Privacy Notice

This Notice applies to visitors, prospective customers, account holders, Authorized Users, administrators, billing contacts, support contacts, and other people who interact directly with Cartograph. It also provides a high-level explanation for a person whose information appears in Customer Content.

For account, website, billing, support, sales, product-security, and legal records, Cartograph generally acts as the controller or business. For Customer Personal Data, the customer generally acts as controller or business and Cartograph acts as processor or service provider. If your information came to Cartograph through one of our customers, contact that customer first. We will assist the customer with requests as required by law and the DPA.

This Notice does not govern a customer’s own privacy practices or a third-party service a customer chooses to connect with Cartograph.

A. Website, sales, and support

We collect information you submit, such as name, work email, employer, role, inquiry, meeting details, support messages, feedback, screenshots, and files. Our website and security systems collect browser and device type, operating system, language, IP address, approximate network location, referral source, pages viewed, timestamps, and cookie or similar identifiers. See the Cookie Notice.

Subject to your choices and the regional rules below, our public website uses Google Analytics (Google LLC) and PostHog to understand how visitors find and use the site, and Vercel Analytics and Speed Insights to measure visits and performance. This includes page views, campaign and referral sources, browser and device characteristics, approximate location, online identifiers, signup and sign-in link clicks, form progress and submission outcomes, scheduling handoffs, search result counts and selections, downloads, sharing, and content engagement. These providers process information for our website measurement purposes. We do not send entered names, email addresses, phone numbers, inquiry text, or raw site-search text as website analytics event fields. Campaign links may contain a random link ID. A visit is an engagement signal and does not establish who clicked; we do not automatically identify visitors as the intended recipients. When you submit an inquiry while analytics is allowed, we may connect its original campaign and random browser identifiers to the resulting Attio sales opportunity for up to one year. We send subsequent sales-stage changes and, when recorded, the won deal value to Google Analytics and PostHog to measure campaign outcomes. We do not send your CRM contact details or inquiry text to these analytics providers. Deal value is not proof of payment or revenue received. Declining analytics in Cookie settings on the submitting browser stops future linked outcome measurement once the withdrawal reaches our server; contact us to exercise your rights if that browser or its saved settings are no longer available. Session recording, Google signals, and advertising personalization are disabled for this website tracking. See our Cookie Notice and how Google uses information from sites and apps that use its services.

B. Accounts and administration

We collect name, business email, profile image, user and organization identifiers, workspace, role, permissions, account preferences, authentication and session information, invitations, administrator actions, and integration configuration. Authentication credentials and connected-service secrets are handled by authentication and vault providers; Cartograph does not intentionally store plaintext passwords or provider tokens in ordinary product records.

C. Billing and legal records

We collect billing contacts, plan, usage quantities, invoices, payment status, transaction identifiers, organization location, accepted legal-document versions, authority attestations, acceptance time, session, IP address, browser information, and Enterprise Agreement records. Payment-card details are collected by our payment provider; Cartograph does not store complete card numbers.

D. Product use and telemetry

We collect product events, feature use, workspace and user identifiers, diagnostics, performance, errors, security events, support interactions, and limited session-replay information where enabled. Replay is configured to mask typed and rendered text. We may collect AI operational metadata such as model, latency, token counts, tool names, and success or failure. We do not intentionally send Customer Content to product analytics unless a feature expressly requires and permits it.

E. Customer Content

Depending on customer configuration, Customer Content may include supplier and customer records, contact details, accounting and operational records, email, messages, call audio or transcripts, documents, files, tasks, prompts, AI interactions, tool activity, workflow results, and data from connected systems. The customer controls what it submits and which features it enables.

F. Connected mailboxes

A customer may connect a Microsoft 365 or Gmail mailbox through the provider’s sign-in and consent flow. Cartograph accesses the account’s basic identity (email address, name, profile image, and account identifier) and the content of the folders the mailbox owner selects for syncing, including folder and label structure, message headers and bodies, and attachment names and metadata. Provider credentials are handled by our vault provider as described in Section 2.B.

Connected-mailbox content is Customer Content and is used only to provide features the mailbox owner or workspace can see and control: synced conversations shown beside tasks and records, messages a person composes and approves, archiving and filing actions a person takes in Cartograph, AI features such as conversation summaries and triage suggestions, and provider change notifications that deliver new mail without polling. Cartograph’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and information received from Google Workspace scopes adheres to the Google User Data Policy, including the Limited Use requirements. The same commitments apply to connected Microsoft mailboxes.

We do not use connected-mailbox content for advertising. We do not sell it or transfer it to data brokers or information resellers. Consistent with Section 3, we do not use it to train third-party or general-purpose foundation models. Cartograph personnel do not read synced mail except with the mailbox owner’s or workspace’s permission, during a security investigation, or as required by law. Disconnecting a mailbox stops syncing and deletes the stored credentials; access can also be revoked in the provider’s account security settings. Previously synced mail remains Customer Content and is retained and deleted under Section 5, the DPA, and workspace controls.

