Privacy Policy

1. Who we are and what this Policy covers

MapsHarvest is operated by ODD Media LLC, a Wyoming limited liability company doing business as MapsHarvest and OMD Growth ("MapsHarvest", "we", "us"). Postal address: 30 N Gould St, Ste 4000, Sheridan, WY 82801, USA. Email: support@mapsharvest.com.

This Privacy Policy explains how we handle personal information when you visit mapsharvest.com, create an account, use the MapsHarvest application or API, contact us, apply to our partner program, or interact with our marketing. It also explains, in Section 8, how we handle information about businesses that appear in the results we deliver to customers.

We act in three different roles, and it helps to keep them apart:

• Controller for our own website, accounts, billing, marketing and analytics. This is most of this Policy.
• Processor (or "service provider") for the content you store with us — results kept in your account, CRM records, campaign data. We process that only on your instructions; our Data Processing Addendum governs it.
• Independent controller for the collection of publicly listed business information from Google Maps before it is delivered to a customer. Section 8 and our Business Listing Notice explain this.

We do not sell your personal information for money. Section 5 explains the advertising and analytics tools we use, some of which US state laws treat as "sharing" or "selling", and how to opt out.

2. Information we collect

2.1 Information you give us

• Account details: name, email address, password (stored only as a hash by our authentication provider), the role or use case you select at signup (for example "Marketing agency" or "Freelancer / Consultant"), company name and time zone if you provide them.
• Sign-in provider details: if you sign in with Google, LinkedIn or GitHub, we receive your name, email address, profile picture and a provider account identifier from that provider. We do not receive your password.
• Billing details: payments are processed by Stripe. We never see or store full card numbers. We store your Stripe customer and subscription identifiers, plan, billing country, invoice history, and the card brand and last four digits that Stripe shows us.
• Content you create in the Service: search queries, selected geographies and fields, campaign names, CRM records and notes, scheduled scrapes, webhook URLs and API key labels.
• Communications: messages you send through our contact form or by email, support conversations and any feedback or reviews you submit (including the name, role and company you choose to display).
• Partner program information: if you apply to the Partner Program, your name, contact details, website or social profiles, payout details (such as a PayPal email or bank account name and IBAN/account number, held by our payout provider where possible) and tax information (such as IRS Form W-9 or W-8BEN).
• Referral information: if you were referred by a customer or partner, the referral or partner code that brought you.

2.2 Information collected automatically

When you visit our website or use the Service, we and the tools described in Section 5 collect:

• Device and connection data: IP address, browser type and version, operating system, device type, screen size, language settings and time zone.
• Usage data: pages viewed, links and buttons clicked, scroll depth, time on page, referring website, search terms that brought you to us, dates and times of access, and error and performance data.
• Product usage data: scrapes you run (query, geography, fields, status, rows delivered, credits used), API calls, features used, presence and last-active timestamps, and settings. We also keep internal notes about accounts (for example a record of a support conversation or a billing issue) to give you consistent service.
• Marketing attribution data: UTM parameters and advertising click identifiers in the links you arrive through (such as gclid, fbclid, msclkid, ttclid and li_fat_id). We store the first source that brought you to us ("first-touch attribution") on your account record so that we can understand which channels bring customers.
• Identifiers set by cookies and similar technologies: described in Section 5 and in our Cookie Policy.
• Security logs: IP address, request path, timestamps and authentication events in our server and API logs.

2.3 Information from other sources

• Payment and fraud signals from Stripe (for example whether a payment succeeded or was disputed, and Stripe Radar risk signals).
• Advertising platforms (Google, Meta) may tell us that a visit or signup resulted from one of our ads, in aggregate or campaign-level form.
• Publicly available business information about you, if you are the owner of a business listing that appears in our results — see Section 8.

3. How we use information and our legal bases

We use personal information for the purposes below. Where the GDPR, the UK GDPR or a similar law applies, we rely on the legal basis indicated.

Where we rely on legitimate interests, we have balanced those interests against your rights and you can ask us for a summary of that assessment. Where we rely on consent, you can withdraw it at any time (Section 12) without affecting processing that took place before withdrawal.

