Privacy Policy
Last updated October 2026
Summary
AutoMapped helps businesses manage their leads and customers. Businesses (our customers) decide what data goes into their workspace; we process it on their behalf to run the Service. We don't sell personal data, and we don't use one business's customer data for another business.
Data we process
- Account data — name, email, password (stored only as a one-way hash), workspace and billing details.
- Customer data a business adds — contacts, messages, call records and transcripts, form submissions, appointments, quotes and notes.
- Consent records — when and how someone opted in or out of email, SMS or calls.
- Technical data — IP address and browser information for security, sign-in protection and audit logs.
How we use it
- To provide the Service: the CRM, journey map, automations, website assessments and AI features.
- To secure the Service: rate limiting, audit logs of consequential actions, and fraud prevention.
- To bill for subscriptions and usage.
- To provide support when you ask. Our support staff access a workspace only to help, and every support session is recorded in the audit log.
AI processing
When AI features are enabled, relevant text (for example a call transcript to summarise) is sent to our AI provider to generate the result. AI output is labelled in the product. [Counsel: name sub-processors and confirm provider data-retention terms.]
Sub-processors
Depending on what a business connects, data may be processed by hosting, database, email (e.g. Resend), SMS and voice (e.g. Twilio), payments (e.g. Stripe) and AI providers. [Maintain a current list here.]
Retention
Data is kept while the workspace is active. Owners can set a retention period after which conversation history (messages, calls, transcripts) is deleted automatically. A deleted workspace is closed immediately and permanently erased after 30 days.
Your rights
- Businesses can export all their workspace data and delete individual contacts or the entire workspace from Settings → Data & privacy.
- Their customers should contact the business directly. When a business erases a contact, we keep only a minimal do-not-contact entry (the email address or phone number) so that person is never messaged again.
- You can opt out of SMS by replying STOP, and out of marketing email using the unsubscribe link.
Security
Data is encrypted in transit. Integration credentials are encrypted at rest. Each business's data is isolated by workspace in our application. Access by our staff is limited and audited.
Contact
[Add legal entity, address, data-protection contact and any region-specific disclosures (GDPR/UK GDPR, CCPA/CPRA) before launch.]