SalesMap data processing agreement
Version 2026-10-21. Part of the customer terms (salesmap.site/terms).
This agreement covers personal data that you, the customer, upload to SalesMap or send in a request. That includes CRM or contact exports, the companies, deal statuses and record owners’ names we read from a HubSpot or Salesforce you connect, a LinkedIn Connections.csv, lists of past leads for the watchlist, and the seller profile you save on the hosted server. For that data you are the controller and SalesMap is your processor (GDPR and UK GDPR Art. 28; a “service provider” under the CCPA). It does not cover data SalesMap collects itself from public sources; the privacy policy (salesmap.site/privacy) covers that.
1. What we do with it
- We process it only to answer your requests: matching your contacts to accounts, finding warm paths, re-checking your watchlist. It goes back only to your workspace.
- We never sell it, share it with another customer, add it to our shared cache, or use it to train models.
- A connected CRM is read once a day to leave your customers and open deals out of your results; it never reaches a language model. We write to it only when you confirm an Add on the accounts page: missing companies, blank fields, and one dated note each. Disconnecting, or removing our access in the CRM, deletes what we read from it.
- Every query is scoped to your workspace in code, and database row-level security denies everything except our API.
- On the hosted MCP, a batch’s input (for example an uploaded CSV) is cleared when the batch ends.
2. Our duties
- Instructions. We act only on your documented instructions: these terms and the requests you send. We tell you if we think an instruction breaks the law.
- Confidentiality. Only Sid and Hasan, who run SalesMap, can reach production data, and only to run and support the service.
- Security. Encryption in transit (TLS) and at rest (Supabase); keys stored only as hashes; secrets kept out of logs and model prompts; least-privilege access.
- Subprocessors. Listed below. We give at least 30 days’ notice on this page before adding one, and you may object by ending your account.
- Requests from people. We help you answer access, correction, deletion and objection requests about data you uploaded, usually by pointing you to the delete controls or deleting it for you.
- Breaches. We tell you without undue delay, and within 72 hours, after we learn of a breach affecting your data.
- Deletion. When you delete data or your workspace, it is removed from our database at once (FK cascade), and from backups as they expire. When your account ends we delete what remains within 30 days.
- Audits. We answer reasonable written questions about our compliance once a year, or after a breach.
3. Subprocessors
| Subprocessor | What for | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in | US |
| Fly.io | Runs the API and the worker | US |
| Anthropic | Language models that read and match uploaded data | US |
| OpenAI | Language models, only for steps configured to use them | US |
| Resend | Emails to you (run reports, watchlist alerts) | US |
| Stripe | Payments (billing details only, never uploaded data) | US |
| Pipedream | Holds your HubSpot or Salesforce sign-in and relays our calls to your CRM, only if you connect one | US |
4. Transfers
Data is processed in the US. For transfers from the EEA, the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor), apply and are incorporated by reference; for the UK, the ICO’s International Data Transfer Addendum; for Switzerland, the same clauses with the FDPIC’s amendments. Annex details: the parties are you and SalesMap; the data and purposes are in this agreement; the security measures are §2.3.
5. Order of precedence
If this agreement and the customer terms disagree about uploaded personal data, this agreement wins.