4. Information we do not collect

We do not collect phone numbers from customers and we do not send SMS messages. We do not knowingly collect special-category data (such as health, religion or political opinions), precise geolocation, or information from children. We do not use your account data or content to train artificial-intelligence models, and the processors that store it for us may process it only on our instructions, which do not include that.

5. Analytics, advertising and attribution technologies

This section describes, tool by tool, the technologies we use on mapsharvest.com and in the application. Our Cookie Policy lists the specific cookies, their purposes and lifetimes.

How consent works. If you visit from the European Economic Area, the United Kingdom or Switzerland, we do not set analytics or advertising cookies, and we do not load the Meta Pixel, until you choose "Accept" in our cookie banner. You can decline with one click, choose categories individually, and change your mind at any time through the "Cookie settings" link in the footer. We implement Google Consent Mode so that Google tags respect your choice. Elsewhere, these tools may run by default and you can opt out at any time through the same "Cookie settings" link, through the tool-specific controls below, or by enabling a Global Privacy Control signal in your browser, which we honour as an opt-out of targeted advertising and "sale/sharing" where the law recognises it.

5.1 Google Analytics 4 (Google LLC)

• What it does: measures how visitors use our website and application — pages viewed, events such as starting a trial or completing signup, session duration, approximate location at city level, device and browser, and the campaign or referrer that brought you.
• How: first-party cookies (_ga and _ga_<container-id>) that store a random client identifier; the Google tag also processes your IP address to derive approximate location but Google Analytics 4 does not log or store IP addresses.
• Settings we use: data retention set to 14 months; Google Signals (cross-device and demographic reporting using signed-in Google users) and advertising features enabled only where you have consented to advertising cookies; data-sharing with other Google products limited to what is necessary for measurement.
• Google's role: Google processes this data for us as a processor and, to the extent it uses it for its own purposes under its terms, as an independent controller. Google's privacy policy: policies.google.com/privacy.
• Your controls: cookie settings; the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

5.2 Google Search Console (Google LLC) Search Console gives us aggregated reports about how mapsharvest.com appears in Google Search — the search queries for which our pages appeared, impressions, clicks and average position. This data comes from Google's own search systems, not from a tag on our website, and does not identify individual visitors to us. We mention it for completeness because it is part of how we measure marketing.

5.3 Meta Pixel and Conversions API (Meta Platforms, Inc. and Meta Platforms Ireland Ltd.)

• What it does: lets us measure the results of our advertising on Facebook and Instagram, show ads to people who have visited our website or taken specific actions (retargeting), build audiences of people similar to our customers, and exclude existing customers from our ads.
• What is collected: the pages you visit and actions you take on our site (for example viewing the pricing page, starting signup, starting a trial, purchasing), the time, your browser and device information, your IP address, Meta's cookie identifiers (_fbp and _fbc) and the fbclid click identifier. Where we enable Advanced Matching or the Conversions API, we may also send Meta contact details you have given us (such as your email address) in hashed form, so that Meta can match the event to a Meta account. If you are logged in to a Meta service, Meta may link this information to your profile.
• Roles: for the collection of this data and its transmission to Meta, we and Meta are joint controllers, and the Meta Business Tools Terms and Controller Addendum apply. Meta then processes the data for its own purposes as an independent controller under its Privacy Policy (facebook.com/privacy/policy).
• Your controls: cookie settings; Meta's "Your ad preferences" and "Off-Facebook activity" / "Your activity off Meta technologies" settings; Global Privacy Control.

5.4 Vercel Web Analytics and Speed Insights (Vercel Inc.) Our hosting provider gives us aggregated page-view and performance statistics. These tools do not use cookies; they generate a hashed identifier from the request that is discarded after each day and cannot be used to identify you across days.

5.5 IP addresses Your IP address is processed by our servers, our hosting and content-delivery providers, and the tools above. We use it to: deliver the website and application; protect the Service (rate limiting, blocking abusive traffic, detecting duplicate or automated accounts and trial or referral abuse); derive your approximate location so that we can show the right currency, tax treatment, legal notices and cookie banner; and, in analytics and advertising tools, derive approximate location for reporting. We keep IP addresses in security and access logs for up to 90 days, and longer only where needed to investigate a specific security incident or abuse, or to establish, exercise or defend legal claims.

5.6 Email measurement Emails we send through our email delivery provider may include a tracking pixel and tracked links that tell us whether an email was opened or clicked. We use this to measure engagement and fix delivery problems. You can prevent open tracking by blocking images in your email client, and you can unsubscribe from marketing emails at any time.

5.7 Microsoft Clarity (Microsoft Corporation)

• What it does: gives us anonymised session recordings, heatmaps, and click and scroll behaviour so we can see how visitors actually use our website and find points of friction.
• What is collected: pages viewed, clicks, scrolling and mouse movement, approximate location at country/region level, device and browser information, and referring page. Clarity sets a small number of cookies to link these events into a session and to recognise returning visitors; some of these (for example MUID) are Microsoft identifiers that Microsoft's own systems may also use for advertising and analytics across Microsoft properties, as described in Microsoft's Privacy Statement (privacy.microsoft.com). We do not use Clarity data for advertising ourselves, and we do not send Clarity any special-category data or full form field contents.
• Consent: the Clarity tag does not load at all — no script, no cookies — until you choose "Accept" in our cookie banner. Choosing "Essential only", or later withdrawing consent through the "Cookie settings" link in the footer, stops Clarity from recording.
• Retention: Microsoft retains Clarity data for between 30 days and 13 months depending on the data type, per Clarity's published retention policy.
• Microsoft's role: Microsoft processes this data for us as a processor and, for the identifiers described above, may also act as an independent controller under its own Privacy Statement.
• Your controls: cookie settings; Microsoft's privacy dashboard at privacy.microsoft.com.

6. Marketing communications

We send transactional emails (receipts, trial and renewal reminders, security notices, changes to terms) to everyone with an account; you cannot opt out of these while you have an account. We may also send marketing emails about new features, guides and offers. You can unsubscribe from marketing emails at any time by clicking the link in any such email or by emailing support@mapsharvest.com; we will act on your request within 10 business days. We do not send marketing SMS and we do not share your contact details with third parties for their own marketing.

7. Cookies

We use strictly necessary cookies (for example the authentication cookies that keep you signed in, and a cookie that remembers your cookie choices), analytics cookies and advertising cookies. Our Cookie Policy lists them, explains how long they last, and describes how to manage them. Blocking strictly necessary cookies will prevent you from signing in.

8. Information about businesses that appear in our results ("Business Listing Data")

What we collect and from where. On our customers' instructions, our systems visit public Google Maps listings that match a category and geography and collect the information those listings display, such as: business name, category, address, city and region, phone number, website and domain, Google Maps URL, Plus Code and map coordinates, rating and review count, a breakdown of ratings by star, the business description, opening hours, price level, service options (for example delivery or take-away), whether the listing is marked temporarily closed, when the listing was last updated by its owner, and the time of collection. The current list of fields is published at mapsharvest.com/docs. We do not collect reviewer names or review text.

Whose personal data this can be. Most listings describe companies. Where a listing describes a sole trader, an independent professional or a small business identified by a person's name, the listing details are personal data about that person under laws such as the GDPR and UK GDPR, even though the person has published them.

Why we collect it and on what basis. We collect Business Listing Data so that our customers can identify and contact businesses for legitimate business-to-business purposes — sales prospecting, market research, recruitment and partnership outreach. Our legal basis is our legitimate interest, and that of our customers, in enabling business-to-business communication using contact details that businesses have deliberately made public for the purpose of being contacted, balanced against the rights of the people concerned and supported by the safeguards below. You can ask us for a summary of this assessment.

Safeguards. We collect only the published listing fields described above and nothing from behind a login; we hold delivered results for a limited time (Section 10); our Terms require customers to use results lawfully, to honour opt-outs and to comply with marketing laws; and we operate a suppression list so that a listing whose owner objects is excluded from all future results.

