Who this notice is for
This Privacy Policy explains how MapBulk handles personal information about website visitors, account holders, people who contact us and individuals identified in business records processed through the service. Business contact details and sole-trader listings can be personal information even when publicly available.
MapBulk provides a Chrome Extension, cloud searches, website enrichment, a Dashboard, REST API, MCP and CLI. These services use the same account, credits and permissions. Acknowledging this policy or agreeing to the Terms does not give permission for optional analytics, advertising or session replay.
MapBulk is operated by Strejaru Mihai PFA, CUI 51163290, trade-register number F2025001689003. Address: Str. Nucilor, nr. 18A, bl. P20, et. 4, Drăgășani, Vâlcea, Romania. Privacy and service enquiries: support@mapbulk.com.
Our role and your customer’s role
MapBulk acts as controller for account administration, support, service security and its own website operations. For collection, imports, enrichment and storage carried out on a customer’s documented instructions, MapBulk acts as processor or subprocessor under the Data Processing Addendum. The customer acts as controller or as an authorized processor for its own client.
The role depends on who determines the purpose and means of the processing. MapBulk does not reuse customer lead records for an unrelated database, advertising audience or model training. Any new independent use requires its own lawful basis and privacy information.
Information involved
| Information | Sources and examples | Purpose |
|---|---|---|
| Account details | Name, email address, account identifier and sign-in information provided by you or your chosen sign-in provider. | Account access, administration and support. |
| Search instructions and business records | Your searches and imports, and public business names, contact details, websites, addresses, identifiers and available profile information from requested sources. | