Legal

Map Data, Attribution and Licensing

Whose data is underneath your design, what each source asks for in return, and what that means when you export, print or publish.

Last updated 29 September 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the operator’s address, several retention periods, confirmation of which provider agreements are actually signed, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

35 outstanding items— show

serviceable postal address — the address the Impressum, the Terms and the withdrawal notice are all served at
commercial-register entry — whether registration as a Kaufmann applies, and the court and HRB number if it does
VAT identification number — whether one is assigned at all under the Kleinunternehmer rule, and the number if it is
second direct contact channel under §5 DDG — a telephone number, or another channel a person actually answers quickly
how the current-month refund promise applies to an annual plan — a twelfth, the unused remainder, or not at all. Decide before an annual plan is sold
the refund window on a founding lifetime purchase — 30 days from payment is the reading this draft assumes, and it needs confirming rather than inheriting subscription wording
languages the DSA contact point is answered in — the ones a person can actually handle, not the ones the interface is translated into
the seller for a paid contract — for a Paddle purchase, the Paddle entity named at checkout and on the invoice, with its postal address and email
Review of all ten documents, the Impressum and the implementation-fund rules by a lawyer in Germany — after the operator's address and registration position are settled, because that is half of what counsel checks.
Whether a data protection officer has to be appointed despite the headcount, which turns on whether location-linked consultation and survey responses amount to processing that requires a data protection impact assessment.
The roles in each institutional feature — whether a municipality is a controller, our controller, or a joint controller for consultations, residency registers and street reports — and the agreement that follows from each answer.
Which provider arrangements are actually signed, in which regions, and under which transfer mechanism. The provider table states what the code configures, which is not the same as a countersigned contract.
Whether the service is an online platform under the Digital Services Act rather than only a hosting service, and which of the platform duties the micro and small enterprise exemption removes.
Whether direct access to the production database is logged, and whether a backup restore has ever actually been run.
which accounting records fall in the 10, 8 and 6-year tiers of §147 AO — the periods differ by document class and run from the end of the calendar year, and the old ten-years-for-everything line was over-retention
when an invitation that is never accepted expires — it is an access grant sitting open, and "until somebody revokes it" is not a period
a period per category for correspondence — handling, then a justified follow-up or claims window. "Until somebody asks us to remove it" is not a retention period, it is the absence of one
how long verification evidence is kept after the thing it verified is decided — the decision has to outlast it, the document usually does not
when a waiting-list subscription expires if the list is never used — it survives account deletion, because it was left without needing an account
how long the identifiers that survive a webhook payload are kept — they are what stops a duplicate, and they are still linkable to a transaction
whether attribution should expire before the account does — it answers a question about a signup that stops being asked long before the account closes
the purpose and lawful ground for keeping a country code on the signup record. It is written whether or not attribution was accepted, which the privacy policy used to deny, and currency presentation does not need it stored
the retention configured on the analytics project, and whether an erasure here propagates to it
how long the evidence of a rights request is kept after it is met — a justified period, rather than "kept"
a schedule per civic feature, and the controller each one belongs to. A municipality running a consultation sets its own period; where we set it, it has to be written down
each provider's own log retention, and the maximum age of a backup before it expires
a justified maximum for the staff audit log, and the rule that reviews it. The 180-day expiry of the identifying half is enforced; the row itself has no end
a justified maximum for the record of a support session — somebody here opening your account to help — on the same footing as the staff audit log above
where the Photon instance we call actually runs, and who operates it
where the Nominatim instance we fall back to is hosted — the Foundation's establishment and its servers are separate questions
the session cookie's lifetime in production, and how it refreshes — a provider default is not an inventory
the `__client_uat` cookie's lifetime in production — the same question as the session cookie above, and the same answer is not safe to assume
a production cookie and storage inventory — signed out, signed in, on the map and through checkout. The lists on this page come from the code, which cannot see what a provider sets
whether the preference keys are exempt as part of a service you expressly requested, or have to be gated by consent
a persistent control for reviewing or withdrawing cookie consent — the banner does not come back once a choice is stored, and clearing site data in the browser is not the same thing

1. The short version

Your design is yours. The map underneath it is not, and it comes with conditions that travel with every copy you make.

Keep the credit that is drawn into an export. Do not crop it off.
A picture, an extracted dataset and material fed to a model are three different things under these licenses.
Turning the basemap off does not clear the obligations for anything else still in the file.

