Privacy Policy

1. Who we are

Mapled is a hosted content management system for websites, used through app.mapled.io, its API, and the Mapled SDK, CLI and MCP server. It is run by Anton Novoselov, an individual based in Armenia (“Mapled”, “we”, “us”). This policy explains what personal data we handle, why, how long we keep it and what you can do about it. Questions and requests go to support@mapled.io.

For your account and how you use Mapled, we decide what happens to the data and are responsible for it. For the content you and your team put into projects, including data about the visitors of your sites, we handle it only on your behalf and on your instructions (see Data in your projects and on your sites).

2. What we collect

• Your account. Your name, email address, profile photo if you add one, and how you sign in: a password, which we keep only as a hash, or Google, Apple or your company’s single sign-on. If you sign in with Google for the first time and have no photo, we copy your Google profile photo as your photo. If you turn on two-factor authentication, we keep its secret and your recovery codes.
• Sign-ins and security. For each signed-in session and each device you choose to trust, the IP address and browser details (user agent). We also record security events, such as sign-ins, password and email changes and changes to two-factor authentication, with the IP address and browser details of the request.
• Projects and teams. The projects you create or join, your role in each, invitations and handoffs you send or receive, the AI agents and keys you connect to a project and what they changed, change requests and confirmations.
• Billing. Your plan, subscriptions, extra project slots and seats, and the customer number our payment provider gives you. Payments are processed by Polar, which sells Mapled subscriptions as the merchant of record. We never see or store your card details.
• Usage. Per project and month: the number of requests and bytes served to your sites, form submissions and storage used, to apply plan limits. Error reports record what failed, where and your browser details, without your IP address or the content involved.
• Product analytics and messages to support — described in their own sections below.

3. How we use it

• To provide Mapled: sign you in, run your projects and serve your sites, apply your plan and its limits, send the emails the product needs. Legal basis: performance of our contract with you.
• To keep Mapled and your account secure: detect and stop abuse, investigate incidents, lock accounts that break our Terms. Legal basis: our legitimate interest in a secure service, and legal obligations.
• To understand and improve Mapled, through our own product analytics. Legal basis: our legitimate interest in improving the product.
• To answer you when you write to us. Legal basis: performance of our contract, or our legitimate interest in answering people who are not yet customers.
• To keep billing and tax records where the law requires it. Legal basis: legal obligation.

We don’t sell personal data, we don’t show ads, and we don’t use your projects’ content for anything other than running them. Mapled does not send your data to AI models. AI agents you connect to Mapled, such as Claude Code, Codex or Cursor, act through the connection you approve: what they read from Mapled goes to that agent and its provider, under your agreement with them.

4. Emails

We send only the emails the product needs, from noreply@mapled.io: verifying your address and resetting your password, security notices, invitations and handoffs, confirmations your AI agents ask for, form submissions and change requests in your projects, plan limits and payment issues, and notices before a project is archived or deleted. We don’t send newsletters or marketing emails. Emails that project owners set up in their workflows, and the sign-up emails of their sites’ users, are sent through Mapled in the name of that project.

5. Product analytics

To understand how people find and use Mapled, we keep three kinds of records about your account inside Mapled itself, with no cookies and no third-party analytics: where you came from when you signed up (the campaign tags of the link you followed, the website that linked to us without the page address, the first page you opened and how you signed up); when you first reached key steps, such as creating a project, connecting your site or publishing; and how many times a day you opened each screen of the app, by screen type, never what is on it. These records never hold your email address, IP address or the content of your projects. Campaign tags are kept from the link you followed in lowercase, and tags that look like a personal number or code are dropped; a link made just for you may still identify you. Screen views are kept for 13 months; the signup source and the steps are kept while your account exists. All of them are included when you download your data and deleted when you delete your account.

6. Messages to support

When you write to us from the Support dialog, we keep your message, the email address you entered, the page you wrote from and, if you were signed in, your account, so we can answer and follow up. Screenshots you attach and your browser details travel only in the email to our support inbox and are not stored in Mapled. Messages sent while signed in are kept while your account exists, included when you download your data and deleted when you delete your account; messages sent without signing in are deleted 12 months after we close them.

7. Cookies and browser storage

Mapled sets only its own cookies, all needed for signing in and security. There are no advertising or third-party tracking cookies.

• mapled_session — keeps you signed in, for 30 days.
• mapled_trusted — remembers a device you chose to trust for two-factor authentication, for 30 days.
• mapled_mfa, mapled_sso, mapled_social — hold a sign-in in progress (two-factor code, single sign-on, Google or Apple), for 10 minutes.
• mapled_preview — on the preview domain mapledpreview.dev, lets you see a draft of a site, for 2 hours.

