Privacy

CostaMap is a map and travel guide to the coasts of Spain. This page explains what personal data we collect, why, which other services are involved, how long we keep it and what you can ask us to do with it. En español.

Who is responsible

CostaMap is run by Ebizapple, Norway (org. no. 991 083 200). Questions about privacy: costamap@ebizapple.no.

Visitors

You can use the maps and guides without giving us any personal data and without an account. CostaMap itself sets no cookies for visitors. Like every website, our web server receives your IP address when your browser asks for a page; our hosting provider uses it to deliver the page and keep the site secure.

Some parts of a page come from other services, and your browser contacts them directly, so they also see your IP address:

  • Map tiles come from OpenStreetMap (tile.openstreetmap.org), run by the OpenStreetMap Foundation. On some pages the map software is loaded from unpkg.com.
  • Google AdSense. Some pages load Google’s advertising script. Google may use cookies and similar technology to show and measure ads. See how Google uses information from sites that use its services.
  • Links to booking and travel sites. Some links are affiliate links: if you book through them, we may earn a commission. Nothing is shared when you only read the page; when you click, the other site knows you came from CostaMap and its own privacy rules apply. We count these clicks per link and page, in the same way as below: no cookies, no IP address stored, only daily totals.

Counting for our advertisers. We count how often a sponsored card is seen and clicked, so we can tell the business what its listing did. This works without cookies and without storing anything in your browser. We do not store your IP address: to stop one person from inflating the numbers, a scrambled code made from it is kept for 10 minutes and then thrown away. Only totals per day are kept.

Ask CostaMap (the chat). The assistant is an AI. Your questions are sent through Make (an automation service, EU servers) to an AI model from Anthropic or, as a backup, Google, which writes the answer. We keep a log of the questions and answers, without your name or IP address, to improve the answers. Please do not write personal data in the chat.

If you ask about advertising

When you send the form on Advertise or Anúnciese, we store your name, business, email, phone (optional), website (optional), type of business, the areas and the kind of space you are interested in, and your message. We use them to reply to you and to prepare a proposal. The request is stored on our website and sent to our email address, and you get a confirmation email with a link to your own page. If the request does not lead to a listing, we delete it 12 months after the last contact.

If you have a listing on CostaMap

  • Your listing: business name, description, type, address, position on the map, website, phone and photo. These are shown publicly on the maps, because that is what a listing is. The contact name and email are not shown.
  • Your own page: the text and photos you send us for your partner page. We use them only for your page. Location data (GPS) inside phone photos is removed when you upload them. Nothing is published before you approve it.
  • Messages: what you and we write in the conversation on your listing page and by email, and a history of changes (for example «approved», «email changed»). Emails to costamap@ebizapple.no are handled by Google (Gmail) and copied into our admin area. We may use an AI model (Anthropic, via Make) to help draft a reply; a person reads and sends every reply.
  • Results: the daily totals of views and clicks on your listing, shown to you and to us, and sent to you once a month by email if we have switched that report on.
  • Login: your email and a password (stored only as a one-way hash). When you log in, a login cookie is set. If you choose «Keep me logged in», it lasts longer.
  • Payments: if you pay online, the payment is handled by our card payment provider (Stripe or SumUp). We never see or store your card details, only whether the payment went through.

We keep listing data as long as the listing exists. After a listing has ended, we keep it for 5 years after the last activity, because Norwegian accounting law asks us to keep records of paid listings, and then delete it. Deleting a listing also deletes its photos, its partner page and your login. Unpaid online orders are moved to the trash after 30 days.

Why we may use the data

  • To answer a request and run your listing: steps before and during a contract (GDPR art. 6(1)(b)).
  • To keep records of payments: a legal obligation (art. 6(1)(c)).
  • To keep the site and forms safe, count views and clicks for advertisers and improve the chat answers: our legitimate interest in running and financing a free guide (art. 6(1)(f)).

Some of the services above are based outside the EU/EEA, for example in the United States. Where data leaves the EEA, it is transferred with the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Security

To stop abuse of the forms and the login, we count attempts for a short time using a scrambled code made from the IP address. The IP address itself is not stored by these counters.

Your rights

You can ask to see the data we have about you, have it corrected or deleted, get a copy, or object to how we use it. Write to costamap@ebizapple.no. You can also complain to a data protection authority: Datatilsynet in Norway, or the Agencia Española de Protección de Datos in Spain.

Last updated: 12 November 2026

Scroll to Top