Your rights if your business appears in our results. You may object to our processing, ask what we hold, and ask us to delete your listing details and add your listing to our suppression list, by emailing support@mapsharvest.com with the Google Maps link to your listing. We will action suppression requests within 10 days and confirm when done. We will also pass your objection to any customer who received your details in the previous 30 days and require them to delete it. Our Business Listing Notice explains this in more detail.

9. When and with whom we share information

We share personal information only as described here. We do not sell it for money.

9.1 Service providers

We use a small number of specialist companies to run MapsHarvest. They process personal information only to provide their service to us, under contracts that restrict them to our instructions and require appropriate security. By category:

• Cloud infrastructure: the hosting, database, authentication and file-storage providers on which the Service runs, located in the United States, the United Kingdom and the European Union.
• Payments: Stripe, our payment processor. You interact with Stripe directly at checkout, and its systems handle your card details; we never see them.
• Email delivery: a transactional email provider in the United States, which processes your email address to deliver the messages described in Section 6.
• Analytics and advertising: the tools described in Section 5. Google (Analytics), Meta (Pixel) and Microsoft (Clarity) are named there because their tags run in your browser with your consent where required, and they may also use the data they receive for their own purposes, as described in Section 5 and in their privacy policies.
• Sign-in providers: Google, LinkedIn or GitHub — only if you choose to sign in with one of them.
• Partner payouts: a payment provider used to pay Partner Program commissions to partners.

The current, named list of the sub-processors that handle content stored in your account — with each one's role, location and transfer safeguard — is published in Annex 3 of our Data Processing Addendum, where we keep it updated and give advance notice of changes as described there. You may also ask us at any time which specific providers process your personal data, and we will tell you.

9.2 Advertising platforms. As described in Section 5, Google and Meta receive information about your visits through their tags where you have consented or not opted out. Under some US state privacy laws this is treated as "sharing" for cross-context behavioural advertising or as a "sale". You can opt out as described in Section 12.

9.3 Partners and referrers. Partners in our Partner Program see aggregated statistics about the customers they referred (number of signups, conversions and commission amounts) but not the customers' names or contact details, unless the customer chooses to share them with the partner directly.

9.4 Customers. If you are the owner of a business listing, your public listing details are delivered to the customers who requested results matching your category and location (Section 8).

9.5 Legal and safety. We may disclose information if we believe in good faith that it is necessary to comply with a law, regulation, legal process or governmental request; to enforce our Terms; to detect, prevent or address fraud, abuse or security issues; or to protect the rights, property or safety of MapsHarvest, our users or the public.

9.6 Business transfers. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any change in ownership or in the use of your personal information.

9.7 With your consent or at your direction, for example when you connect a third-party integration or ask us to share information with someone.

10. How long we keep information

When retention periods end we delete or irreversibly anonymise the data. Where deletion is not immediately possible (for example in encrypted backups), we isolate the data from further use until deletion is possible.

11. Security

We protect personal information with measures appropriate to its sensitivity, including encryption in transit (HTTPS/TLS) and at rest with our providers, hashed passwords and API keys, row-level access controls in our database, least-privilege access for staff, signed and expiring download links, logging and monitoring, and separation of our collection engine from customer data. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information and creates a risk to you, we will notify you and the relevant authorities as the law requires.

12. Your rights and choices

12.1 Everyone. Whatever your location, you can: access and update most account information in your dashboard settings; delete your account from settings or by emailing us; unsubscribe from marketing emails; change your cookie choices; and ask us for a copy, correction or deletion of the personal information we hold about you. Email support@mapsharvest.comwith the subject "Privacy request". We will verify your identity (usually by replying to your account email) and respond within 30 days, or within any shorter period the law requires. We will not discriminate against you for exercising your rights.

