Privacy Policy

Who we are

This Privacy Policy explains how xMap Ltd. (“xMap”, “we”, “us”) handles personal data when you visit or use xMap Flows at flows.xmap.ai (the “Service”).

• Where xMap decides. For the account, sign-in, billing, security and contact data described here, and for the business information in xMap data, xMap is the controller.
• Where your organization decides. For personal data that an organization puts into or collects through its own flows (for example a table of its customers, or the recipients of its emails), that organization is the controller and xMap processes the data for it under the Data processing agreement. Questions about that data go to the organization first.

Contact us about privacy at legal@xmap.ai.

What we collect

We do not seek special categories of personal data (such as health data, or data about religion or ethnic origin), and we ask you not to put them into flows, files, tables or comments.

Visitors without an account

• The live run on the home page. The type of place and the place you choose (a city, a district or an address), and the distance or the brand's name when you size a market or track a brand, are sent to our servers to run the search; while you type a place, what you have typed so far is sent to our place search to suggest matches. We keep a hashed form of your network address for up to 30 days to limit how many runs one visitor can make, and the result for up to 30 days so that it can be emailed to you if you ask.
• Market reports you share. When you press Share the report after sizing a market or tracking a brand, we make a public page of that search: the place and distance or brand you chose, the figures, where the places are and the best rated of them. Anyone with its link can see it. It holds no name or email; we keep a hashed form of your network address with it to limit how many reports one visitor makes. It stays online for one year.
• The free market check. When you type a business website (and, if you add it, a city) on the market check, our servers read that website's public home page and xMap AI reads its text to work out what the business does, where it is and the kind of place it competes with; we then count the places like it nearby in xMap's places and population data. We make a report page of the result with its own link, which anyone you give the link to can open: it shows the website's address, what we read from it, the figures and the places found, and holds no name or email. We keep the report, the website's address, what we read from it, a keyed hash of your network address (to limit how many checks one visitor can run and to count how often a report is opened and shared) and the site that sent you to us, for one year. If you then ask us to keep watching it with a work email, it works as the list on the home page below.
• If you leave a work email to receive the list. We create an account for that address, record that you accepted the Terms, email you the list with a link to set a password, and tell our sales team. The account cannot be used until the password is set through that link. We keep this request (your email address, a hashed form of your network address, what you searched for and the flow made for you) with the account, and delete it when the account is deleted. You can ask us to delete it at any time.
• The guest editor. A flow you build without an account is saved only in your own browser and runs there on sample data. It reaches our servers only if you create an account and choose to keep it.
• Looking up a place. The text you type into a place search is sent to our place-search providers (listed below) without your name or email.
• Template pages. When you open a template page someone published, we count the visit once a day against a keyed hash of your network address, never the address itself. To run it you give a work email: a new address gets an account waiting for the code we email it (your name and company are read from the address, and you can change them), and an address that already has an account gets an email with a link to add the flow instead. The choices you made wait until then. The flow made for you is yours. If you report a page, we keep your words and that hash to handle the report.

Business information in xMap data

xMap’s data blocks return information about businesses and places that xMap or its providers collect from public sources: public online map listings and the reviews people post on them, public job postings, vessel position broadcasts (AIS), satellite imagery, weather models, aggregated mobility data, and datasets xMap compiles for its Regional data sources (such as real estate transactions, property listings and cars counted on roads, from public registers, public property sites and other lawful sources). Most of it is not about people. Some of it can relate to a person, for example the business phone number of a sole trader, or the name of a company’s contact on a public job posting.

We handle this information because we and our customers have a legitimate interest in up-to-date information about businesses and places, and we limit how customers may use it: our Terms forbid using it to identify or track individuals or to contact anyone unlawfully. Satellite pictures are at about 10 metres per pixel and do not show people. Mobility Footfall gives figures built from the location signals of a panel of mobile devices, scaled to the whole population: how busy an area is through the day and where its visitors come from, always as totals for an area, never a person, a device or a single trip, and never for a group of fewer than 5. When xMap switches on the Sanctions and watchlists block, it checks the names a flow gives it against public sanctions lists and watchlists, which can include named people, among them politically exposed people; a possible match is a prompt to look closer, never proof, and only the name, a country and ship numbers are sent. When a flow asks for a place’s reviews, we keep each review’s rating, date and text, and never the reviewer’s name, profile or picture.

If information about you or your business appears in results and you want it corrected or removed, or you want to object to its use, write to legal@xmap.ai. Tell us the business name and place, and we will act on it and ask customers who received it to do the same where the law requires.

How we use it

We do not sell personal data, we do not share it for advertising, and we do not use it to make decisions about you that have legal or similarly significant effects without a person being involved.

Connected accounts

You can connect xMap Flows to other apps and systems, for example Google Sheets, Gmail, Slack, Salesforce, HubSpot or your own database, so that your flows can add records, send messages or look things up there. Connections are made by you or an admin in your organization, and you can remove them at any time on the Connections page.

• What we use them for. Only to carry out the steps in your flows: when you load a list in a block’s settings (such as your Slack channels or spreadsheets), test a connection, or run a flow with sending switched on. Test runs never send anything to connected accounts.
• How we keep them. Sign-in details are encrypted before they are stored (AES-256) and are never shown again, not even to administrators. A personal connection can only be used by flows its owner owns.
• What we keep from them. We don’t copy the contents of your connected accounts into xMap. A run keeps only what the flow produced, plus a short reference or status for each thing sent (such as a record or message ID), in that run’s history.
• When you remove one. Removing a connection deletes its stored sign-in details. You can also revoke xMap’s access from the other service’s own settings.

Some app blocks are built on open-source connector code from Activepieces. That code runs on xMap’s own servers: your sign-in details and data are not sent to Activepieces.

Google user data

When you choose “Sign in with Google” for Gmail, Google Sheets, Google Drive or Google Calendar, Google asks you to allow xMap Flows to access parts of your Google account. This section explains what we access, why, and what we don’t do with it.

• We access your Google data only to provide the features you set up in your flows, and only when you load a list in a block’s settings, test the connection, or run a flow with sending switched on.
• We don’t read your email, and we don’t store the contents of your files, spreadsheets or calendars. A run keeps only what the flow produced and a short reference or status for each step (such as a message or file ID). Your Google sign-in tokens are stored encrypted.
• We don’t sell Google user data, and we don’t use it for advertising, including retargeting or personalised ads.
• We don’t use Google user data to develop, improve or train generalised artificial intelligence or machine-learning models.
• We don’t transfer Google user data to anyone else, except as needed to provide or improve the features you use, to comply with the law, or as part of a merger or acquisition with your data protected as described here.
• No person at xMap reads your Google data, unless you ask us to for support, it is needed for security (such as investigating abuse), or the law requires it.

Limited Use. xMap Flows’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access. Remove the connection on the Connections page in xMap Flows; this deletes its stored Google sign-in at once. You can also revoke xMap Flows’ access at any time at myaccount.google.com/permissions. To ask us to delete anything else, email legal@xmap.ai.

The xMap Flows browser extension

The xMap Flows extension for Chrome and browsers built on Chrome shows the market around a business whose website you have open, or a place you have open on an online map. It asks for as little as it can: it learns which page is open only when you press its button (the browser’s “active tab” permission: that tab, at that moment), it cannot read or change the pages you visit, and it talks only to flows.xmap.ai.

The extension has no analytics, sets no cookies and keeps no browsing history. The data it shows (places, ratings, openings) is xMap’s places data, as in the app.

The xMap Academy

If you take the xMap Academy, its Academy and Certification Terms apply as well. Here is what it keeps, why and for how long.

Who sees it. You. xMap’s Academy team (xMap administrators) sees each learner’s progress, how much they watched, their attempts and anything fair play held back, to review it. Your first name and the first letter of your last name may appear on the weekly board, which you can switch off. A certificate’s public page, its PDF and its share picture show only what is on the certificate, to anyone with its number. Your organization’s admins do not see your Academy progress, though the exercises you do in an organization are flows like any other, unless they assigned you a level of the Academy: then, for each level they assigned, they see how many lessons you finished, how much of the course you watched, how many assignments you passed, whether you passed the final check and your best score, your certificate, and the date they set. They never see your answers, your attempts’ details or anything fair play held back. When they take the level back, or you leave the organization, they stop seeing it.