2. What is on your screen

The basemaps, and where each one's data comes from
Layer	Source	License
Streets (MapTiler streets-v2)	MapTiler, from OpenStreetMap data	MapTiler's terms · ODbL
Light (MapTiler dataviz-light)	MapTiler, from OpenStreetMap data	MapTiler's terms · ODbL
Satellite (MapTiler hybrid)	A MapTiler composite: Copernicus Sentinel-2 (ESA, processed by EOX IT Services), Maxar, NASA Earth Observatory and Goddard, USGS EROS, and national mapping agencies where one covers the area — Spain's PNOA among them	MapTiler's terms, and each provider's own — several of the national sets are CC BY 4.0 or an open government license
Terrain (MapTiler outdoor-v2)	MapTiler, from OpenStreetMap data	MapTiler's terms · ODbL

Everything else on screen that comes from somebody else
Layer	Source	License
Terrain elevation, under the Terrain basemap	SRTM 1ARC (USGS), ASTER GDEM (METI and NASA), EU-DEM (produced using Copernicus data), and bathymetry processed by NASA	MapTiler's terms, and each provider's own
The editor's map, on plans that include it (Mapbox Standard and Standard Satellite)	Mapbox, from OpenStreetMap data, with satellite imagery from Mapbox's own providers	Mapbox's terms · ODbL
Building footprints	OpenStreetMap contributors	ODbL
Address and place search	Photon (Komoot), with Nominatim (OpenStreetMap Foundation) behind it	ODbL

These tables are generated from the basemap list the editor actually offers, so a new basemap cannot ship without appearing here. They name providers rather than every regional dataset: satellite imagery in particular changes source by area, and MapTiler’s copyright page is where the per-country sets for the area you are looking at are listed.

3. OpenStreetMap

OpenStreetMap data is available under the Open Database License. Keep the acknowledgement of OpenStreetMap contributors and the information about the license with anything derived from it.

A picture and a database are not the same thing

A rendered image made from the data is a Produced Work: credit it and you are done. Extracting or adapting the underlying data — which is what a vector or CAD export can do — produces a Derivative Database instead, and share-alike obligations attach to that differently.

Which one you have depends on what you actually extracted, adapted and then distributed. The ODbL does not take ownership of a design you drew yourself; it also does not turn imported geometry into unrestricted original work just because it now appears inside a StreetShape plan.

4. Exports, printing and the credit

Every image exported from StreetShape carries the credit for the basemap it was made with, drawn into the frame with nothing to switch it off. Depending on which basemap you used, that credit reads:

Do not remove or obscure it. When you crop, print, drop the image into a report or cut it into a video, keep the attribution in the form that use requires — MapTiler’s terms ask for a credit comparable to the on-screen one on printed maps, images and video recordings, which is what makes putting a satellite basemap on a printed sheet permitted in the first place.

The strings above are the constants the exporter draws, quoted rather than retyped, so this page cannot promise one credit while the picture carries another. They describe the current configuration: whether they are sufficient for every geographic source and every output is worth checking against the copyright page for the area, and additional source-specific notices apply where they do.

Hiding the basemap is not a way out

Switching the basemap off removes MapTiler’s cartography from the frame. It does not remove imported data, imagery or any other third-party asset still in the export, and whatever those require is still required. A credit generated by software is also not a permission: it satisfies an attribution condition, it does not widen what the underlying license allows.

5. Imagery, redistribution and machine processing

Displaying, printing, publishing, reusing commercially, redistributing raw data and processing material by machine are separate permissions, and having one does not give you another. Check MapTiler’s terms, their Cloud terms, the plan actually contracted and any source-specific restriction for the output you have in mind.

In particular: permission under the ODbL for the street data underneath does not license MapTiler’s cartography or the satellite imagery on the same terms. Those are different works from different rights holders.

Do not bulk-download, cache, resell or redistribute tiles or imagery except where that is expressly permitted.
Do not use provider imagery or data to train machine-learning models, or for other restricted processing, without the rights to do it.

The satellite basemap is a composite, and the elevation behind the terrain basemap is assembled from several datasets. The tables above name the providers; the required credit for a particular area can include more than they do.

6. Address search

Address and place search is answered by Photon, with Nominatim behind it, both working from OpenStreetMap data — so the same attribution and the same license apply to what comes back. What happens to the text you type is in the privacy policy.

7. Contributing back

If the map is wrong — a missing street, a junction that has been rebuilt, a cycle lane nobody has drawn yet — the fix belongs in OpenStreetMap rather than in a message to us. Everyone using that data gets the correction, including you, the next time the tiles are rebuilt.

8. Software

StreetShape is built on open-source software. Among it:

MapLibre GL JS — BSD-3-Clause
Next.js — MIT
React — MIT
Tailwind CSS — MIT

This is not the complete third-party notice — that is a build output rather than a hand-written list. The copyright, license and notice texts each component’s license requires travel with the distributed component.

9. Getting a credit wrong

Tell us

If a credit here is missing or wrong, write to hello@streetshape.org. We will check it and fix what is actually wrong. An attribution page that is confidently incorrect is worse than one with a visible gap, because it looks like the obligation was discharged.