Privacy Policy
Last updated: June 2026
1. Who we are
Mapstack ("we", "us") provides AI-assisted local-business marketing tools. You can reach us at privacy@mapstack.app.
2. Data we collect
- Account data: email, display name, OAuth identifiers.
- Business data: public Google Maps listings you import (name, address, photos, reviews).
- Generated content: AI captions, scheduled posts, campaign metadata.
- Connection tokens: encrypted OAuth tokens for connected social accounts. Stored server-side, never returned to the browser.
- Usage telemetry: aggregated counts (publishes, AI generations) for billing and abuse detection. No third-party ad trackers.
3. How we use it
Strictly to operate the service: generate content you request, publish to networks you connect, enforce quotas, send transactional email, and meet our legal obligations. We do not sell personal data and do not use your content to train third-party models.
4. Sharing
Sub-processors: Lovable Cloud (hosting + database), Lovable AI Gateway (LLM inference), Stripe (billing), and the social platforms you explicitly connect. Each receives only the data needed for its function.
5. Retention
Account and content data is retained while your account is active. On deletion (Settings → Account → Delete account) all rows tied to your user are removed within 30 days, except where law requires retention (e.g. invoices for 7 years).
6. Your rights
Under GDPR / CCPA you may access, export, correct, or delete your data at any time from Settings → Account. For other requests email privacy@mapstack.app.
7. Security
TLS in transit, encryption at rest, OAuth tokens AES-encrypted with a key only the server can decrypt, Row-Level Security on every table, and an internal audit log of sensitive actions.
8. Changes
We will email account holders for material changes at least 30 days in advance.