MapWorthy Inc. ("MapWorthy", "we", "us") operates mapworthysites.com, a site-evaluation service for franchise brands. This policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have. We are based in Alberta, Canada, and we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA).
What we collect
- Account information. Your email address, your password (stored only in hashed form by our authentication provider — we never store or see your password in plain text), and the company or brand name you give your account.
- Your role. The role you pick when you sign up.
- Brand profile information. The brand names, cuisine categories, and competitor terms you configure. This is business information you choose to provide.
- Evaluation activity. The addresses you evaluate, the reports the service generates for you, the evaluations you save, and your usage counts against your plan's allowance. When you buy a Single Site Report, we also keep the site address and a copy of the finished report (see How long we keep it).
- Field notes. The notes you write on your saved sites. Only you can see them.
- Site names. The names you give your saved sites. Everyone on your account can see them, and they appear on the client sheets and tour packages you print.
- Website sign-up details. The address and restaurant type you enter on our website before you have an account, so your first report can open on that address.
- Contact form. The name, email, company, role and message you send through our contact form, and whether you ticked the box to receive news by email.
- Help requests. When you use Get help, we receive the topic you pick, your message and anything you add about what it concerns, along with your account name if it has one, your sign-in email when we can look it up, and the reference codes for your account, your user and your brands, so we can answer you. Resend delivers these messages to our support inbox (Gmail).
- Technical information. Your IP address (used to limit repeated attempts on sign-in, sign-up, password reset, the contact form and resending emails), standard server logs, and cookies (below).
- Payment information — when you pay. Payments are processed by Stripe. We do not collect, store, or see your full card number. We receive confirmation of payment status and the billing details needed to administer your purchase or subscription. If you use the automatic refund, we keep a record that your account has used it, so it can only be used once.
We do not collect more than we need. We do not buy data about you from third parties, and we do not sell personal information to anyone.
How we use it
- To provide the service: authenticate you, run evaluations you request, store your saved reports, and administer your plan allowance.
- To show new business licences and building permits near your saved sites on your dashboard: we compare your saved sites' locations with public data files we hold. Your sites are not sent to anyone for this.
- To secure the service: rate-limit sign-in attempts, keep audit records of account-level events, and investigate abuse.
- To communicate with you: transactional email such as account invitations, password resets, and billing notices.
- To improve the service, using aggregate usage information that does not identify you.
- Only if you tick "Help improve MapWorthy": to study how restaurants and other businesses choose locations in Canada and the US, using the addresses and business types you search, combined with other users' searches and with your name and company removed. You can withdraw this consent anytime by emailing mapworthysites@gmail.com, and withdrawing does not affect your account.
Unless you tick "Help improve MapWorthy", we do not use your evaluation data to build products for other customers, and we do not disclose your evaluations, your brand configurations, or your candidate sites to anyone else. Your site pipeline is your business.
Cookies and local storage
MapWorthy sets two cookies: a signed session cookie that keeps you signed in for up to 30 days, and a one-minute cookie that lets us show the right page when you come back from buying more evaluations. Both are essential to the service, and neither is used for advertising or cross-site tracking. We do not currently use analytics or advertising cookies on mapworthysites.com. If that changes — for example, if we add a measurement pixel for our own advertising — we will update this policy first and, where required, ask for your consent.
If you use the "Add to compare" feature, your browser stores a local copy of the compared evaluations (including competitor listings from those reports) in its own local storage, on your device only. We cannot see it, and you can remove it at any time by clearing your browser's site data for mapworthysites.com. See the Cookie Policy for detail.
