Legal
Privacy Policy
Last updated: 29 October 2026
Where this policy says “New Map”, “we” or “us”, it means the team that runs New Map. This policy explains what personal data New Map processes when you visit our website, book a call, use the platform, or appear in the public sources we analyse; why we process it; on which legal basis; who receives it; how long we keep it; and the rights you have. It is written to Articles 13 and 14 of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
1. Controller
The controller (Verantwortlicher) for this website and for New Map's own business processing is:
New Map
Contact: privacy@thenewmap.ai
2. What we process, why, and on which legal basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting the website | IP address, date and time, requested page, referrer, browser and operating system (server logs at our hosting provider) | Delivering the site, security, abuse prevention, fault diagnosis | Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website |
| Signing in and the contact form, where the bot check is enabled | IP address, browser signals and the check result, processed by Cloudflare Turnstile on the login and contact forms | Telling a human from a bot so the form can be submitted | Art. 6(1)(f) GDPR, our legitimate interest in preventing abuse |
| Booking a discovery call | Name, email, company, the notes you type, meeting time (collected by Calendly on its own pages) | Arranging and holding the call, following up on your request | Art. 6(1)(b) GDPR, steps at your request before a contract |
| Contact form and email | Name, email, company, the content of your message; the AI sales agent's reply | Answering you | Art. 6(1)(b) or (f) GDPR |
| Free report (offered until 20 October 2026; the reports already made are kept for the period below) | Your website, work email, the company, industry and competitors detected from the site, and the AI engines' answers about the brand | Producing and sending the report you asked for | Art. 6(1)(b) GDPR, steps at your request before a contract |
| Creating and using an account | Name, work email, company, role, hashed password, session data, the actions you take in the platform | Providing the platform you subscribed to, securing your account | Art. 6(1)(b) GDPR, performance of the contract |
| Brand intake | The documents, decks, links, repositories and contracts you upload or paste, which may contain names of your team, partners or customers | Teaching the agents what your brand is, so recommendations and drafts are accurate | Art. 6(1)(b) GDPR; you confirm you may share what you upload |
| Account manager conversations | The messages you exchange with the AI account manager and any files you attach | Answering you with continuity across sessions; producing the plan and deliverables you ask for | Art. 6(1)(b) GDPR |
| AI visibility measurement | The answers AI engines give to the questions we track for your brand, the sources they cite, the brands and people they name, sentiment judgements of those passages | Measuring and improving your brand's presence in AI answers | Art. 6(1)(b) GDPR towards you; Art. 6(1)(f) GDPR towards third parties named in public answers (see section 4) |
| Connecting Google Analytics | Your Google account identity for the authorisation, and aggregated traffic reports for the property you choose; refresh tokens are stored encrypted | Showing you the traffic AI engines send to your site | Art. 6(1)(b) GDPR; you can disconnect at any time, which deletes the token |
| Service emails | Email address, report content | Weekly reports, deliverable notifications, security notices | Art. 6(1)(b) GDPR |
| Internal operations notices | Company name and event type (for example a new account or a task), sent to New Map staff on Telegram; no message content or end-user data | Running the service and reacting to events in time | Art. 6(1)(f) GDPR, our legitimate interest in operating the service |
| Service improvement | Aggregated, de-identified usage and measurement statistics | Improving the agents' playbooks and publishing benchmarks; never used to identify you or to train a third-party model | Art. 6(1)(f) GDPR, our legitimate interest in improving the Service |
| Marketing to existing customers | Email address | Information about similar services of ours; you can object at any time in every email or by writing to us | Art. 6(1)(f) GDPR and § 7(3) UWG |
| Business outreach | Business contact details of people at companies we believe may benefit from the service, taken from public sources and business databases | Proportionate B2B prospecting | Art. 6(1)(f) GDPR, balanced against your interests; we honour objections immediately (section 4) |
We do not process special categories of personal data (Article 9 GDPR) on purpose and ask you not to submit any. We do not use your data for automated decisions with legal or similarly significant effects (Article 22 GDPR).
3. AI systems and generated content
The account manager in the platform, the sales agent on the contact page and the agents that draft deliverables are AI systems built on large language models. You are told this in the interface, in line with Article 50 of the EU AI Act. Their output is generated and can be wrong; the platform marks drafts as AI-generated and verified against your data, and you decide what to publish. Prompts and content we send to AI providers are processed under their business API terms. Anthropic, OpenAI, Perplexity and xAI do not use API inputs or outputs to train their models, and Google applies its paid-tier data terms to the Gemini API for developers established in the EEA, under which prompts and responses are not used to improve Google's products. We do not permit any provider to train a public model on your data. Each client's identifiable data serves only that client. We may derive aggregated, de-identified statistics from use of the service and from measurement data to improve the agents' playbooks and to publish benchmarks; these statistics never identify you, your users or your customers, are never sold, and are never used to train a third-party AI model.