While you watch. To protect the films, your name, email and the date are shown faintly across the lesson on your own screen; they are not added to any file or sent anywhere else. Before you sign in, your progress is kept only in your browser (see the Cookie Policy).

xMap for Startups

When you apply for startup credits on the xMap for Startups page, we keep what you send: your name, company email, company name and website, the accelerator you name, your stage and what you want to build, with where you came from on our site. xMap staff use it to decide your application and to write to you about it; our sales team gets an email with it. If we approve it, we make or credit your organization and keep which application or accelerator code the startup credits came from, how many there were and when they end. An accelerator that gave you its code does not receive anything from us about you.

The directory of certified experts

If you hold an xMap Academy certificate, you can choose to show a profile in the directory of certified xMap Flows experts, so that clients can find you. It is off until you switch it on, and you can switch it off or change it at any time on the Academy page.

• What your profile shows. Anyone who can open the directory sees the name printed on your certificate, your picture if you chose to show it, the headline, city, industries, languages, company and words about you that you wrote, your certificates with links to their public pages, and, if you name an organization you are an admin of as your agency, its name and its partner tier. The tier is worked out from how many of its people hold certificates and how many client organizations it runs AI employees for; only the tier is shown, never those organizations. Your email address is never shown. A profile shows only while one of your certificates is valid.
• Messages to you. A visitor can write to you through your profile: we keep their name, email, company and message, send them to you by email with their address to reply to, and show them to you on the Academy page. We keep a keyed hash of the visitor’s network address (never the address) to limit how many messages one visitor can send.
• Leads xMap passes on. When someone asks xMap for help (for example when they book a call or leave their email), xMap may pass their name, company, email, city and what they need to a certified expert near them, who may then contact them. Each one is recorded with who at xMap passed it on.
• Who sees it. You, and xMap administrators, who can take a profile down. Messages and leads are kept for two years, then deleted; your profile while your account exists.

Who we share it with

Other people in your organization, and people you share flows with, can see relevant account details (such as your name and email) and your activity on shared flows. Organization admins can see the organization’s members, flows and activity, but not a member’s private flow that uses that member’s own connected accounts, nor what such a flow found; when that member leaves, what those accounts gave the flow is deleted before the flow passes to someone else.

Your own connected accounts. An account you connect for yourself (for example your Gmail, Google Calendar, Sheets, Drive or Outlook) is used only by flows you own. If such an account is connected for the whole team, only flows of the person whose account it is can read from it; everyone else can only send or add things with it. Nobody, including admins and xMap, is shown your saved passwords, keys or sign-in tokens.

xMap support. xMap staff cannot open your organization (its flows, results, connections, people or settings) unless one of its admins allows it, for a time they choose and can end at any time. While they can, every page they open and every change they make is listed for your admins under Settings, xMap support access, and your admins are emailed. Even then they cannot read from your members’ own connected accounts or see private flows that use them. xMap keeps account-level information (organization name, plan, credits, counts of flows and runs) to run the Service.

County property records. The Property changes block brings in public records that US counties publish about properties, including the names of their owners and their mailing addresses. They are kept with your flow’s results, like any other result, and deleted with them. To avoid looking the same place up twice, xMap also keeps a copy of each owner look-up for 30 days, apart from any organization, and then deletes it. They are given to an AI block only when its instructions name the owner or the mailing address. Use them as the law where the property is allows: they are not a list of people who agreed to be contacted.

Public links. Your team can share a map or a saved list by a public link (and embed a map on your own website). Anyone with the link can then see the places on it and their category, city, address, rating, website and phone, under your organization’s name, without an account. Nothing else of your account is shown. Your team can stop a link at any time; we count how often it is opened. Share a link only when the places on it may be public.

Template pages. When you publish a flow as a template page, anyone with its link can see its name, the words you wrote, its steps and the questions you chose, and, if you chose to show them, your name and your organization’s name and logo. Your accounts, email addresses, tables, files and keys are never on it. If xMap lists it in its community gallery, anyone browsing Templates can find it. The people who use it see how many teams use it, not who they are.

