Privacy Policy
Effective Date: November 11, 2026 · Privacy & Data Protection Desk: privacy@maptoowner.com
1. Data Controller & Scope
MapToOwner (“MapToOwner”, “we”, “us”, or “our”), operating https://maptoowner.com, provides an on-demand B2B corporate intelligence software platform. This Privacy Policy explains how we process personal data relating to (a) our registered SaaS workspace customers and visitors, and (b) publicly disclosed corporate representatives retrieved on-demand at a customer's instruction. For all privacy inquiries, Data Subject Access Requests (DSARs), or opt-out/removal requests, contact privacy@maptoowner.com.
2. Categories of Data We Process
- Workspace Account Data: Full name, work email address, encrypted authentication credentials managed via Supabase Auth, workspace plan tier, and atomic credit ledger balances (
plan_creditsandpurchased_credits). - Billing & Transaction Data: Stripe Customer ID, Subscription ID, billing country, VAT/Tax ID, and invoice history. Payment card numbers are collected directly by Stripe (PCI-DSS Level 1) and never touch MapToOwner servers.
- Security, API & Audit Logs: IP address (sliding-window rate limiting and SSRF abuse prevention), SHA-256 digests of workspace API keys (
key_hash), and search job metadata. - On-Demand Public B2B Business Data: MapToOwner does not maintain a static resold consumer broker database. When a customer launches a search, our automated engine retrieves publicly published corporate records in real time (Google Maps business listings, official company websites such as
/about,/contact,/impressum, Italian Partita IVA / PEC disclosures, and US/CA BBB corporate officer listings).
3. Legal Basis for Processing (GDPR & UK GDPR)
- Performance of a Contract — Art. 6(1)(b) GDPR: Creating and authenticating your workspace, executing requested B2B extractions, settling credits, and delivering signed CSV exports.
- B2B Legitimate Interest — Art. 6(1)(f) GDPR: On-demand technical aggregation and verification of corporate contact details manifestly published by businesses on the open web for commercial outreach, as well as platform security, rate limiting, and fraud prevention. Customers remain independent Data Controllers for their downstream B2B outreach campaigns.
- Legal Obligation — Art. 6(1)(c) GDPR: Statutory tax, VAT, and accounting record retention on commercial invoices.
- Consent — Art. 6(1)(a) GDPR: Optional product analytics cookies, which remain strictly disabled unless you opt in via our Cookie Banner.
4. Authorized Sub-Processors
We engage the following vetted infrastructure sub-processors under Data Processing Addenda (DPAs), EU-US Data Privacy Framework (DPF) certifications, and Standard Contractual Clauses (SCCs):
| Sub-Processor | Role & Processing Purpose | Transfer Safeguards |
|---|---|---|
| Supabase, Inc. | Authentication (PKCE/SSR) & Row-Level-Secured PostgreSQL ledger | European Union / United States (SCCs) |
| Vercel Inc. | Application edge network, TLS termination & serverless execution | Global Edge / United States (DPF & SCCs) |
| Cloudflare, Inc. | Private R2 encrypted object storage (7-day export retention) & WAF | European Union / Global Network (DPF & SCCs) |
| Stripe, Inc. | PCI-DSS Level 1 subscription checkout, billing portal & invoicing | European Union / United States (DPF & SCCs) |
| DataForSEO | Real-time on-demand public Google Maps SERP retrieval | European Union / United States |
| Groq, Inc. | Zero-training LLM inference (openai/gpt-oss-120b) on public web text | United States (SCCs) |
5. Data Retention & 7-Day R2 Export Auto-Deletion
- Cloudflare R2 Export Vault (7 Days): Enriched JSON datasets and generated CSV export files stored in our private Cloudflare R2 bucket are automatically scheduled for deletion after 7 days. AWS SigV4 presigned download links expire after 15 minutes.
- Workspace Account & Self-Service Deletion: Retained for the duration of your active workspace. When you execute Delete Account in /app/settings, any active Stripe subscription is immediately canceled, your R2 datasets are purged, and your Supabase Auth & workspace records are permanently deleted via cascading database constraints.
- Tax & Accounting Records: Stripe invoice records are retained for the statutory period required by applicable tax law (typically 7–10 years).
6. Your Rights under GDPR, UK GDPR & CCPA / CPRA
Depending on your jurisdiction, you have the right to access, rectify, export (portability), restrict, object to processing, or request erasure of your personal data. Under the California Consumer Privacy Act (CCPA/CPRA), MapToOwner does not sell or share personal information for cross-context behavioral advertising. Business owners or individuals who wish to opt a corporate domain or contact record out of on-demand enrichment may email privacy@maptoowner.com with the subject B2B Opt-Out / DSAR; verified requests are honored within 30 days (and typically within 72 hours). You also have the right to lodge a complaint with your local Data Protection Authority (such as the Garante per la protezione dei dati personali in Italy, the ICO in the UK, or any EU supervisory authority).