4. Data about people we did not collect from them (Article 14 GDPR)
Two kinds of processing involve people who are not our users. First, AI engines name people in public answers about a category or a brand, for example founders or analysts, and the sentiment of those passages is judged; we hold this as part of a client's measurement, drawn from the engines' public answers and from public web pages, registries and repositories. Second, for business outreach we hold work contact details from public sources and business contact databases. In both cases the legal basis is our or our client's legitimate interest (Article 6(1)(f) GDPR), the data is limited to what is public or professional, and it is not used for profiling with legal effect. If you are such a person, you can object at any time at privacy@thenewmap.ai and we will stop, unless compelling legitimate grounds require otherwise.
5. Recipients and processors
We use the following providers to run the service. Each is bound by a data processing agreement under Article 28 GDPR or receives data as an independent controller where marked. The same list forms Annex 3 of our Data Processing Agreement. The client database and authentication are hosted by Supabase on AWS in Ireland (EU), so client data is stored in the EU. Vercel functions and the AI providers run outside the EU, so processing is not EU-only. "DPF" is the EU-US Data Privacy Framework; "unverified" means we have not yet checked the vendor's current certification and rely on the Standard Contractual Clauses until we have.
| Vendor | Service | Role | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting, serverless functions, logs | Processor | USA | DPF (listed as Vercel Inc., active for EU, Swiss and UK, HR and non-HR data); SCCs as fallback |
| Supabase Pte. Ltd (contracting entity) and Supabase Inc. | Database, authentication (including 2FA), file storage, backups | Processor | Singapore company with a US affiliate; database and authentication hosted on AWS in Ireland (EU) | Data stored in the EU; not DPF-certified (not on the list); EU SCCs (Decision 2021/914) with UK and Swiss addenda in the Supabase DPA for any access from outside the EU |
| Anthropic, PBC (EEA contracting entity: Anthropic Ireland, Limited) | Language models for the account manager, agents, verifier, PDF parsing, bookkeeping extraction | Processor | USA (contract with the Irish entity for EEA customers) | Not DPF-certified (not on the list); SCCs Module Two or Three in the Anthropic DPA; commercial terms: Anthropic may not train models on Customer Content |
| LLM Pulse SL | Weekly collection of AI engine answers and citations | Processor | Spain (EU) | None needed |
| OpenAI OpCo, LLC (EEA contracting entity: OpenAI Ireland Ltd) | ChatGPT answers for audits and first-party measurement (Responses API with web search) | Processor | USA (contract with the Irish entity for EEA customers) | Not DPF-certified (not on the list); SCCs or an EU adequacy decision for transfers out of the EEA under the OpenAI DPA; Services Agreement: OpenAI will not use Customer Content to develop or improve the Services unless the customer agrees |
| Perplexity AI, Inc. | Perplexity answers for audits and first-party measurement | Processor | USA | DPF (listed as Perplexity AI for EU and UK, HR and non-HR data, on the official list on 13 October 2026); EU SCCs Module Two in the Perplexity DPA; API terms: Customer Content is not used to train, retrain or fine-tune models |
| Google LLC (Google Ireland Ltd. for Google Analytics; Google Cloud EMEA Ltd. for paid Gemini API contracts in EMEA) | Gemini API answers for audits; Google Analytics authorisation and reports when the client connects them | Processor | USA / Ireland | DPF (listed as Google LLC, active for EU, Swiss and UK, HR and non-HR data; covers Google LLC and its wholly owned US subsidiaries); SCCs; Gemini API terms: on Paid Services Google does not use prompts or responses to improve its products, and for developers in the EEA, Switzerland or the UK those paid-tier data terms apply to all use including unpaid quota |
| SpaceXAI LLC, trading as SpaceXSI (the xAI API, formerly xAI Corp.) | Grok answers for first-party measurement | Processor | USA | Not DPF-certified (not on the list); EU SCCs Module Two or Three with UK Addendum in the SpaceXSI DPA; enterprise terms: no User Content is used to train models and User Content is deleted within 30 days; the DPA requires personal data to be sent only through the Zero Data Retention API |
| Serper (serper.dev) | Google search results for agent research and grounding | Processor | See the provider's privacy policy | SCCs (the Serper privacy policy says EEA transfers rest on an adequacy decision or the standard contractual clauses) |
| Resend (Plus Five Five, Inc.) | Transactional and report email | Processor | USA (primary processing in the United States) | DPF (listed as Resend, legal name Plus Five Five; active for EU and UK, non-HR data only; re-certification under review); EU SCCs in the Resend DPA |
| Upstash, Inc. | Rate limiting, caching | Processor | USA; Redis region chosen per database | DPF (listed as Upstash, Inc., active for EU, Swiss and UK, HR and non-HR data); DPA with SCCs available |
| Cloudflare, Inc. | Turnstile bot check on the login, signup and contact forms (when enabled) | Processor | USA (data centres in the USA and Europe) | DPF (listed as Cloudflare, Inc., active for EU, Swiss and UK, HR and non-HR data; re-certification under review); SCCs as fallback in the Cloudflare DPA |
