Privacy Policy

Last updated: February 11, 2026

Effective date: February 11, 2026

Your Privacy Matters

We are committed to protecting your privacy and being transparent about our data practices. This policy explains what data we collect, why we collect it, and your rights regarding your personal information.

1. Introduction & Scope

PsychoactiveMap ("we," "our," or "us") operates the website psychoactivemap.com (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform.

This policy applies to all visitors, users, and others who access the Platform. By using our Platform, you agree to the collection and use of information in accordance with this policy.

Data Controller: PsychoactiveMap operates as the data controller for personal data collected through this Platform.

2. Information We Collect

We collect the following types of information:

a) Newsletter Subscriptions

Email address
Subscription date and time
Research interests (optional)

b) Contact Form Submissions

Name and email address
Message type (bug report, feature request, general inquiry)
Subject and message content
Submission timestamp

c) Automatically Collected Information

IP address
Browser type and version
Device information (type, operating system)
Referring website/URL
Pages visited and time spent on pages
Geographic location (approximate, based on IP)

d) Cookies & Local Storage

Essential cookies for Platform functionality
User preferences (theme, map style)

We do NOT collect: Social Security numbers, financial information, health records, or any Protected Health Information (PHI).

3. How We Use Your Information

We use collected information for the following purposes:

Newsletter Communications: Send research updates and news about psychedelic research (only with your consent)
Contact Inquiries: Respond to bug reports, feature requests, and general inquiries
Platform Improvement: Analyze usage patterns to improve functionality, user experience, and content
Security & Fraud Prevention: Detect and prevent abuse, spam, and unauthorized access
Legal Compliance: Comply with legal obligations, enforce our terms, and protect our rights
Analytics: Understand how users interact with the Platform to make data-driven improvements

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data based on the following legal grounds:

Consent: Newsletter subscriptions and analytics cookies (you can withdraw consent anytime)
Legitimate Interests: Platform analytics, security measures, and fraud prevention
Legal Obligation: Data retention for security auditing and compliance

6. Cookies & Tracking Technologies

We use cookies and similar technologies for the following purposes:

Essential Cookies (Required)

Purpose: Authentication, security, and core functionality

Examples: Login session tokens, CSRF protection

Can be disabled: No (required for Platform to function)

Preference Cookies

Purpose: Remember your settings (theme, map style)

Examples: Dark mode preference, selected jurisdiction

Can be disabled: Yes (but settings won't be saved)

Analytics (Built-in)

Purpose: Understand how visitors use the Platform to improve user experience

Provider: Lovable built-in analytics (part of the hosting platform)

Data Collected: Aggregated, anonymized usage metrics such as page views and visitor counts

Privacy Protections:

No third-party analytics cookies are set
No personal identification is collected
Data is not shared with third parties for advertising

How to manage cookies: You can control analytics cookies through our cookie banner when you first visit, or change your preference anytime using the "Cookie Settings" link in the footer. Essential cookies cannot be disabled as they are required for the Platform to function.

7. Your Privacy Rights

Your Rights at a Glance

You have control over your personal data. Depending on your location, you may have the following rights.

For EEA Users (GDPR Rights):

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten"): Request deletion of your data
Right to Data Portability: Receive your data in a machine-readable format
Right to Restrict Processing: Limit how we use your data
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent for newsletter or other consented activities
Right to Lodge a Complaint: File a complaint with your data protection authority

For California Users (CCPA/CPRA Rights):

Right to Know: What personal information we collect and how we use it
Right to Delete: Request deletion of your personal information
Right to Opt-Out: Opt-out of sale of personal information (we don't sell data)
Right to Non-Discrimination: Not be discriminated against for exercising your rights

How to Exercise Your Rights:

To exercise any of these rights, please contact us with your request. We will respond within 30 days.

8. Data Retention

We retain personal data for as long as necessary to fulfill the purposes outlined in this policy:

Newsletter Subscriptions: Until you unsubscribe
Contact Messages: For a reasonable period to resolve inquiries and maintain records
Analytics Data: Aggregated and anonymized periodically

After the retention period, data is securely deleted or anonymized so it can no longer identify you.

9. Data Security Measures

We implement industry-standard security measures to protect your data:

Encryption in Transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
Encryption at Rest: Databases and storage are encrypted by our infrastructure provider
Access Controls: Row-level security (RLS) policies restrict data access to authorized users only
Security Monitoring: Systems are monitored for unauthorized access and suspicious activity
Regular Security Updates: We keep our systems and dependencies up to date with security patches

Data Breach Notification: In the event of a data breach that affects your personal information, we will notify you and relevant authorities within 72 hours as required by GDPR.

10. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States, where our hosting provider operates.

For EEA users, we ensure adequate protection through:

Standard Contractual Clauses (SCCs) approved by the European Commission
Compliance with GDPR requirements for international transfers
Infrastructure providers that are GDPR-compliant

11. Children's Privacy

Our Platform is not intended for children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will delete such information from our systems within 30 days.

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will:

Update the "Last Updated" date at the top of this policy
Display a prominent notice on the Platform for 30 days

Your continued use of the Platform after changes become effective constitutes acceptance of the updated policy. If you do not agree to changes, please discontinue use.

14. Contact for Privacy Matters

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Privacy Contact:

Use our Contact Form

We aim to respond to all privacy-related inquiries within 30 days.

EU Users: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

Related: Terms of Service, Disclaimer