SmartMaps Address Autocomplete: Privacy
Privacy of SmartMaps Address Autocomplete: external requests to SmartMaps, visibility of the API key, no consent integration, and notes on CSP and your privacy policy.
Privacy
This documentation always describes the latest published version.
This plugin is not self-hosted. On the affected pages the visitor's browser loads files from
cdn.smartmaps.cloud, and the SmartMaps library sends the typed address data to SmartMaps to complete it.
External requests
| When | To | What |
|---|---|---|
| When an affected page is opened, as soon as the plugin is active and configured | cdn.smartmaps.cloud |
The stylesheet autocomplete.css and the script autocomplete.min.js are loaded. The server receives the visitor's IP address and the usual browser details. |
| When typing in the street field | SmartMaps service | The SmartMaps library sends the entered text together with your API key to fetch suggestions. |
The files are loaded on every affected page, even if the visitor never uses the address field. On other pages, and with the plugin switched off, no requests take place.
Cookies and consent
- The plugin itself sets no cookies and writes nothing to the browser's local storage.
- The plugin is not connected to the Shopware cookie consent or to a consent tool. The SmartMaps files are loaded without asking for consent.
- What the SmartMaps library itself stores or transmits in the browser is decided by SmartMaps. The plugin cannot influence it.
Before going live, check whether you need a legal basis and a data processing agreement for using SmartMaps, and add SmartMaps to your privacy policy.
API key in the page source
The API key is part of the HTML of the affected pages, in the data-smartmaps-apikey attribute of the script tag. The SmartMaps library runs in the browser and needs it there, so every visitor can see it. Restrict the key to your shop domains in the SmartMaps portal.
The key does not appear in the configuration passed to the Storefront JavaScript class (which only holds the switch and the country filter). It is read per sales channel, so different shops can use different keys.
Content Security Policy
If you use a Content Security Policy, allow cdn.smartmaps.cloud for scripts and stylesheets. Initialisation runs in an inline script that uses the Shopware CSP nonce (cspNonce). Which further hosts the SmartMaps library contacts is decided by SmartMaps; with a strict policy they must be allowed as well.
Processing in the shop
The plugin stores no addresses and no SmartMaps responses. The selected address reaches the shop through the normal Shopware form, just like a manual entry.