We use personal information to:

• provide accounts, authentication, workspaces, billing, support, and requested services;
• communicate about inquiries, the Service, security, billing, legal changes, and customer relationships;
• secure, monitor, troubleshoot, test, evaluate, and improve Cartograph;
• measure service quality, reliability, usage, and outcomes;
• prevent fraud, abuse, unauthorized access, and violations of our agreements;
• process Customer Content under the customer’s instructions and the DPA;
• comply with law and establish, exercise, or defend legal claims; and
• create information that is legally anonymized, de-identified, or aggregated.

Identifiable Customer Content may be used to provide, secure, support, test, evaluate, debug, and improve the Cartograph service the customer uses. Cartograph does not use identifiable Commercial Customer Content to train third-party or general-purpose foundation models. We may use legally de-identified or aggregated derivatives for benchmarking, research, product improvement, and industry or market analysis where they identify neither an individual nor the originating customer. Redacted or pseudonymous text, embeddings, and near-verbatim transcripts remain protected when they can reasonably be linked back.

We disclose information only as reasonably necessary for the purposes above:

• Service providers and subprocessors. Hosting, database, storage, authentication, communications, AI inference, analytics, billing, support, document-processing, security, and integration providers process information for us. Providers processing Customer Personal Data are listed on the Subprocessor List.
• Customer and administrators. Workspace administrators and authorized personnel may access account activity, Customer Content, configuration, billing, and legal status according to their permissions.
• Customer-directed recipients and integrations. We send information when a customer directs Cartograph to connect a service, deliver a message, place a call, share a file, or take another action. The recipient’s own terms may then apply.
• Legal, safety, and security. We may disclose information to comply with law or valid process, enforce agreements, investigate abuse or incidents, protect people or property, or establish and defend claims.
• Business transactions. Information may be disclosed in diligence and transferred as part of a financing, merger, acquisition, reorganization, bankruptcy, or sale, subject to appropriate confidentiality and legal safeguards.
• Professional advisers. Lawyers, accountants, insurers, auditors, and other advisers may receive information under professional or contractual duties.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising and do not use it for third-party targeted advertising. We do not claim that every service-provider or customer-directed disclosure is categorically exempt from every jurisdiction’s definition of sale; we structure those relationships and disclosures to comply with applicable law.

We retain information only as long as reasonably necessary for the purpose collected, customer instructions, security, account administration, dispute resolution, and legal, tax, or accounting obligations. Retention depends on the type and sensitivity of information, workspace status, product configuration, legal requirements, and whether an enforceable deletion control is available.

Customer Content is retained and deleted under the DPA, product controls, and any Enterprise Agreement. Workspace deletion removes active access and begins the documented deletion process. Some information may remain temporarily in protected backups or provider systems, or longer where required for legal claims, billing, security, fraud prevention, or suppression lists.

For public-website Google Analytics, event-level and user-level data are configured to be retained for fourteen months, without resetting user-data retention on new activity. These controls do not apply to standard aggregated reports. Cookie lifetimes are separate and are described in the Cookie Notice.

Legal acceptance evidence is retained for the customer relationship and generally seven years afterward so we can establish which agreement applied. Security audit records may be retained longer where their purpose is to preserve evidence of access, deletion, and compliance.

We use administrative, technical, and organizational safeguards designed for the nature of the information, including access controls, encryption in transit and at rest through our infrastructure, workspace isolation, secrets management, logging, incident response, and deletion procedures. No system is perfectly secure. Cartograph has not completed a SOC 2 audit and does not claim SOC 2, ISO 27001, or another security certification.

Some features let a person connect a Google account to Cartograph — today, a Gmail mailbox — through Google’s sign-in and consent flow. This section describes how Cartograph handles information received from Google APIs. Where it is more specific than the rest of this Notice, this section controls for that information.

A. What we access

With the mailbox owner’s consent, Cartograph requests the Gmail permission that allows reading, sending, and organizing mail (gmail.modify) and the basic sign-in permissions that identify the account (email address, name, profile image, and account identifier). Using those permissions, Cartograph accesses the mailbox’s labels and folders and, for the folders the owner chooses to sync, message headers, message bodies, and attachment names and metadata.

B. How we use it

Gmail data is used only to provide user-facing features of the Service that the mailbox owner or their workspace can see and control:

• importing and continuously syncing the selected folders so conversations appear beside the workspace’s tasks and records;
• sending replies and new messages that a person explicitly composes and approves;
• archiving or filing a message when a person takes that action in Cartograph;
• AI features a person can see and invoke, such as conversation summaries and triage suggestions; and
• registering change notifications with Google so new mail appears without polling.

Cartograph’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes adheres to the Google User Data Policy, including the Limited Use requirements.

C. What we do not do with it

We do not use Gmail data for advertising of any kind. We do not sell it or transfer it to data brokers or information resellers. We do not use it to determine credit-worthiness or for lending. We do not use Gmail data to create, train, or improve generalized artificial-intelligence or machine-learning models; AI features operate on a person’s own connected data solely to provide the features described above. No person at Cartograph reads synced mail unless the mailbox owner or their workspace permits it, it is necessary for a security investigation such as abuse or incident response, or the law requires it.

