Introduction

This Privacy Policy outlines how xMap Inc. ("xMap", "we", "us", or "our") collects, uses, discloses, stores, and protects personal and geospatial data when you ("you", "your") access or use our software-as-a-service platform located at https://xmap.ai (the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy and consent to the data practices described herein.

Scope

This Privacy Policy applies to all users of the Service and governs the data practices related to personal data and geospatial inputs. This policy complies with applicable privacy laws including but not limited to the California Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR), and the Children's Online Privacy Protection Act (COPPA).

If you are located outside of the United States, you acknowledge and consent to the processing of your data in the United States.

Categories of Data Collected

We collect the following categories of information:

• Personal Identifiers: Full name, email address, phone number, account credentials
• Commercial Information: Transaction history, service usage
• Device & Technical Data: IP address, browser type, OS, device ID, cookies, logs
• Geospatial Information: Location queries, map layers, metadata
• Communications: Support tickets, surveys, feedback
• Sensitive Information: We do not intentionally collect sensitive data (e.g., racial, biometric, health). Users are prohibited from uploading such data

You are solely responsible for ensuring that any data you submit does not violate any applicable laws or third-party rights.

Legal Bases for Processing (GDPR)

If you are located in the EEA, UK, or Switzerland, we rely on the following legal bases:

• Consent
• Performance of a contract
• Compliance with legal obligations
• Legitimate interests, including maintaining platform security and improving user experience

Methods of Collection and Consent

Data is collected via:

• Direct submissions by users
• Automated tracking tools (e.g., cookies, pixels)
• Third-party integrations
• APIs and external datasets

Consent is obtained at the time of account creation via explicit clickwrap acceptance of our Privacy Policy and Terms of Service. Cookie consent is obtained through a compliant cookie banner upon first visit.

Use of Information

We use collected data to:

• Operate and maintain the Service
• Process billing and transactions
• Provide customer support and respond to inquiries
• Improve the platform through analytics
• Detect and prevent fraud and abuse
• Comply with legal obligations
• Communicate with users about service updates

We do not use data for automated decision-making without human oversight.

Use of Aggregated and Anonymized Data

We may process personal and geospatial data in an aggregated and/or anonymized form for purposes that include, but are not limited to:

• Analyzing usage trends and user behavior
• Enhancing and optimizing the performance of the Service
• Developing new features, models, and analytical tools
• Supporting internal research and business intelligence
• Generating insights that do not identify any individual user

Aggregated and anonymized data is stripped of personally identifiable information and cannot reasonably be used to identify you. This type of data does not constitute personal data under applicable privacy laws and may be retained or shared with third parties at our discretion, provided it remains non-identifiable.

We do not use aggregated or anonymized data for profiling or automated decision-making that produces legal or similarly significant effects on users.

All such processing is conducted in compliance with relevant data protection regulations, including GDPR, CCPA, and other applicable laws.

Data Sharing and Disclosure

We may disclose personal data to:

• Service providers (hosting, support, analytics, payments) under strict confidentiality and data processing agreements
• Legal authorities as required by subpoena, court order, or applicable law
• Buyers or successors in connection with a merger, sale, or corporate restructuring
• Third-party partners only with your consent or as part of a disclosed integration

A current list of third-party subprocessors is available upon request.

International Transfers

Data may be transferred to and stored in jurisdictions outside your country of residence, including the United States.

For EEA, UK, and Swiss residents, we rely on Standard Contractual Clauses (SCCs) or other lawful mechanisms to legitimize international transfers.

Cookies and Tracking Technologies

We use cookies and other tracking mechanisms to:

• Authenticate users
• Analyze traffic and usage patterns
• Improve performance and personalization

Users can manage cookie preferences via browser settings or opt-out mechanisms provided in our cookie banner. Visit our Cookie Policy for more details.

Data Retention

We retain your data for as long as necessary to:

• Provide the Service and fulfill contractual obligations
• Comply with legal requirements
• Enforce our rights and agreements

If you deactivate your account, we may retain your personal data in a secure and inactive state for operational and legal purposes. If you request account deletion, we will delete your personal data within 30 days of verification, unless we are legally required to retain it longer.

Even after deletion, we may retain and continue to use data that has been irreversibly anonymized or aggregated for analytics, research, and product development purposes, in compliance with applicable laws.

You may request deletion of your data at any time by contacting privacy@xmap.ai, subject to our legal and regulatory obligations.

Data Security

We implement industry-standard technical and organizational measures, including:

• Encryption at rest and in transit
• Role-based access control (RBAC)
• Multi-factor authentication (MFA)
• Regular security assessments and audits

Despite our efforts, no system is completely secure. You acknowledge and accept this residual risk.

User Rights and Controls

Depending on your jurisdiction, you may have the following rights:

• Access your personal data
• Request correction or deletion
• Object or restrict processing
• Data portability
• Opt-out of marketing communications

To exercise these rights, email privacy@xmap.ai. We will respond within the timeframes required by applicable laws and may request identity verification.

Children's Privacy

The Service is not directed to individuals under the age of 13 (or 16 in applicable jurisdictions). We do not knowingly collect data from children. If we become aware that we have inadvertently collected such data, we will delete it promptly in accordance with COPPA.

Data Breach Notification

In the event of a data breach involving personal information, we will notify affected users and authorities within 72 hours where required by law, and provide actionable information to minimize potential harm.

Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. We will notify users of material changes via email and platform notifications. Continued use of the Service constitutes acceptance of the updated terms.

Contact Information

For any questions, concerns, or requests related to this Privacy Policy, contact:

xMap Inc.
Email: privacy@xmap.ai