Last updated June 30, 2026
This Privacy Notice for Product Map Ltd (doing business as Product Map) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hey@productmap.io.
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. This includes the content and product context you upload or create (documents, mind maps, templates, prompts, and AI chat history). Learn more about personal information you disclose to us.
Do we process any sensitive personal information? We do not collect or store sensitive personal information (for example, racial or ethnic origin, sexual orientation, or religious beliefs). Because you can upload free-form content to the Services, you should not include sensitive or special-category personal information in your uploads. Learn more in Section 1.
Do we collect any information from third parties? We collect limited information from third parties you choose to connect, such as social login providers and Google APIs, and confirmation data from our payment processor. Learn more in Section 1.
How do we process your information? We process your information to provide and operate the Services (including generating AI responses), to improve and administer the Services, to communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
How do we use AI, and is my content used to train models? We deliver AI features through Anthropic and OpenAI. Your inputs are processed to generate responses for you. We do not use your content, prompts, or outputs to train our own or our providers' foundation models. Learn more about AI data usage.
In what situations and with which parties do we share personal information? We share information with service providers and subprocessors that help us operate the Services (including our AI, payment, hosting, and email providers), in business transfers, and where required by law. We do not sell your personal information. Learn more about when and with whom we share your personal information.
How do we handle international data transfers? We are based in the United Kingdom and host application data in the European Union (Ireland). Some of our service providers are located in the United States. Where we transfer your information internationally, we rely on appropriate safeguards. Learn more in Section 6.
How do we keep your information safe? We have organizational and technical measures in place to protect your personal information. However, no electronic transmission or storage technology can be guaranteed to be 100% secure. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, applicable privacy law may give you certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? The easiest way to exercise your rights is by visiting https://app.productmap.io/profile, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.
In Short: We collect personal information that you provide to us, including the content and product context you upload to or create within the Services.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal information provided by you. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
Content and product context. A core function of the Services is to let you create, upload, and store product-management content — for example documents, files, FigJam-style mind maps, templates, notes, the prompts you submit to AI agents, and the AI conversations and outputs generated for you (collectively, "Content"). Your Content may contain personal information if you choose to include it (for example, the names of colleagues, stakeholders, or customers referenced in a roadmap, interview note, or chat). You control what you put into your Content. You should not upload sensitive or special-category personal information, and you should only upload personal information about other people where you have the right to do so. See "Your responsibilities for Content you upload" in Section 8.
Sensitive information. We do not collect or store sensitive personal information. Because you can submit free-form Content, please do not include sensitive personal information (such as health, racial or ethnic origin, religious beliefs, sexual orientation, or government identifiers) in your uploads or prompts.
Payment data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by Stripe. You may find their privacy notice here: https://stripe.com/privacy.
Social media login data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, X, or other social media account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in "How do we handle your social logins?" below.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
Like many businesses, we also collect information through cookies and similar technologies.
The information we collect includes:
In Short: We collect limited information from third parties you choose to connect.
We may collect information from the following third-party sources:
In Short: We process your information to provide and operate the Services (including generating AI responses), to improve and administer the Services, to communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law — such as to perform our contract with you, with your consent, to comply with laws, to protect your rights, or to fulfill our legitimate business interests.
If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on to process your personal information. We may rely on the following legal bases:
In legal terms, we are generally the "data controller" under European data protection laws of the personal information described in this Privacy Notice (such as your account data), since we determine the means and/or purposes of the processing. Where you upload Content that contains personal information about other people, you may be the "data controller" of that information and we may act as your "data processor." In those situations, our processing is governed by our agreement with you, including any data processing agreement. See Section 5.
If you are located in Canada, this section applies to you.
We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.
In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:
In Short: We share information with service providers and subprocessors that help us operate the Services, in business transfers, and where required by law. We do not sell your personal information.
We may share or disclose your personal information in the following situations:
We do not sell your personal information.
In Short: We rely on a small set of trusted subprocessors to run the Services. We require each of them to protect your information under a written contract.