| Telegram Messenger Inc. (controller) and Telegram FZ-LLC | Internal notifications to New Map staff (company name, account and task events, no end-user content) | Processor | British Virgin Islands and Dubai, UAE; data of users who signed up from the EEA is stored in the Netherlands | Not DPF-certified (not on the list); Telegram's privacy policy relies on SCCs between its group companies; data minimised to company names and event types |
| Calendly LLC | Discovery-call booking on Calendly's pages | Independent controller | USA | DPF (listed as Calendly LLC, active for EU, Swiss and UK, non-HR data only; re-certification under review); SCCs and UK Addendum in Calendly's notice |
| Animoca Brands, Minds platform | Composition of account manager replies, where enabled | Processor | Hong Kong | SCCs |
| Hunter.io | Business contact lookup for New Map's own outreach; not used on client data | Processor for New Map's own data only | France (EU) | None needed |
We also read public sources without sending your data to them: the AI engines' consumer surfaces via our measurement provider, your public website, public GitHub repositories, contract verifiers such as Sourcify, and registries such as Wikidata, CoinGecko and DefiLlama. We disclose personal data to authorities only where the law requires it. We do not sell personal data.
6. International transfers
Your account, brand, measurement and conversation data is stored in the EU (section 5). Several providers that process it are in the United States or elsewhere outside the European Economic Area. Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified (checked against the official list on 13 October 2026: Vercel, Google, Perplexity, Resend, Cloudflare, Upstash and Calendly; the table in section 5 names the safeguard for every provider), and for the providers that are not certified (Anthropic, OpenAI, xAI, Supabase) on the European Commission's Standard Contractual Clauses (Decision 2021/914) with a transfer impact assessment and supplementary measures such as encryption in transit and at rest. Transfers to other third countries rely on the Standard Contractual Clauses. You can request a copy of the relevant safeguards at privacy@thenewmap.ai.
7. Retention
- Server logs: 30 days, unless needed longer to investigate a security event.
- Call bookings, contact messages and free reports: 12 months after our last exchange, unless a contract follows.
- Account, brand, measurement and conversation data: for the life of the subscription and 30 days after termination, after which it is deleted or anonymised; you can ask for earlier deletion.
- Google Analytics connection: until you disconnect or your account ends; the token is deleted immediately.
- Invoices and accounting records: 10 years under § 147 AO and § 257 HGB; commercial correspondence 6 years.
- Outreach contacts: 12 months without a reply, or until you object.
- Backups: encrypted database backups are rotated within 30 days.
8. Your rights
You have the right to access your personal data (Article 15 GDPR), to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interests, including direct marketing, at any time (Article 21). Where processing is based on consent you can withdraw it with effect for the future. Write to privacy@thenewmap.ai; we answer within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the authority competent for us, the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany (datenschutz-berlin.de), or the authority of your own place of residence. A list of the German authorities is published by the Federal Commissioner at bfdi.bund.de.
9. Cookies and local storage
We store what is strictly necessary to run the service (a secure session cookie, the authentication provider's cookies and, where the bot check is enabled, Cloudflare Turnstile's short-lived cookie on the login and contact forms) and two functional preferences in your browser's local storage (theme, and your cookie choice). If you pick a language with the language switcher, we also set one essential first-party cookie, nm_lang, which stores that language for one year so the site opens in it. Under § 25(2) TDDDG these do not require consent. Only if you accept, we also set one first-party cookie, nm_src, for 90 days: it records which link or campaign brought you to the site (the utm parameters, the referring site's name and the first page you opened), and if you then book a call or become a client, that source is stored with your account so we know which channels work (Art. 6(1)(a) GDPR, your consent, which you can withdraw at any time on the Cookie Policy page). We do not use analytics, advertising or cross-site tracking cookies. Details are in the Cookie Policy.
10. Security
Transport encryption (TLS) everywhere; passwords stored only as salted hashes by our authentication provider; two-factor authentication required for every New Map staff login and available to every client; integration tokens encrypted at rest with AES-256-GCM; row-level security in the database so each client's data is isolated; role-based access for our staff on a need-to-know basis; rate limiting and monitoring; encrypted backups. We will notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach where required by Article 33 GDPR, and affected people where Article 34 requires it. What we do today is on the security page.
11. Business use and children
The service is for businesses and their staff. It is not directed at consumers or at anyone under 18, and we do not knowingly collect data from children.
12. Changes
We update this policy when our processing or the law changes. Material changes are announced by email to account holders or in the platform before they take effect. The date at the top is the current version.