PurposeMapped

Privacy & Security Policy

Version 2.0 · May 2026

Your Privacy. Your Security. Complete Transparency.

Everything you share with PurposeMapped stays exactly where it belongs — in your private environment. Here is exactly how we make that true.

1. Your Data Belongs to You

Your conversations are not used by PurposeMapped to train AI models. Per our providers' standard API terms, your conversation data is not used to train their general models. Anthropic's and OpenAI's API data is not used for training by default. PurposeMapped does not opt-in to data sharing for any AI model provider and requests they not use your content to train their general models, except as disclosed in those providers' own enterprise or API terms. See Section 4 for complete details.
Your data is never sold. We do not share your data with third parties except as necessary to provide the Service, process payments, maintain infrastructure, comply with law, or when you explicitly authorize an integration or disclosure.
Your conversations are never mined for advertising, research, or analytics.
Everything you share is stored within your private instance except as needed for secure transmission, authorized integrations, payment processing, infrastructure support, backup, logging, and AI processing described in this policy.
You own your data. You can request deletion at any time, and we will process deletion within 30 days, subject to legal retention obligations and reasonable backup deletion timelines described below.

2. What Data We Actually Collect

Transparency starts with clarity. Here is every piece of data PurposeMapped collects from you:

Account & Profile Data

Data Type	What We Collect	Why
Email Address	Your email for account login and password recovery	Authentication & account access
Account Name	Display name for your account dashboard	User identification within your environment
Subscription Status	Plan type, renewal date	Service delivery & billing

Payment Processing: Card information and payment history are processed and stored by Stripe (PCI-compliant payment processor). PurposeMapped receives only subscription status webhooks from Stripe; we do not store or access full card data.

Service Providers & Subprocessors

PurposeMapped uses a limited number of service providers and subprocessors to operate the Service. Depending on the features you use, these may include hosting and infrastructure providers (such as AWS), payment processors (such as Stripe), email and integration providers (such as Google), and AI model providers (such as Anthropic, OpenAI, and Google). These providers may process personal data on our behalf only for the purposes described in this policy and subject to applicable contractual and legal restrictions.

Profile & Configuration Data

Data Type	What We Collect	Why
Values Assessment Scores	Your responses to the 8-question values quiz and calculated scores across 10 values	Creates your psychological profile; personalizes companion behavior
Companion Choice	Which companion type selected, companion name, selected portrait	Determines companion personality, voice, interaction style
Onboarding Responses	Answers to all setup questions	Configures companion to match your needs and context
Interaction History	Conversation history is retained within your user instance and companion bot to provide continuity. PurposeMapped does not maintain a separate central repository of your conversation history, except for limited transient processing, security logging, backups, and service-provider records as described in this policy.	Allows companion continuity within your isolated environment

Technical & Usage Data

Data Type	What We Collect	Why
IP Address	Your IP when you log in or interact with the Service	Security (login verification, fraud prevention, abuse detection), service operations, and limited usage analytics
Device / Browser Info	Device type, browser version, operating system	Product stability, security, compatibility, and optimization
Usage Timestamps	When you log in, when you interact with your companion	Session management, security, audit trails, and feature usage analytics
System Events	Non-identifying logs of instance health, errors, or system events (flagged for oversight when needed)	System reliability, security monitoring

Cookies & Tracking Technologies: PurposeMapped uses session cookies and similar technologies to authenticate your session, maintain login state, and support core service functionality. We may also use limited analytics cookies or tokens to collect non-identifying information about how the Service is accessed and used. We do not use advertising cookies or third-party behavioral tracking technologies. You may disable cookies through your browser or device settings, but doing so may impair or prevent your ability to access or use the Service. A description of the cookies used by PurposeMapped and their applicable retention periods is available upon request at support@purposemapped.com.