We engage the following subprocessors:
Where we act as a data processor on behalf of a business customer (for example, in respect of personal information contained in Content uploaded by that customer's users), our processing is governed by a data processing agreement (DPA). We prepare a DPA according to the needs of each business customer. Business customers who require a DPA can contact us at hey@productmap.io.
In Short: We are based in the United Kingdom and host application data in the European Union (Ireland). Some of our service providers are located in the United States. When we transfer your information internationally, we use appropriate safeguards.
We host application data with Google Cloud in Ireland (EU). Some of our service providers — including our AI providers (Anthropic and OpenAI), our payment processor (Stripe), our analytics provider (Google Analytics), and our email provider (Mailchimp) — may process personal information in the United States or other countries outside your country of residence.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal information may be transferred to countries that have not been deemed to provide an adequate level of data protection. Where we transfer personal information out of the EEA, UK, or Switzerland, we put in place appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), and/or reliance on an applicable adequacy decision or data-transfer framework.
You may request more information about these safeguards, or a copy of the relevant transfer mechanism, by contacting us using the details in Section 18.
In Short: We may use cookies and other tracking technologies to collect and store your information. We do not use them for advertising.
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions. We also use analytics technologies to understand how our Services are used.
We do not run advertising on our Services, and we do not use online tracking technologies for targeted or cross-context behavioral advertising. Our marketing is limited to email and community channels.
To the extent any analytics technologies are deemed to be a "sale"/"sharing" under applicable US state laws, you can opt out as described below under "Do United States residents have specific privacy rights?"
We may share your information with Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.
In Short: Yes. Our Services include AI agents and AI-powered features. Your inputs are processed to generate responses for you. We do not use your Content to train AI models, and we store only the processed content that appears in your account.
As part of our Services, we offer products, features, and tools powered by artificial intelligence, machine learning, and similar technologies (collectively, "AI Products"). The terms in this Privacy Notice govern your use of the AI Products.
Our AI Products. Our AI Products are designed to support your product-management work and include:
Use of AI Technologies. We provide the AI Products through third-party service providers ("AI Service Providers"), currently Anthropic and OpenAI. To generate responses, your inputs (including prompts and the relevant Content) and the resulting outputs are shared with and processed by these AI Service Providers. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.
Model training. We do not use your Content, prompts, or outputs to train our own or our AI Service Providers' foundation models. We use our AI Service Providers' API offerings under terms that do not permit training on your data.
What we store. For all AI capabilities, Product Map stores only the processed content that you upload or generate through your use of the platform. Product Map does not store source files or original source information in their raw form beyond what is needed to provide the Services. The information that appears in the user interface is the information that Product Map stores and uses in connection with your account. We do not use this Content for marketing or advertising purposes, and we do not share it with third parties except the AI Service Providers and infrastructure subprocessors needed to operate the Services.
Automated decision-making. Our AI features generate suggestions, drafts, assessments, and recommendations to assist you. These outputs are intended to support — not replace — your own judgment, and we do not use them to make decisions that produce legal or similarly significant effects about you without human involvement. AI outputs may be inaccurate or incomplete; you should review them before relying on them.
Your responsibilities for Content you upload. You are responsible for ensuring you have the right to upload any personal or confidential information contained in your Content, including information about third parties (such as colleagues, customers, or interview participants). Do not upload sensitive or special-category personal information. Where your Content contains personal information about other people, you act as the controller of that information and we process it on your behalf to provide the Services.
How to manage AI processing. AI processing is intrinsic to the AI Products. You can control your data by choosing what Content to upload, by deleting specific projects, chats, or Content at any time, and by deleting your account. To remove Content that has been processed by AI features, log in to your account and delete the relevant projects and chats.
In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.
Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the provider, but will often include your name, email address, friends list, and profile picture, as well as other information you choose to make public.
We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal information.
In Short: We keep your information for as long as you maintain an account with us, unless otherwise required by law.
We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). As a general rule, we retain your account information and Content for as long as you maintain an account with us.
When you delete specific Content (such as projects or chats), we delete it from our active systems. When you delete your account, we will deactivate or delete your account and Content from our active databases, and remove it from backup archives on our standard backup cycle.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because it has been stored in backup archives), then we will securely store it and isolate it from any further processing until deletion is possible.