12.2 European Economic Area, United Kingdom and Switzerland. You have the right to access your personal data; to rectification; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests (including profiling) and, at any time and without giving reasons, to direct marketing; and to withdraw consent at any time. You may lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

12.3 United States. Depending on your state (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Iowa, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island), you may have the right to know what personal information we collect and how we use and disclose it; to access, correct and delete it; to obtain a portable copy; to opt out of the "sale" or "sharing" of personal information, of targeted advertising and of certain profiling; and to appeal a decision we make about your request. We honour these requests for all US residents regardless of whether a particular law technically applies to us. To opt out of targeted advertising and sale/sharing, use the "Do Not Sell or Share My Personal Information" / "Cookie settings" link in our footer, or enable the Global Privacy Control signal in your browser, or email us. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information for purposes that require a right to limit. If we deny a request, you may appeal by replying to our decision email; if your appeal is denied, you may contact your state attorney general. Notice at collection (California): the categories of personal information we collect are identifiers, customer records, commercial information, internet activity, approximate geolocation, professional information and inferences drawn from the above, for the purposes and retention periods described in Sections 3 and 10; we disclose identifiers, internet activity and commercial information to advertising partners as described in Section 5, which may be "sharing". We do not offer financial incentives in exchange for personal information other than the referral credits described in our Terms.

12.4 Canada. You may request access to and correction of your personal information and withdraw consent, subject to legal and contractual restrictions. If you are in Quebec, our person in charge of the protection of personal information is Omar Darwish, Managing Member, and can be reached at support@mapsharvest.com; your personal information may be communicated outside Quebec, including to the United States and the United Kingdom, and we have assessed the privacy factors involved. You may complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

12.5 Australia. We handle personal information in accordance with the Australian Privacy Principles. You may request access to and correction of your personal information and complain to us first; if you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). Your information is disclosed to overseas recipients in the United States and the United Kingdom as described in Sections 9 and 13.

12.6 India. If you are in India, you may access, correct and erase your personal data, nominate a person to exercise your rights, withdraw consent, and raise a grievance with our Grievance Officer at support@mapsharvest.com (Attn: Grievance Officer — Omar Darwish). We will respond within the time required by the Digital Personal Data Protection Act, 2023 and its Rules. If you are not satisfied, you may approach the Data Protection Board of India.

12.7 Other countries. If you live elsewhere and have rights under local law, email us and we will honour them to the extent the law requires and, where practical, beyond it.

12.8 Do Not Track and Global Privacy Control. Browsers may offer a "Do Not Track" signal; there is no accepted standard for it, and we do not respond to it. We do honour the Global Privacy Control signal as an opt-out of targeted advertising and of sale/sharing where the law recognises it.

13. International transfers

We are based in the United States, our collection engine runs in the United Kingdom, and our providers process data in the United States, the United Kingdom and the European Union. When personal information originating in the EEA, the UK or Switzerland is transferred to a country that has not been found to provide adequate protection, we rely on: the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, for providers certified under them (we check certifications when we engage a provider); the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with transfer risk assessments, for other providers and for transfers to us; and, for transfers from the EEA to the UK, the European Commission's adequacy decision for the United Kingdom. The sub-processor list in our Data Processing Addendum shows the mechanism that applies to each provider, and you can ask us for a copy of the relevant safeguards.

14. Children

The Service is for adults and businesses. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

15. Automated decision-making

We use automated rules to detect abuse — for example to flag duplicate accounts, unusual signup patterns or payment fraud. These rules may temporarily restrict an account, but any decision to suspend or terminate an account is reviewed by a person, and you can contest it by contacting us. We do not make decisions with legal or similarly significant effects on you based solely on automated processing.

16. Changes to this Policy

We may update this Policy from time to time. If we make material changes — for example adding a new category of data, a new purpose, or a new type of recipient — we will notify you by email or by a prominent notice in the Service before the change takes effect, and we will update the "Last updated" date. Earlier versions are available on request.

17. Contact us

Privacy questions and requests: support@mapsharvest.com(subject "Privacy request"), or write to ODD Media LLC, 30 N Gould St, Ste 4000, Sheridan, WY 82801, USA.