Integrated Third-Party Data (Optional, User-Authorized Only)

Integration	What We Access	User Control
Gmail	Email metadata and content that you specifically authorize through Google OAuth, including message subject lines, sender and recipient information, message bodies, labels, and draft content, solely to enable the Gmail features you request.	You explicitly authorize access through Google OAuth. You can revoke access at any time through your Google account permissions.
Google Calendar	Calendar metadata and content that you specifically authorize through Google OAuth, including calendar names, event titles, participants, times, descriptions, locations, and availability information, solely to enable the calendar features you request.	You explicitly authorize access through Google OAuth. You can revoke access at any time through your Google account permissions.
Google Docs	Document and file data that you specifically authorize through Google OAuth, including document content, titles, comments, file metadata, and related Drive metadata, solely to enable the document features you request.	You explicitly authorize access through Google OAuth. You can revoke access at any time through your Google account permissions.
Element (Matrix)	Messages you send to your companion through Element. Element integration is optional and user-managed. PurposeMapped does not create or administer your separate Element account, but messages sent through that channel are processed to provide the Service.	You explicitly authorize bot access. You can revoke or disable that access through your Element or bot settings, or by contacting PMD support.

3. How We Use Google OAuth

PurposeMapped uses Google OAuth to request and manage your explicit permission to access Gmail, Google Calendar, and Google Docs/Drive features.

OAuth & Integration Capability

Gmail Access: The Gmail data and actions available to PurposeMapped depend on the Google permission scopes you grant. This access may be used to retrieve, analyze, summarize, organize, or draft email content only to provide the Gmail features you request.
Google Calendar Access: The Calendar data and actions available to PurposeMapped depend on the Google permission scopes you grant. This access may be used to review schedules, identify conflicts, summarize calendar information, and create or modify events only if you authorize those capabilities.
Google Docs/Drive Access: The document and file data available to PurposeMapped depend on the Google permission scopes you grant. This access may be used to read, summarize, organize, or modify documents only if you authorize those capabilities.

All integration permissions are user-defined and scope-limited. PurposeMapped uses Google data only to provide or improve user-facing features that you request within the Service — not for cross-user analytics, aggregate product development, advertising, or model training.

How Your Google Data Is Used

Never for training: Your Google data is never used to train AI models.
Restricted sharing: We do not sell your Google data or share it with advertisers, data brokers, or research organizations. We may disclose Google data only to service providers and subprocessors as necessary to provide the Service, secure the Service, comply with law, or at your direction.
Limited use: We access, process, and analyze Google data only as needed to provide the specific features you request within the Service.
Only for your Service: Your Google data is used only to operate your private PurposeMapped experience and the related features you request, including processing by the service providers and AI models described in this policy.
Revocable anytime: You can revoke PurposeMapped access through your Google account settings or by contacting PMD support.

3a. Google Services & Compliance

When you authorize PurposeMapped to access Gmail, Google Calendar, Google Docs, or Google Drive, your use of those integrations is also subject to Google's applicable terms and privacy policies:

Google API Terms of Service · Google Privacy Policy

PurposeMapped complies with applicable Google API Services requirements, including the following disclosure and use restrictions:

We do not retain Google data longer than reasonably necessary to provide the Service features you request, subject to backup, security, and legal retention requirements disclosed in this policy
We do not use Google data to train general AI models or for unrelated secondary purposes such as advertising or data sale
We do not sell Google data, and we do not disclose Google data except as necessary to provide the Service, secure the Service, comply with law, or at your direction
You can revoke access at any time through your Google Account settings or by contacting PMD support

Notwithstanding anything else in this policy, if PurposeMapped receives information from Google Workspace APIs, PurposeMapped's use of that data will be limited to providing or improving user-facing features that are prominent in the user interface (meaning improvement of those specific features for the requesting user, and not for cross-user analytics, aggregate product development, advertising, or model training), and PurposeMapped will not transfer that data to third parties other than as necessary to provide and secure those features, comply with applicable law, or as directed by you.

4. How Your Conversations Reach AI Models

When you chat with your PurposeMapped companion, your messages are processed by artificial intelligence.

Which AI Models We Use

Anthropic Claude — Your prompts, related context, and necessary service metadata may be transmitted to Anthropic's API for processing as a service provider.
OpenAI GPT — Your prompts, related context, and necessary service metadata may be transmitted to OpenAI's API for processing depending on availability, configuration, and the features you use.
Google Gemini — Your prompts, related context, and necessary service metadata may be transmitted to Google's API for processing depending on availability, configuration, and the features you use.
OpenRouter — Your prompts, related context, and necessary service metadata may be transmitted to OpenRouter's API for processing depending on availability, configuration, and the features you use.
z.ai — Your prompts, related context, and necessary service metadata may be transmitted to z.ai's API for processing depending on availability, configuration, and the features you use.