D. Storage, sharing, retention, and deletion

Synced mail is stored in the customer’s isolated workspace database and protected as described in Section 5, including encryption in transit and at rest. Google account credentials are held by our vault provider and are not stored in ordinary product records. Gmail data is disclosed only to the subprocessors that host and operate the Service, listed on the Subprocessor List; when the mailbox owner or their workspace directs an action, such as sending an email; for the security and legal reasons in Section 4; or in a business transaction as described there.

Disconnecting a mailbox in Cartograph stops syncing and deletes the stored Google credentials. A person can also revoke Cartograph’s access at any time in their Google Account security settings. Previously synced mail remains part of Customer Content and is retained and deleted under Section 5, the DPA, and workspace controls, including workspace deletion.

Depending on your location and applicable law, you may have rights to know, access, correct, delete, restrict, object to, or obtain a portable copy of personal information; withdraw consent; opt out of certain sale, sharing, targeted advertising, or profiling; and appeal a denied request.

Submit a request to hello@cartograph.ai with the subject “Privacy Request.” Describe your relationship with Cartograph and the right you wish to exercise. We may verify identity and authority. An authorized agent may act where law permits and sufficient authorization is provided.

If the request concerns Customer Content, contact the relevant customer first. We may refer the request to that customer and assist it under the DPA. We will not discriminate against a person for exercising an applicable right.

For new visitors whose network location is the United States, optional public-website analytics may run without an opt-in popup unless they decline or enable Global Privacy Control. Outside the United States, or when location is unknown, analytics runs only after you accept it. We use our hosting provider’s approximate request country for this rule, not your language or selected country, and do not store the country in an analytics-choice cookie. Saved declines remain effective everywhere. Use Cookie settings in the website footer to enable, decline, or withdraw consent at any time. Declining analytics or withdrawing consent stops subsequent optional analytics collection on this website and clears its accessible analytics cookies and browser storage; it does not undo processing that already occurred. We honor Global Privacy Control by keeping optional website analytics off. Updated consent is requested when we materially change the analytics provider scope. Account and service communications necessary to provide or secure the Service are not marketing opt-ins. Marketing emails include an unsubscribe method where required.

A. United States

Where a comprehensive state privacy law applies, the categories collected include identifiers, customer records, commercial and billing information, internet or network activity, approximate geolocation from IP, professional information, communications content, inferences, and sensitive information that may appear in credentials or Customer Content. We use and disclose those categories for the purposes and recipient categories described above. We do not sell or share personal information for cross-context behavioral advertising. State residents may use the request method in Section 7 and may appeal by replying to our decision.

B. European Economic Area

Where the GDPR applies to information Cartograph controls directly, we rely on performance of a contract, our legitimate interests in operating, securing, supporting, and improving a B2B service, consent for optional public-website analytics, consent where otherwise requested, and compliance with legal obligations. You may object to processing based on legitimate interests and may complain to the supervisory authority where you live or work. For Customer Personal Data, the customer determines the lawful basis and Cartograph processes under the DPA.

Cartograph and its providers process information in the United States and other countries. Where required, international transfers use an adequacy decision, Standard Contractual Clauses, or another lawful safeguard. Google Analytics processing is governed by Google’s Data Processing Terms, including their applicable international-transfer provisions. Contact us to request information about the safeguards relevant to your data. The public website is available in English, Spanish, and German; these legal notices are provided in English. Contact us if you need help understanding this Notice. Customers are responsible for providing notices to their own data subjects in a language and form those people can understand.

C. Canada outside Quebec

Where Canadian federal, Alberta, or British Columbia private-sector law applies, we process information with consent or another permitted basis and use contractual and other safeguards for providers outside Canada. Information processed in another country may be accessible to authorities under that country’s law. You may request access or correction, withdraw consent subject to legal and contractual limits, and complain to the Office of the Privacy Commissioner of Canada or the relevant provincial regulator.

D. Quebec and Mexico

Self-serve access is unavailable to organizations established in Quebec or Mexico. Cartograph provides this standard-form agreement in English and does not offer self-serve access in Quebec. Mexico is unavailable because this Notice does not provide the business domicile required for a Mexican privacy notice. See Supported Regions. These service-eligibility restrictions do not remove applicable privacy rights for public-website visitors.

We may update this Notice to reflect changes in Cartograph, providers, or law. We will publish a new version and effective date. If a change materially affects how we use or disclose personal information, we will provide additional notice and obtain renewed acceptance or consent where required. We do not silently apply a materially broader use to information collected under an earlier promise.

Cartograph is not directed to children and is not intended for anyone under 18. Customers must not use Cartograph to process children’s information unless Cartograph has expressly agreed in writing and required safeguards are in place.

Cartograph Technologies, Inc.
Seattle, Washington, United States
Email: hello@cartograph.ai

A non-home business mailing address and dedicated privacy email will be added before any jurisdiction that requires those details is activated.