The app also keeps a few items in your browser’s storage. Interface preferences (a collapsed sidebar, hints you dismissed) and a marker that ties the screen-view counts above to your sign-in stay in your browser. The signup source is kept in the tab until you finish signing up, then sent to Mapled and kept as described in Product analytics.

Sites built with the Mapled SDK set cookies of their own, on the site’s domain: mapled_draft lets an editor see a draft of the site, for 2 hours, and, by default, mapled_session keeps a signed-in user of the site signed in, for up to 90 days. The site’s owner is responsible for telling their visitors about them.

8. Data in your projects and on your sites

The content of your projects — collections, records, files, releases — and the data your sites collect through Mapled — form submissions with the consent text shown, accounts of your site’s users, sign-up emails sent to them — belong to the project. We store and process it only to run the project for its owner and team. The project owner decides what is collected and is responsible to the people it is about. If you visited a site built with Mapled and want to see or remove your data, contact that site’s owner; if you write to us, we will pass your request on.

To show a picture of your site on its project card, Mapled loads the site’s public address in Cloudflare’s browser and keeps a screenshot. When you set up webhooks, workflows or data sources, Mapled sends the data you chose to the addresses you entered.

9. Service providers

We use these providers to run Mapled. Each gets only what its job needs.

• Vercel — hosts the app and the API, and keeps request logs, which include IP addresses, for a short time.
• Neon — hosts our Postgres databases.
• Cloudflare — stores and serves uploaded files (R2), serves custom media domains, and takes the project card screenshots.
• Resend — delivers our emails.
• Polar — sells subscriptions as the merchant of record and processes payments; it receives your account number and email address.
• Google, Apple and your company’s identity provider — only when you choose to sign in with them.
• jsDelivr — serves the Mapled script that sites without a server load, including in Mapled’s preview of such a site; your browser requests it from jsDelivr, which sees your IP address.
• Grafana Cloud — receives performance traces made of route names and error codes, without IP addresses, accounts or content.

10. Where your data is stored

The Mapled API runs in Frankfurt, Germany. Your account, sessions and billing records, and the list of projects and their members, are kept in our main database. Each project has a data region, chosen when it is made and not changed later: United States, the default, or European Union. A European Union project keeps its content, history, form submissions, site users and files in Frankfurt, in a database and in Cloudflare storage limited to the EU; the account and billing records of its team stay in the main database.

Some of our providers process data in the United States and other countries. Where personal data leaves the European Economic Area, we rely on the safeguards in our providers’ data processing terms, such as the EU Standard Contractual Clauses.

11. How long we keep it

• Your account: until you delete it. Sessions end after 30 days, trusted devices after 30 days.
• Security events: 1 year. Error reports: 30 days. Request logs at our hosting provider: about a day.
• Record history and Trash: 7 days on Free, 30 on Pro, 90 on Max.
• Webhook deliveries, workflow runs and data source runs: 30 days. Monthly usage per project: 13 months.
• Deleted projects: 14 days, during which the owner can bring them back; then they are deleted with their files. An archived project deleted with Delete now is removed at once. Empty projects nobody has used for 12 months are deleted, after an email a month before.
• Archived projects are kept until their owner restores or deletes them.
• Product analytics and messages to support: as described in their sections.
• Deleted data can stay in our database provider’s backups until those backups expire.

12. Your rights and choices

• Download your data: Account settings → Download my data gives you a file with your account, sessions, projects and everything else above that is about you, with your 2,000 most recent security events in full and a count of older ones.
• Correct it: change your name, email address and photo in Account settings.
• Delete your account: Account settings → Delete account. Hand off or delete the projects you own first. Deleting cancels your paid plan at the end of the period you paid for and removes your account at once: your name, email, password, sessions, photo, analytics records and messages to support are deleted, and your name is shown as “Deleted account” where you worked in other people’s projects. Security events keep your account number until they expire. Polar keeps its own billing records as required by law.
• Object to or restrict processing, or ask anything else about your data: write to support@mapled.io. We answer within 30 days.
• If you are in the EU, the UK or another place with data protection law, you can also complain to your local data protection authority.

13. Security

Mapled is served only over HTTPS. Passwords and server keys are stored as hashes, two-factor authentication and single sign-on are available, every project’s data is kept apart from every other project’s, and every change to sign-in and security settings is recorded. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

14. Children

Mapled is not meant for anyone under 16, and we don’t knowingly collect their data. If you think a child has given us personal data, write to support@mapled.io and we will delete it.

15. Changes to this policy

When this policy changes, we update the date at the top of this page. If a change matters for how we use your data, we will email account owners before it takes effect.

16. Contact

Anton Novoselov, Armenia. Email: support@mapled.io. See also our Terms of Service.