Model Changes: PurposeMapped may change which AI models are used, add new models, or discontinue models for reasons including performance optimization, cost management, security, legal compliance, or availability. We will update this policy or otherwise provide notice as required for material changes.

How Data Flows to AI Models

You send a message to your companion (in-app, via Element, or browser extension).
Your message is encrypted and transmitted to your private PurposeMapped instance.
Your instance sends your message, relevant conversation context, and necessary service metadata to the AI model API endpoint.
The API processes your message and returns a response.
The response is stored in your private instance and displayed to you.

PurposeMapped does not maintain a separate long-term repository of raw messages sent to AI models beyond what is stored in your conversation history, security logs, backups, and limited operational records as described in this policy. Some raw request or response data may be processed transiently or logged in limited form for reliability, abuse prevention, troubleshooting, and security.

Training & Model Improvement

PurposeMapped does not use your data to train AI models. To the extent user inputs are processed by third-party AI model providers, those providers process such inputs pursuant to their applicable API terms, privacy policies, and data-use settings. PurposeMapped configures its accounts, where available, to prevent use of customer content for model training.
API Logging: AI providers may maintain API usage, security, abuse-prevention, and operational logs, which can include metadata and limited content, and they manage those logs under their own terms and privacy policies.

5. How We Protect Your Data

Encryption & Storage

In Transit: All data transmitted between your device and PurposeMapped is encrypted in transit using industry-standard TLS.
At Rest: All new user instances are provisioned with AWS EBS at-rest encryption enabled. Any existing user instance not yet configured with at-rest encryption will be migrated to encrypted storage within ninety (90) days of the effective date of this policy or upon the next instance renewal, whichever is sooner.
Storage Location: Your conversation history, profile data, and configuration are stored in your private AWS instance. No shared databases or multi-tenant storage.

Access Controls

Private Instances: Each user account is provisioned with its own isolated AWS instance. Your data is physically separated from other users' data.
Administrative Access: A dormant administrative account exists within your instance for emergency support purposes. This account is locked by default and only accessed when you explicitly request troubleshooting support. You will be asked for permission before any access occurs.
Access Logging: All administrative access attempts and sessions are logged with relevant details. These logs are available to you upon request and are retained in accordance with the retention schedule in this policy.
Least Privilege: PurposeMapped staff access is limited to the minimum necessary for support, and all access is audited.
Security Incident Notification: In the event of a data breach or security incident involving your personal information, PurposeMapped will notify affected users without undue delay and within the timeframe required by applicable law. Notification will describe: (a) the nature of the incident; (b) the categories and approximate volume of personal data affected; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the incident. Where required by applicable law, PurposeMapped will also notify relevant regulatory authorities.

6. Data Retention & Deletion

Data Retention Policy

Data Type	Retention Period	Reason
Active Account Data	For duration of subscription	Necessary to provide the Service
System Events & Logs	90 days	Troubleshooting, security, optimization
Payment & Billing Records	Up to seven (7) years from the date of creation, or such longer period as expressly required by applicable law	Tax and legal compliance
Administrative Access Logs	For the period reasonably necessary for security, audit, and accountability purposes	Security audit trail and accountability
Data After Termination	Up to 30 days, except where longer retention is required for backups, legal obligations, security records, or de-identified archival records	Account recovery window, service wind-down, backup processing, and compliance with legal obligations; thereafter deleted or de-identified in accordance with this policy

How to Request Data Deletion

Email Support: Send a deletion request to support@purposemapped.com with the phrase "I request complete data deletion."
Specify Scope: You can request deletion of specific types of data or complete account deletion.
Verification: We will verify your identity by confirming your email address.
Timeframe: We will process your request within 30 days and confirm completion via email, subject to legal retention obligations and reasonable backup deletion timelines.
Exceptions: Billing and other records required for tax, accounting, fraud prevention, or legal compliance will be retained for a maximum of seven (7) years from the date of creation, or such longer period as expressly required by applicable law. Upon expiration of the applicable retention period, such records will be permanently deleted or de-identified.

Account Termination & Data Cleanup

Subscription Cancellation: When you cancel, your data is retained for 30 days in case you wish to reactivate.
Automatic Deletion: After the applicable post-cancellation retention period, your conversation history, profile data, and account configuration are permanently deleted or de-identified, except to the extent retention is required for backups, security records, billing records, fraud prevention, or legal compliance.
Backup Deletion: Backup copies are deleted in the ordinary course according to PurposeMapped's backup retention schedules and technical deletion processes.
Verification: You will receive an email confirming deletion once the process is complete.

