapsted.com iframe is served from a third-party origin relative to the Licensee's page, it is subject to browser restrictions on third-party storage (e.g., Safari ITP, Chrome third-party storage partitioning). Mapsted Corp.'s architecture is designed to function within these constraints; however, Licensees should be aware that iframe-origin storage is governed by evolving browser policies.

6. Consent Responsibilities

Licensee responsibility: Licensees are responsible for displaying a compliant cookie and storage consent notice on their own pages before calling init() (see Section 4.1). This notice must cover:

1. all cookies and storage set by the Licensee's own application;
2. storage set by the Mapsted iframe (third-party origin), to the extent required by applicable ePrivacy law in the Licensee's target jurisdictions;
3. the clipboard permission granted to the Mapsted iframe (see Section 4.3), where required by applicable law.

Mapsted Corp. does not provide a consent management platform ("CMP") as part of the Service. Licensees must integrate their own CMP and configure it to cover the Mapsted iframe where legally required.

Cookie-wall prohibition (Licensee obligation): Consistent with Recital 32 of the GDPR, guidance from the European Data Protection Board (EDPB), and the requirements of Québec Law 25, Licensees must not condition access to their service or content on the user's consent to non-strictly-necessary cookies or storage set via the Mapsted Maps JavaScript API. Consent must be freely given.

Documentation site: The documentation site does not currently display a cookie consent banner because the storage it sets is limited to strictly-necessary and preference items. Licensees deploying in EU/UK or Québec contexts should assess whether a consent banner is required for preference storage in those jurisdictions.

7. California Residents — CPRA "Sale or Sharing" and GPC Signal

Sale or sharing analysis: The Mapsted Maps JavaScript API does not sell or share personal information for cross-context behavioural advertising as defined under the California Privacy Rights Act (CPRA), Cal. Civ. Code § 1798.100 et seq. The Software creates an iframe pointing to maps.mapsted.com; any data transmitted between the user's browser and maps.mapsted.com constitutes a first-party interaction with Mapsted Corp., not a sale or sharing with a third party for advertising purposes.

Global Privacy Control (GPC): Mapsted Corp. honours Global Privacy Control signals to the extent applicable to first-party processing. The Software does not currently emit or process a GPC signal on behalf of the Licensee's page. Licensees targeting California users are responsible for ensuring their own pages honour the GPC signal and communicate applicable consent state to the Mapsted Maps JavaScript API. California residents may submit privacy rights requests to privacy@mapsted.com; Mapsted will respond within forty-five (45) days, extendable by a further forty-five (45) days with notice.

8. Canadian Residents — PIPEDA and Québec Law 25

PIPEDA meaningful consent: Mapsted Corp. collects and processes information through the Maps JavaScript API in accordance with the principle of meaningful consent under the Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and its provincial equivalents. Meaningful consent requires that individuals understand what information is being collected, why it is being collected, and how it will be used, in plain language accessible to a reasonable person.

Where the Software stores information on a user's device through the Licensee's embedded map, users are entitled to be informed of that storage through the Licensee's own cookie/privacy notice before the storage occurs. Mapsted Corp. provides this policy to enable Licensees to fulfil that disclosure obligation.

Privacy Officer: Questions about Mapsted Corp.'s personal information handling practices, including storage through the Maps JavaScript API, may be directed to Mapsted's Privacy Officer at privacy@mapsted.com.

Escalation — OPC and CAI: If a Canadian user believes their privacy rights have not been respected, they may file a complaint with:

• Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca — for matters governed by PIPEDA or the Privacy Act.
• Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca — for matters governed by Québec Law 25 (Loi 25).

9. EU / UK / EEA Residents — Supervisory Authorities

Users in the European Union, European Economic Area, or United Kingdom who have concerns about Mapsted Corp.'s use of cookies or storage through the Maps JavaScript API may contact their local data protection supervisory authority. A list of EU/EEA supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu. For UK residents, the relevant authority is the Information Commissioner's Office (ICO) at ico.org.uk.

Mapsted Corp. will appoint a formal EU/UK representative under GDPR Art. 27 where required and will update this section accordingly. For GDPR and UK GDPR enquiries, contact privacy@mapsted.com.

10. Managing and Disabling Storage

Users can control or clear browser storage through standard browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Apple Safari: Settings → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and site permissions

Clearing storage may affect the functionality of the map (e.g., losing saved floor preferences). The documentation site's local search and theme preference will also reset.

Disabling all cookies and site storage may prevent the Mapsted Maps iframe from functioning correctly if any strictly-necessary storage is blocked by the browser.

11. Changes to This Policy

Mapsted Corp. may update this Cookie Policy to reflect changes in the Software's storage usage or applicable law. Material changes will be announced on this documentation site with an updated publication date. Licensees may also contact privacy@mapsted.com to request notification of material changes.

---

Related documents

• Privacy Policy — PP-MMA-001
• Terms of Service — TOS-MMA-001
• Legal Hub