Legal
Privacy Policy
Effective July 16, 2026 · version 1.1
In short
- We collect the minimum: account data (name, email), an optional profile, and usage data to operate the service.
- You decide what goes into the platform. For the content you upload — such as the location of your assets — we act as a processor, at your request.
- We do not use your content to train AI models and we never sell personal data.
- We share data only with providers that help us operate (under contract), and some of them process it outside Brazil with safeguards in place.
- You have rights over your data (access, correct, delete, export) and can exercise them at any time.
- Questions? Contact our Data Protection Officer: start@mappier.app.
This policy explains, in plain language, how Mappier handles personal data — both for people who visit the mappier.ai website and for people who use the platform. We follow Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018) and, where applicable, the European GDPR.
1. Who this notice applies to
This notice applies to:
- Visitors to the mappier.ai website;
- Prospects who get in touch or request early access;
- Users with an account to access the platform.
It does not govern the data a customer uploads to the platform about third parties — in that case, the customer is responsible for that data, as we explain below.
2. Who we are and our roles
Mappier, based in Curitiba, Paraná, Brazil, handles data in two different roles:
- Controller — for website data, your account, the business relationship, and billing. Here, we determine how and why the data is processed.
- Processor — for the content the customer uploads to the platform (such as assets and their locations). We process this data at the request and on the instructions of the customer, who is the controller, under the agreement signed with them.
3. What data we collect
What you provide to us
- Account: name, email, and a login identifier.
- Profile (optional): phone number, role, industry, a short bio, and a photo.
- Business contact: the data you submit in the form (name, email, company, industry, message).
What we collect automatically
- Usage and security data: access and activity logs, IP address, and browser type.
- Preferences: your chosen language and the record of your cookie consent, stored in your browser.
- Website audience metrics: aggregated browsing statistics (pages viewed, visit source, reading time), measured without cookies or persistent identifiers by Plausible Analytics — they cannot identify you. With your consent, also heatmaps and session recordings (Microsoft Clarity).
The content a customer uploads (which we handle as a processor)
- Asset locations: the geographic positions the customer registers or connects, which may include the location of vehicles or teams.
- AI assistant telemetry: usage metrics (volume, response time) without the content of the conversations.
We do not intentionally collect sensitive data (such as racial origin, political opinion, or health). We ask that you not enter that kind of data in free-text fields.
4. Why we use it and on what legal basis
Each use has a concrete purpose and a legal basis (LGPD art. 7 / GDPR art. 6):
| Purpose | Legal basis |
|---|---|
| Create and operate your account and provide the platform | Performance of a contract |
| Authenticate access and maintain security | Performance of a contract / legitimate interest |
| Respond to business inquiries and provide support | Legitimate interest / consent |
| Prevent abuse and fraud and generate internal metrics | Legitimate interest |
| Measure website audience in aggregate, cookie-free (Plausible) | Legitimate interest, with a documented balancing test |
| Non-essential cookies and technologies (e.g. Clarity heatmaps) | Consent |
| Comply with the law and respond to authorities | Legal obligation |
When we rely on legitimate interest, we weigh our reasons against your rights — and you can object at any time (see Your rights).
5. Do we use AI with your data?
The platform has an AI assistant. To protect you, we apply clear limits:
- We do not use your content to train AI models.
- The assistant receives only metadata and aggregated data — never the geometry or the raw values of your data.
- Model providers process what is sent only to generate the response for that interaction.
- We keep AI usage metrics (volume, latency), without the content of the conversations.
6. Who we share with
We do not sell personal data. We share it only with providers that help us operate the service (processors), under contract and only as needed. They are prohibited from using your data for their own purposes and are bound by a duty of confidentiality.
| Provider | Function | Data |
|---|---|---|
| Auth0 (Okta) | Login and identity | Email, name, identifier |
| Amazon Web Services | Database and storage | Platform data |
| Vercel | Application hosting | Data in transit |
| Netlify | Website and form hosting | Form and access data |
| Plausible Insights OÜ | Website audience measurement (cookie-free) | Aggregated browsing data, no identifiers |
| Microsoft (Clarity) | Heatmaps and session recordings — only with consent | Browsing interactions on the site's pages |
| Mapbox | Maps | IP and the map area viewed |
| OpenRouter and AI model providers | AI assistant | Interaction metadata and text |
| Upstash | Abuse protection | Technical identifiers |
We may also share data to comply with the law, protect rights, or in the context of a corporate reorganization — always with appropriate safeguards.
7. Where we transfer your data
Some of the providers above process data outside Brazil (for example, in the United States, in AWS's us-east-1 region, and in the European Union, where Plausible processes the site's aggregated metrics). When this happens, we apply the safeguards required by law:
- under the LGPD, contractual clauses that meet the Brazilian Data Protection Authority (ANPD) requirements for international transfers;
- where the GDPR applies, the European Commission's Standard Contractual Clauses (SCCs).
8. How long we keep it
We keep each piece of data only for as long as needed for its purpose — or for the period required by law.
| Data | Period |
|---|---|
| Account and profile data | For as long as the account exists |
| Business contact | For the duration of the relationship |
| Asset locations | A defined retention period, with automatic deletion at the end |
| Access logs | The legal minimum (Marco Civil) and security needs |
When you close your account or withdraw consent, we securely delete or anonymize the data, except for what the law requires us to keep.
9. Your rights and how to exercise them
As a data subject, you can, at any time: confirm and access your data; correct anything incomplete or out of date; request anonymization or deletion; obtain portability; withdraw consent; and be informed about sharing.
On the platform, several of these rights are available in your account settings — including exporting your data and deleting your account. For other requests, write to start@mappier.app; we respond within the timeframes set by law. Some rights have legal limits and, in those cases, we will explain the reason for any partial fulfillment. You may also file a complaint with the Brazilian Data Protection Authority (ANPD).
10. How we protect your data
We apply technical and administrative measures to protect data: encryption in transit, isolation of each customer's data, access control, and profile photos stored in private storage served through a proxy. No system is 100% immune, but we work continuously to reduce risks and respond to incidents.
11. Cookies
We use a minimal number of cookies and local storage. No non-essential cookie is activated before your consent. Website audience measurement (Plausible) works without cookies and without identifying you, based on legitimate interest. The details, categories, and how to withdraw are in our Cookie Policy. You can review your choice at any time via .
12. Children and adolescents
Mappier is a business product, not directed at minors. We do not intentionally collect data from children or adolescents.
13. Changes to this notice
We may update this policy. When there is a relevant change, we will update the date at the top and, if necessary, notify you through the appropriate channels — without quietly expanding our purposes. The version in force is always the one published on this page.
14. Contact the Data Protection Officer
For any privacy matter or to exercise your rights, contact our Data Protection Officer (DPO): start@mappier.app — Mappier, Curitiba, PR, Brazil.