Privacy Policy
Last updated October 17, 2026
The short version
- Visitors who use a kiosk or scan a QR sign don’t sign in, and we don’t identify them. Their route requests are counted anonymously.
- We collect what we need to run workspaces for our customers: staff names, email addresses, and the maps they create.
- We don’t sell personal information, show ads, or use third-party tracking or analytics.
Who we are
Vertex Wayfinder is an indoor wayfinding service from Vertex Systems LLC (“Vertex”, “we”, “us”). This policy covers this website, the Vertex Wayfinder workspace (Map Studio, management, team and publishing pages), and the kiosk and phone pages that show published maps.
Our customers are organizations, such as hospitals, campuses and workplaces, that use Vertex Wayfinder to publish maps of their buildings. For the maps and workspace content a customer creates, the customer decides what goes in and who can see it, and we process it on their behalf. If you’re a visitor to one of those buildings and have a question about its map, you can also ask the organization that runs it.
What we collect
When you contact us
If you request a demo or send us a message, we collect your name, work email address, organization, the kind of space you manage, and anything you write in your message.
When you sign up or upgrade
To create a workspace we collect your work email address, your organization’s name, and when you agreed to our terms. If you upgrade, you pay on a checkout page run by Stripe: your card details go straight to Stripe, and we never see or store them. Stripe tells us your customer and subscription identifiers, the subscription’s status and its renewal date, which we keep to run your plan.
When you use a workspace
- Account details: your email address, your role in the workspace, and whether you want alert emails. Passwords are stored only as a salted scrypt hash; we never store the password itself.
- Single sign-on: if your organization signs in through its identity provider, we receive the email address and an identifier for your account from that provider.
- Workspace content: floor plans (including uploaded PDF files), maps, destinations, kiosk and QR signage locations, branding, and published versions.
- Activity records: an audit log of actions in the workspace, such as sign-ins, invitations, publishing and setting changes, with the email address of the person who acted, the time, and a shortened one-way hash of the network address it came from.
When you use a kiosk or a phone map
Kiosk and phone pages don’t ask for your name or any account. To help the building’s operator understand how the map is used, the page reports anonymous events: that a map was opened at a particular kiosk or QR sign, which destination was chosen, whether a step-free route was requested, and whether a route was found. These events don’t include your network address, device identifiers or anything that names you.
Read-aloud directions on kiosks use the speech features built into the kiosk’s own browser. We don’t record audio. Kiosk screens never use the camera or microphone.
Technical information
Like every website, our servers receive your network (IP) address and basic browser information with each request. To prevent abuse we keep a one-way hash of the network address for up to 15 minutes to limit repeated sign-in attempts, form submissions and similar requests. Our hosting provider, Cloudflare, also processes this information to deliver and protect the service.
How we use it
- To provide the service: sign you in, save and publish maps, show directions, pair kiosks and report when one goes offline.
- To run your plan: confirm your email when you sign up, take payment through Stripe, and switch paid features on or off as your subscription changes.
- To send service emails: sign-up confirmations, plan changes, invitations, password resets, approval requests and kiosk alerts. You can turn off alert emails in your workspace; sign-in emails always go.
- To show customers usage reports for their own maps, built from the anonymous events above.
- To keep the service secure: detect and limit abuse, and give workspace owners an audit log.
- To reply when you contact us, and to follow up about the demo or information you asked for.
We don’t sell personal information, share it for advertising, or use it to build profiles of visitors.
How long we keep it
| Information | Kept for |
|---|---|
| Demo and contact requests | 12 months |
| Sign-ups nobody confirmed | 8 days |
| Payment records held by Stripe | As Stripe and tax law require |
| Anonymous kiosk and phone events | 90 days |
| Workspace audit log | 400 days |
| Hashed network addresses for abuse limits | 15 minutes |
| Accounts and workspace content | Until a member is removed or the workspace is deleted |
Workspace owners can delete their whole workspace at any time from Team & Security. Deleted information may remain in our provider’s database backups for up to 30 days before it is overwritten.
Security
All traffic is encrypted in transit. Passwords are hashed with scrypt, session cookies are HttpOnly and Secure, and the database stores only hashes of session and invitation tokens. Each workspace’s data is separated on the server. Single sign-on secrets are encrypted at rest. Owners and admins can review activity in the audit log.
No system is perfectly secure. If we learn of a breach affecting your information, we’ll notify affected customers without undue delay and as the law requires.
Your choices and rights
- Workspace owners and admins can export all of their workspace’s data as a ZIP file and delete the workspace from Team & Security.
- Workspace members can change their password and turn alert emails on or off. To change or remove your account, ask your workspace’s owner or admin, or contact us.
- To see, correct or delete information from a demo request, contact us and we’ll take care of it.
Depending on where you live, including in California, the European Economic Area and the United Kingdom, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict some processing. Where we process information on a customer’s behalf, we’ll pass your request to that customer and help them respond. We won’t treat you differently for exercising your rights.
Children
Workspaces are for organizations and their staff, not for children. Kiosk and phone maps can be used by anyone, including children, without providing personal information.
Changes
We’ll update this page when our practices change and revise the date at the top. If a change materially affects how we handle workspace information, we’ll tell workspace owners in advance.
Contact us
For privacy questions or requests, write to us through the contact form and choose “Other” as the kind of space. We reply to every request.
See also our Terms of Service.