Privacy Policy

Mapped is operated by Mapped LLC, an Iowa limited liability company, United States. Privacy contact: privacy@mpped.com.

We collect information you provide or create, data from connected services, and professional directory and contact data:

• Account: email, consent choices, sign-in and security records.
• Profile: resume, narrative, preferences, employment, education, location, and other professional details.
• Activity: searches, contacts, notes, drafts, messages, replies, reminders, meetings, and outcomes.
• Connections: email and calendar content, provider identifiers, permissions, status, and protected credentials.
• Directory: professional facts, images, relationship signals, inferred affiliations, contact addresses, and source or verification evidence.
• Other: AI inputs and outputs, billing and subscription records, device and browser data, cookies, logs, and backups.

Our directory includes people without accounts. Information comes from professional datasets, public professional sources, providers, users, and derived relationships. You can ask about your information or request access, correction, removal, or an appeal without an account, as described under Privacy rights and appeals.

We use information to operate and secure the service, verify accounts, process profiles and resumes, support search and networking, generate AI suggestions, send approved messages, track replies and meetings, manage subscriptions, provide support, prevent misuse, keep records, and comply with law.

OpenAI's API receives relevant profile and directory facts, writing instructions, and drafts to generate suggestions. Uploaded resumes also go to Alibaba Cloud's Qwen models for an initial read; Qwen handles other AI requests when OpenAI is unavailable. We may store results and processing records. Review AI text before use. Connected email and calendar providers receive data needed for your requested actions.

Manage Google access in connection settings or Google Account connections. Mapped's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Sign-in links your account using your Google identifier, email, and basic profile.
• Gmail permission allows sending outreach, not reading your messages. Account notices and password resets use a separate email service.
• Calendar permissions allow checking primary-calendar busy times and creating, reading, updating, and canceling meeting events and invitations.
• Meetings shows the titles, times, and links of events on your primary calendar. We read them when you view Meetings and do not store them.
• We store connection details, protected credentials, and the sent messages and meeting details needed for these features.
• Google user data is used only for these email and calendar features, never sold or used for advertising or AI or machine-learning training, and shared only with necessary service providers or as legally required.
• Staff read Gmail or Calendar data only to investigate abuse or security incidents, or as legally required.

Microsoft sign-in provides your identifier and basic profile. Outlook permissions allow reading messages to detect replies, sending outreach, and creating drafts for sending. Calendar permission allows reading availability and creating, changing, and canceling meetings with attendees. We may store credentials, matched replies, message identifiers, and meeting details. Disconnect in connection settings; remove Microsoft account consent if needed.

Cookies and browser storage support sign-in, security, and preferences; logs support troubleshooting, abuse prevention, and operations. Blocking necessary cookies can prevent sign-in. Data may be processed in the United States and wherever our AI, hosting, and connected providers operate.

For the purposes above, we share information with providers, connected services, and people you contact; in transactions involving Mapped; or to comply with law or protect rights and safety. Recipients include:

• Railway (hosting), database and private storage providers (account and feature data), OpenAI and Alibaba Cloud/Qwen (AI), and communications, contact-data, security, and support providers.
• Google, Microsoft, and other connected services; Stripe and payment, tax, fraud, and financial-service providers for subscriptions.
• Message recipients, meeting attendees, directory users, authorities, and transaction counterparties, as applicable.

Faith, civic, union, cultural, and other community affiliations can reveal sensitive traits. Community affiliations is on by default and uses your affiliations for matching and drafted outreach. Turn it off in account settings, omit information you do not want used, or contact us to remove stored information.

We retain information as needed to operate the service, keep your history, resolve disputes, prevent abuse, or meet legal obligations. Disconnecting Google or Microsoft stops future use, removes stored credentials, and attempts to revoke access; it does not delete stored data or recall messages, invitations, or provider copies. Thirty days after an account-deletion request, we permanently delete account data, including messages, replies, meetings, and billing records we hold, keeping only a deletion record. Backups expire on their normal schedule. Payment processors and other third parties keep their own copies. Edit your profile, manage connections, download data, or delete your account in account settings.

Depending on your location, you may have rights to access, correct, delete, or obtain a portable copy of your information; appeal denials; use an authorized agent; or make choices about sale, sharing, targeted advertising, or sensitive information. Submit requests or appeals through the privacy request form or privacy@mpped.com. Identify your account or directory entry; do not email passwords or identity documents. We may verify identity and authority. No account is required.

Mapped is for U.S. residents 18 or older, not children. We use administrative and technical safeguards, but no system is perfectly secure. We will give notice or request renewed consent for policy updates when required.