MapWorthy Inc. ("MapWorthy", "we", "us") operates mapworthy.ai, a site-evaluation service for franchise brands. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. We are based in Alberta, Canada, and we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA).
What we collect
- Account information. Your email address, your password (stored only in hashed form by our authentication provider — we never store or see your password in plain text), and the company or brand name you give your account.
- Brand profile information. The brand names, cuisine categories, and competitor terms you configure. This is business information you choose to provide.
- Evaluation activity. The addresses you evaluate, the reports the service generates for you, the evaluations you save, and your usage counts against your plan's allowance.
- Technical information. Your IP address (used for security rate limiting on sign-in), standard server logs, and a session cookie (below).
- Payment information — when you subscribe. Payments are processed by a dedicated payment processor. We do not collect, store, or see your full card number. We receive confirmation of payment status and the billing details needed to administer your subscription.
We do not collect more than we need. We do not buy data about you from third parties, and we do not sell personal information to anyone.
How we use it
- To provide the service: authenticate you, run evaluations you request, store your saved reports, and administer your plan allowance.
- To secure the service: rate-limit sign-in attempts, keep audit records of account-level events, and investigate abuse.
- To communicate with you: transactional email such as account invitations, password resets, and billing notices.
- To improve the service, using aggregate usage information that does not identify you.
We do not use your evaluation data to build products for other customers, and we do not disclose your evaluations, your brand configurations, or your candidate sites to anyone else. Your site pipeline is your business.
Cookies and local storage
MapWorthy uses one cookie: a signed session cookie that keeps you signed in. It is essential to the service and is not used for advertising or cross-site tracking. We do not currently use analytics or advertising cookies on mapworthy.ai. If that changes — for example, if we add a measurement pixel for our own advertising — we will update this policy first and, where required, ask for your consent.
If you use the "Add to compare" feature, your browser stores a local copy of the compared evaluations (including competitor listings from those reports) in its own local storage, on your device only. We cannot see it, and you can remove it at any time by clearing your browser's site data for mapworthy.ai. See the Cookie Policy for detail.
Who processes your information
We use a small number of service providers to run MapWorthy. Each receives only what it needs to do its job:
| Provider | Purpose | What it handles |
|---|---|---|
| Supabase | Database and authentication | Account, brand, and evaluation data. Hosted in the Canada (Central) region. |
| Render | Application hosting | Runs the service; server logs including IP addresses. May be located in the United States. |
| Google Maps Platform | Geocoding, imagery, and place data | The addresses and coordinates you evaluate are sent to Google to be located and enriched. Google's own privacy policy applies to its processing. |
| Routing providers | Drive-time analysis | Site coordinates only. |
| Resend | Transactional email | Your email address and the content of service emails we send you. |
| Payment processor (on subscription) | Billing | Payment card details, handled entirely by the processor under its own certified security standards. |
Some providers store or process information outside Canada, including in the United States. While in another jurisdiction, information may be accessible to that jurisdiction's authorities under its laws. We choose providers with strong security practices and limit what each receives.
Census and demographic figures in your reports come from published Statistics Canada data. They are public statistics about areas, not personal information about you.
How long we keep it
- Account and brand data: for as long as your account is active, and for a reasonable period afterwards to allow reactivation and to meet legal obligations.
- Evaluations and saved reports: until you delete them or your account is deleted.
- Security and audit records: for as long as needed for security purposes; records of any breach of security safeguards are kept for at least 24 months as required by Canadian regulations.
When information is no longer needed, we delete it or render it anonymous.
Your rights
- Access. You can ask what personal information we hold about you and how it is used.
- Correction. You can ask us to correct inaccurate information.
- Deletion. You can ask us to delete your account and its data, subject to record-keeping we are legally required to retain.
- Withdraw consent. You can withdraw consent to optional uses at any time; if the use is essential to the service, withdrawing it may mean closing your account.
To exercise any of these, contact us at the address below. We respond within the timelines PIPEDA requires. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).
We send transactional email needed to run your account: invitations, password resets, and billing notices. We do not send marketing email without your consent, and any marketing message we ever send will identify us and include a working unsubscribe, as Canada's Anti-Spam Legislation (CASL) requires.
Security
Personal information is protected with safeguards appropriate to its sensitivity: encrypted connections throughout, hashed passwords, signed session cookies, tenant isolation at the database layer, security rate limiting, and audit logging of account-level events. No system is perfectly secure, but we build as if the next reader of any record might be hostile.
For users in the United States
MapWorthy serves customers in Canada and the United States. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information beyond what is needed to provide the service. As a small Canadian business, we do not currently meet the applicability thresholds of the California Consumer Privacy Act; regardless, we extend the same rights described above — access, correction, and deletion — to all users, wherever they are. US users can exercise them through the same contact below.
Children
MapWorthy is a business tool. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.
Changes to this policy
If we change this policy, we will post the new version here with a new effective date. If a change materially affects how we handle personal information already collected, we will notify account holders by email before it takes effect.
Contact
Privacy questions and requests: mapworthysites@gmail.com
MapWorthy · Alberta, Canada