Who processes your information
We use a small number of service providers to run MapWorthy. Each receives only what it needs to do its job:
| Provider | Purpose | What it handles |
|---|---|---|
| Supabase | Database and authentication | Account, brand, and evaluation data. Hosted in the Canada (Central) region. Sends account emails such as the confirm-your-email message, directly or through Resend. |
| Render | Application hosting | Runs the service; server logs including IP addresses. May be located in the United States. |
| Google Maps Platform | Geocoding, imagery, and place data | The addresses and coordinates you evaluate are sent to Google to be located and enriched. Google's own privacy policy applies to its processing. |
| Routing providers | Drive-time analysis | Site coordinates only. |
| Resend | Transactional email | Your email address and the content of service emails we send you. |
| Google (Gmail) | Support inbox | Messages you send us, including help requests, and our replies. |
| Stripe | Payments and billing | Payment card details and billing information, handled entirely by Stripe under its own certified security standards. |
Some providers store or process information outside Canada, including in the United States. While in another jurisdiction, information may be accessible to that jurisdiction's authorities under its laws. We choose providers with strong security practices and limit what each receives.
Census and demographic figures in your reports come from published Statistics Canada data. They are public statistics about areas, not personal information about you. The other items on your dashboard come from data published by the Bank of Canada, Statistics Canada, and the cities of Edmonton, Calgary, Vancouver and Montréal.
How long we keep it
- Account and brand data: for as long as your account is active, and for a reasonable period afterwards to allow reactivation and to meet legal obligations.
- Evaluations and saved reports: until you delete them or your account is deleted. This does not include bought Single Site Reports (next line).
- Bought Single Site Reports: the site address and the finished report are kept while the report is open, which is 30 days after you use it. They are deleted automatically after it closes. A refund closes it sooner.
- Your recent sites list: 30 days.
- Recent evaluations: the address, brand, date and score (if any) of up to five of your most recent evaluations. Only you see them, on your dashboard. We show each one for up to 30 days, then delete it automatically.
- Field notes: until you delete them, the saved site they belong to, or your account.
- Site names: until you clear the name, or until the saved site and every tour package it is in are deleted, or your account is deleted.
- Website sign-up details: up to about 8 days. If you don't confirm your email within 7 days of signing up, we delete the sign-up and the email address you entered at our next nightly clean-up. If your email is on our tester list, your sign-up is kept.
- Security and audit records: for as long as needed for security purposes; records of any breach of security safeguards are kept for at least 24 months as required by Canadian regulations.
When information is no longer needed, we delete it or render it anonymous.
Your rights
- Access. You can ask what personal information we hold about you and how it is used.
- Correction. You can ask us to correct inaccurate information.
- Deletion. You can ask us to delete your account and its data, subject to record-keeping we are legally required to retain.
- Withdraw consent. You can withdraw consent to optional uses at any time; if the use is essential to the service, withdrawing it may mean closing your account.
To exercise any of these, contact us at the address below. We respond within the timelines PIPEDA requires. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).
We send email needed to run your account: the message asking you to confirm your email, password resets, and replies to messages you send us. We send news only if you ticked the box to receive it, and you can unsubscribe at any time. We do not send marketing email without your consent, and any marketing message we ever send will identify us and include a working unsubscribe, as Canada's Anti-Spam Legislation (CASL) requires.
Security
Personal information is protected with safeguards appropriate to its sensitivity: encrypted connections throughout, hashed passwords, signed session cookies, tenant isolation at the database layer, security rate limiting, and audit logging of account-level events. No system is perfectly secure, but we build as if the next reader of any record might be hostile.
For users in the United States
MapWorthy serves customers in Canada and the United States. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information beyond what is needed to provide the service. As a small Canadian business, we do not currently meet the applicability thresholds of the California Consumer Privacy Act; regardless, we extend the same rights described above — access, correction, and deletion — to all users, wherever they are. US users can exercise them through the same contact below.
Children
MapWorthy is a business tool. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.
Changes to this policy
If we change this policy, we will post the new version here with a new effective date. If a change materially affects how we handle personal information already collected, we will notify account holders by email before it takes effect.
Contact
Privacy questions and requests: mapworthysites@gmail.com
MapWorthy · Alberta, Canada
The person responsible for privacy at MapWorthy is Tamur Malik, Director, MapWorthy Inc.