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the personal information we process. These include authentication of requests, access controls, logging, and regular backups of our database.
In the event of a personal data breach affecting your information, we will notify the relevant supervisory authority and affected individuals where required by applicable law (for example, under GDPR/UK GDPR Articles 33–34).
However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
In Short: We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.
We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction, or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any data we may have collected from children under age 18, please contact us at hey@productmap.io.
In Short: Depending on your state of residence in the US or in some regions such as the EEA, UK, Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by contacting us using the contact details provided in "How can you contact us about this notice?" below.
We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.
If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time by contacting us using the contact details provided below or by updating your preferences.
However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.
If you would at any time like to review or change the information in your account or terminate your account, you can:
Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.
Cookies and similar technologies: Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove or reject cookies, this could affect certain features or services of our Services.
If you have questions or comments about your privacy rights, you may email us at hey@productmap.io.
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.
Where required by applicable US state law (such as in California), we honor recognized opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of any "sale" or "sharing" of personal information from the browser or device sending the signal.
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.
The list below shows the categories of personal information we have collected in the past twelve (12) months.
We may also collect other personal information outside of these categories where you interact with us in person, online, or by phone or mail in the context of:
We will use and retain the collected personal information as needed to provide the Services or as otherwise described in Section 10.
Learn more about the sources of personal information we collect in "What information do we collect?"
Learn more about how we use your personal information in "How do we process your information?" and how we share it in "When and with whom do we share your personal information?" and "Data processing and subprocessors."
We may use your personal information for our own business purposes, such as undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.
We do not sell personal information, and we do not knowingly sell or share the personal information of individuals under 16 years of age.
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:
Depending upon the state where you live, you may also have additional rights (for example, to access the categories of personal data being processed, to obtain lists of categories or specific third parties to which we have disclosed or sold personal data, to question profiling, and to limit the use and disclosure of sensitive personal data), as permitted by applicable state law.
To exercise these rights, you can contact us by visiting https://app.productmap.io/profile, by submitting a request through our data subject request form at the link at the bottom of this Notice, or by referring to the contact details at the bottom of this document. For US privacy-related questions, you can also join our Discord support channel at https://discord.gg/DKHX4Wf9rs and contact an administrator.
If you wish to opt out of any "sale" or "sharing" of your personal information, you can submit a request through our Discord support channel by contacting an administrator, or by using the contact details at the bottom of this Notice.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. If we cannot verify your identity from the information already maintained by us, we may request additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.
If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request, and the agent will need to provide written and signed permission from you to submit such request on your behalf.
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at hey@productmap.io. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact details provided in "How can you contact us about this notice?"
In Short: You may have additional rights based on the country you reside in.
We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020 (Privacy Act).
This Privacy Notice satisfies the notice requirements defined in both Privacy Acts, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.
If you do not wish to provide the personal information necessary to fulfill the applicable purpose, it may affect our ability to provide our services, in particular to:
At any time, you have the right to request access to or correction of your personal information by contacting us using the details in "How can you review, update, or delete the data we collect from you?"
If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand's Privacy Principles to the Office of New Zealand Privacy Commissioner.
At any time, you have the right to request access to or correction of your personal information by contacting us using the details in "How can you review, update, or delete the data we collect from you?"
If you are unsatisfied with the manner in which we address any complaint with regard to our processing of personal information, you can contact the office of the regulator:
The Information Regulator (South Africa)
General enquiries: enquiries@inforegulator.org.za
Complaints (complete POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
If you have questions or comments about this notice, you may contact our Data Protection Officer (DPO) by email at matvey@productmap.io, or by post at:
Product Map Ltd, Data Protection Officer, 167-169 Great Portland St, 5th Floor, London, England, W1W 5PF
We are the "data controller" of your personal information. We have appointed Matvey Bryksin as our representative. You can contact our representative directly regarding our processing of your information, by email at matvey@productmap.io.
Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit https://app.productmap.io/profile.
