Privacy Policy

1. Who We Are

Maptero is operated by Gabriele Morano, based in Italy. For privacy inquiries, contact us at legal@maptero.com.

2. Data We Collect

Account Data

• Email address (required for authentication)
• Display name (optional, set by you)

Content You Create

• Tasks (title, type, status, deadline, effort level, recurrence rules)
• Projects (name, description)
• Contacts (first name, last name, company, job title). See "Third-Party Personal Data" below
• Task relationships (blockers, contact assignments)
• Project status (an overview narrative and goals) that you capture by voice or by typing

Voice Data

• Audio recordings are sent to OpenAI for transcription and are not stored by Maptero
• Text transcriptions of your voice commands are stored for 90 days for debugging, then automatically deleted

Usage & Account Data

• API usage logs (AI model used, cost per request) for billing and rate limiting
• Account settings (usage tier, monthly cap)
• Invite code redemption records (during early access)

Tutorial & Onboarding Data

• Tutorial progress (which steps you have completed)

Security Monitoring Data

• Active session count (how many browser tabs are open, tracked ephemerally for abuse prevention)
• Security alerts (pseudonymized records of unusual activity, retained for 30 days)

Technical Data

• Authentication session cookies (strictly necessary)
• Language preference cookie (strictly necessary)
• Timezone preference cookie (strictly necessary): stores your device's time zone so dates display in your local time
• UI state preferences stored in your browser's local storage
• Error diagnostics (stack traces, browser/OS metadata, anonymized request paths) sent to our error-monitoring sub-processor for service reliability and security, on a legitimate-interest basis (Art. 6(1)(f)). IP addresses, cookies, request bodies, and authorization headers are scrubbed before send. You can opt out of client-side error reporting in Account settings.

For details about cookies and local storage, see our Cookie Policy.

3. Legal Basis for Processing

4. AI Processing

Maptero uses artificial intelligence to interpret your voice commands, manage tasks, organize project status, and answer your questions about how the app works. When you use these AI features:

• Your audio is sent to OpenAI for speech-to-text transcription using the GPT-4o-transcribe model (the Realtime API used by the Pro and Max voice tiers transcribes with whisper-1)
• The transcribed text, along with your task context (task titles, project names, contact names), is sent to OpenAI's GPT models (GPT-5.4-mini for interpretation, GPT-4o-mini to detect when a command continues a previous task, and the Realtime API for the Pro and Max tiers) for interpretation
• When you capture a project's status (by voice or by typing), your status notes and the project's existing goals are sent to OpenAI's GPT models (GPT-5.4-mini, plus GPT-4o-transcribe for audio) to structure them into goals
• When you ask the in-app help assistant a question, your question (typed, or transcribed from your voice using GPT-4o-transcribe) is sent to OpenAI's GPT-5.4-mini model, together with our product help guide, to generate an answer. These help conversations are not stored on our servers
• OpenAI processes this data under a Data Processing Agreement (DPA) and does not use it to train their models
• AI interpretations and answers may be inaccurate. For voice commands and project status, you are always shown a confirmation before any action is taken
• Data processed by our sub-processors is subject to their own data retention policies, as governed by their respective terms and, where applicable, Data Processing Agreements

5. Third-Party Personal Data (Contacts)

Maptero allows you to store contact information about other individuals (first name, last name, company, job title) for task management purposes. This constitutes third-party personal data.

• How it's used: Contact names are stored in our database and included in AI processing requests to enable voice-based task assignment, filtering, and contact resolution
• Legal basis: Legitimate interest of the user for professional task management (Art. 6(1)(f) GDPR)
• Your responsibility: As the person entering contact data, you act as data controller for this information. You should ensure you have a lawful basis to store it and avoid entering sensitive personal data
• Retention: Contact data is retained while your account is active and deleted when you delete your account or remove the contact
• Sub-processor access: Contact names are shared with OpenAI during voice processing (see AI Processing above) and stored in Supabase (see Sub-Processors below)

6. Sub-Processors

We use the following third-party services to operate Maptero:

7. Data Retention

• Account data, tasks, projects, contacts, project status: Retained while your account is active
• Voice transcription logs: Automatically deleted after 90 days
• API usage logs: Automatically deleted after 180 days
• Security alerts: Automatically deleted after 30 days
• Deleted accounts: When you request account deletion, your data is retained for 30 days (so you can cancel), then permanently deleted
• Deleted-account operational archive: A copy of your account data, protected by the same infrastructure-level encryption-at-rest as the rest of our database, is retained for 7 days after the hard-delete strictly for system error recovery (in case the deletion job mis-fires). After 7 days the archive entry is itself deleted automatically. Service operators have no routine access to this archive; it exists only to recover from an operational error within the first week.

8. Data Security

We take the protection of your data seriously:

• Encryption at rest: All data is encrypted at rest using AES-256 at the infrastructure (database-provider) level, including database storage and write-ahead logs. We do not currently apply additional application-level (per-field) encryption on top of this.
• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
• Access control: Database access is restricted through row-level security policies. Each user can only access their own data. Service administrators may access user email addresses, account settings, and aggregate account statistics for operational, support, and abuse prevention purposes. These statistics include month-to-date usage and the number of tasks, projects, and contacts in each account; they are counts only, never the content of those items.
• Authentication: User sessions are managed through industry-standard secure authentication protocols.

9. Your Rights

Under the GDPR, you have the following rights:

• Access: Request a copy of all your data (use "Export my data" in Account settings)
• Rectification: Correct inaccurate data (edit your tasks, contacts, and profile directly)
• Erasure: Request deletion of your account and all data (use "Delete my account" in Account settings)
• Portability: Download your data in JSON format (use "Export my data" in Account settings)
• Restriction: Request restricted processing by contacting legal@maptero.com
• Objection: Object to processing based on legitimate interest (Art. 21) by contacting legal@maptero.com. Upon receiving a valid objection, we will cease the specific processing unless we demonstrate compelling legitimate grounds. For voice transcription logs, we will delete your existing logs upon request.
• Complaint: Lodge a complaint with your local EU data protection authority

10. International Data Transfers

Our sub-processors are located in the United States and the EU (see the Sub-Processors table above for each provider's location). Transfers to the United States are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) as appropriate. Most sub-processors operate under Data Processing Agreements; where one does not (currently Telegram, used only for internal pseudonymized security alerts), we share only pseudonymized identifiers and document the residual risk in our records.

11. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected users via email without undue delay, in accordance with GDPR Articles 33 and 34.

12. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify you via email at least 30 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision.

13. Contact

Gabriele Morano
Italy
Email: contact@maptero.com
Privacy contact: legal@maptero.com