Customer stories. After one of your AI employees has worked for 30 days, we may draft a short story from your organization’s own figures (how many results it found, how many were strong fits, how many runs, how long it has worked, an estimate of the hours saved, the kinds of place and cities it found most, its role and what it works on, and your industry if your admins gave it). The draft is shown only to your organization’s admins and to xMap’s admins. It is published only when one of your admins chooses to, with or without your organization’s name and logo; we record who chose, when and which version. A published story is public and holds no person’s name, email address, contact details or the results themselves. We count its views once a day against a keyed hash of the visitor’s network address. Your admins can take it down at any time, and it then stops showing at once; the draft and the record of the choices stay with your account until your organization is deleted.

We use these service providers to run the Service. They process data on our instructions:

This table is our list of sub-processors. We update it here before a new provider starts to process customer data. A data processing agreement is available on the Data processing agreement page, and how we protect the Service is described on the Security page.

Artificial intelligence

AI blocks run only when a flow that contains them runs, or when you ask xMap AI to build a flow, answer a question about your results, write a first message to a result or read your company’s website, and when you chat with Ask xMap, the assistant in the app. Ask xMap receives your message, the conversation so far, the page you are on and what it looks up for you, with your own rights, in the organization you are working in (your flows, runs, results, credits and connections’ names, never sign-in details); it does what changes something only after you press Confirm, and each confirmed action is listed in your organization’s Activity. An AI agent block in a flow receives the messages that reach it (from a chat, an API call or an app such as WhatsApp), the conversation it remembers and what its tools return; it remembers each conversation (the last 20 messages) for 30 days after the last one, for the flow’s organization, which can see and clear it under Conversations. People who write to a flow’s chat page or to a connected messaging account are the organization’s own contacts: the organization decides what its agent does with their messages. What they receive is listed in the table above; for a first message, also the result’s details and your company’s description. We do not use your content to train AI models. To make Ask xMap better, we keep each request you give it with the flow it built and what became of that flow (whether it was tested, kept, deployed or undone). When your organization leaves Help improve Ask xMap on (the default; an admin can switch it off in Settings), a flow it built that you kept and ran can become a worked example that Ask xMap is shown when it builds flows for others, and a request it got wrong can become one of its tests, but only after names, email addresses, phone numbers, web addresses, accounts, tables, queries and code are removed. Switching it off stops this and withdraws what your organization’s flows gave. Microsoft states that data sent to Azure OpenAI is not used to train its models; TypeSafe AI processes data under its own terms. AI answers can be wrong: check them before you rely on them.

Speaking instead of typing. The microphone button uses your browser’s own speech recognition (in Chrome and Edge it is Google’s or Microsoft’s service, in Safari Apple’s). The audio goes from your browser to that service, not to us; we receive only the text you then send.

Services you connect. When your flow sends something to an app you connected (for example a new row to Google Sheets or a message to Slack), that service receives it and handles it under its own privacy policy.

Pages run by others. Stripe’s payment page and the Google and Microsoft sign-in pages are run by those companies under their own privacy policies.

Other disclosures. We may disclose data where the law requires it or to protect rights and safety. If xMap is involved in a merger, acquisition or sale of assets, data may pass to the successor, which must keep to this policy.

International transfers

xMap Ltd. is based in Canada (Toronto), and the Service is hosted in the United States: the application and the database run there. xMap’s own data services run on Google Cloud and on Amazon Web Services, whose services for xMap are in Japan. Other providers in the table above may process data in the United States, the European Union or other countries where they operate.

Where data protection law restricts sending personal data abroad, we rely on a lawful mechanism for the transfer: the European Commission’s Standard Contractual Clauses for data from the European Economic Area and Switzerland, the United Kingdom’s International Data Transfer Addendum for data from the United Kingdom, and the mechanisms allowed by the Saudi Personal Data Protection Law and other applicable laws for data from those countries. You can ask for a copy of the relevant clauses at legal@xmap.ai.

How long we keep it

Backups and our hosting provider’s server logs are kept for a limited period and then overwritten.

Your rights

Depending on where you are, you may have the right to access your personal data, correct it, delete it, receive a copy of it, object to or restrict certain uses of it, and withdraw consent you have given. Using these rights is free, and we will not treat you differently for using them.

• In the app. In Settings you can change your name, password and email address, see and end your signed-in devices, download everything we hold about your account, and delete your account.
• By email. For anything else, write to legal@xmap.ai. We answer within 30 days. We may ask for information to confirm who you are.
• Data in your organization’s flows. If your data is in a flow, table or result that an organization controls, we will pass your request to that organization.

European Economic Area, United Kingdom and Switzerland. You have the rights set out in the GDPR, including the right to object to processing based on legitimate interests, and you can complain to your local data protection authority.

Saudi Arabia and the United Arab Emirates. You have the rights given by the Saudi Personal Data Protection Law and the personal data laws of the UAE, including the rights to be informed, to access, to correct and to request destruction of your data. In Saudi Arabia you can complain to the Saudi Data & AI Authority (SDAIA).

California. The California Consumer Privacy Act gives California residents the rights to know, correct and delete their personal information. We collect identifiers (such as name and email), commercial information (plans and payments), internet activity (sign-ins and use of the Service) and professional information (company and role), for the purposes described above. We do not sell personal information or share it for cross-context behavioural advertising. You may use an authorised agent to make a request.

Security

We use encryption in transit (HTTPS), encryption at rest by our hosting providers, a second layer of encryption for the sign-in details of connected accounts, one-way password hashing, secure session cookies, optional and enforceable two-step sign-in, sign-in and usage limits, role-based access, recorded administrator access, tested releases and monitoring. The Security page describes these measures.

No service is completely secure, so please use a strong, unique password and switch on two-step sign-in. If we learn of a breach of your personal data that is likely to put you at risk, we will tell you and the authorities as the law requires. Report a concern to legal@xmap.ai.

Emails we send

• Service emails. Codes, invitations, password links, receipts, alerts you set up and notices about your account or organization. These are part of the Service.
• Emails your flows send. When a flow emails results to you or to people your organization chose, the email shows that organization as the sender “via xMap Flows” and carries an unsubscribe link. If you unsubscribe, that organization’s flows stop emailing you.
• The monthly email. Once a month we email everyone with an account our product news: the AI employee of the month, a template, what is new and a tip, with one line on what your own AI employees found (only flows you own; never anyone else’s). It is on until you switch it off in Settings, Notifications, or press Stop the monthly email in it. We keep who got each month’s email for two years, so nobody gets it twice.
• Contact from xMap. If you leave your email address or book a call, we may write to you about xMap Flows. You can tell us to stop at any time.

We do not track whether you open our emails or click the links in them. The links in the monthly email name the email and the link (for example utm_source=xmap-monthly): when someone arrives through one, we add one to a count for that link and day, with nobody named, and not when Measurement is switched off in Cookie settings.

Cookies and browser storage

We keep on your device only what the Service needs to work, unless you agree to more. With your agreement we also remember how you like the app laid out (Preferences) and learn which pages and sites bring people to xMap Flows (Measurement). We use no advertising or cross-site tracking cookies.

The first time you visit, a banner lets you accept all, reject everything that is not strictly necessary, or choose; you can change your choice at any time under Cookie settings in the footer of every page. Global Privacy Control and Do Not Track count as a rejection. When you are signed in, we keep your choice with your account (what you chose, how and when), so we can show it was yours.

The Cookie Policy lists every cookie and item of browser storage, what each is for, its kind and how long it lasts. In short: one sign-in cookie (xf_session) and two short-lived sign-in checks (xf_sso, xf_saml), all strictly necessary; strictly necessary storage for your choice and work you started; preference storage for your layout; and measurement storage for the page you first landed on and the site that sent you (xf_land), the invite link you came with (xf_ref) and one count when you first see results. We count page visits with Vercel Web Analytics, which sets no cookie and keeps nothing in your browser, and not at all when Measurement is off.

Pages run by other companies (Stripe, Google and Microsoft sign-in, your company’s single sign-on, apps you connect) set their own cookies under their own policies.

Children

The Service is for business users aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, tell us and we will delete it.

Changes to this policy

We may update this policy. If a change is material, we will let you know in the Service or by email before it takes effect. The date at the top shows the latest version.

Contact

Privacy questions and requests: legal@xmap.ai.

By post: xMap Ltd., 20 Bay St., Suite 1100, Toronto, Ontario M5J 2N8, Canada.