7. Your Rights & Control

Export Your Data: Request a copy of your conversations, profile data, and configuration through your dashboard where available or by contacting PMD support.

Revoke Integrations: Disconnect Gmail, Google Calendar, Google Docs, or Element at any time through your settings or by contacting PMD support. Google access can also be revoked through your Google account settings.

Delete Specific Data: Delete individual conversations or request deletion of specific categories of data without deleting your account, subject to technical availability and legal retention requirements.

Request Access Logs: Request information about administrative access attempts to your instance, subject to security and legal limitations.

Opt Out of Analytics: Where optional usage analytics are offered, you may opt out through your account settings or by contacting PMD support.

Account Deletion: Delete your entire account and data at any time. Deletion is processed in accordance with this policy, including the 30-day deletion window, backup cycles, and legal retention obligations.

Children's Privacy

The Service is intended solely for users who are 18 years of age or older, and is not directed to minors. PurposeMapped does not knowingly collect, use, or disclose personal information from any person under the age of 18. To the extent required by COPPA, PurposeMapped does not knowingly collect personal information from children under the age of 13. If you believe that any person under the age of 18 has provided personal information to PurposeMapped, please contact us immediately at support@purposemapped.com and we will take prompt steps to delete that information from our records.

8. Questions, Contact, & Miscellaneous

Privacy Questions

If you have questions about this Privacy & Security policy, contact us at:

support@purposemapped.com
Subject: "Privacy Question" or "Data Request"

We will acknowledge general privacy inquiries within 5 business days. Substantive responses to data subject rights requests will be provided within the timeframe required by applicable law (including, where GDPR applies, within one month of receipt, extendable by up to two additional months for complex or numerous requests).

Legal Compliance

GDPR (EU): If you are in the EU or another jurisdiction with similar rights, you may have rights to access, correct, delete, restrict, object to certain processing, and port your data, subject to applicable law. You may exercise these rights by contacting us at support@purposemapped.com. PurposeMapped processes personal data on the following legal bases: (a) performance of a contract, for processing necessary to provide the Service; (b) compliance with a legal obligation, for processing required by applicable law; (c) legitimate interests, for security monitoring, fraud prevention, system reliability, and limited usage analytics; and (d) consent, for optional integrations such as Gmail, Google Calendar, and Google Docs. You have the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
International Data Transfers: PurposeMapped is operated from the United States. If you access the Service from the EU, EEA, UK, or another jurisdiction that restricts international transfers of personal data, your personal data may be transferred to and processed in the United States. Where such transfers are subject to applicable legal requirements, PurposeMapped relies on recognized transfer mechanisms, including Standard Contractual Clauses (SCCs) as adopted by the European Commission. A copy of the applicable transfer documentation is available upon written request to support@purposemapped.com.
CCPA/CPRA (California): If you are a California resident, you may have rights to know, access, correct, delete, and limit certain uses of personal information, and to opt out of sale or sharing as defined by California law. PurposeMapped does not sell your personal information.
Other Jurisdictions: We comply with applicable data protection laws in your jurisdiction.

Policy Updates

We may update this Privacy & Security policy from time to time. We will notify you of any material changes by email at least thirty (30) days before the changes take effect. For changes that materially alter the way we collect, use, or share your personal information, we will request your affirmative consent before applying those changes to your account. Continued use of the Service after the effective date of non-material changes constitutes acceptance of the updated policy.

Governing Law & Dispute Resolution

This Privacy & Security policy and any disputes arising out of or relating to it are governed by the laws of the State of Colorado, without regard to its conflict of laws principles. Any dispute arising under this policy that cannot be resolved informally shall be submitted to binding arbitration administered by the American Arbitration Association (AAA) under its then-current Consumer Arbitration Rules. Each party waives any right to participate in a class action lawsuit or class-wide arbitration to the fullest extent permitted by law. Nothing in this section requires arbitration of, or limits your right to pursue: (a) data subject rights requests under applicable data protection law; (b) complaints filed with a data protection authority; or (c) any claim that applicable law expressly requires be resolved outside of arbitration.

Last updated: May 2026

← Back to Sign Up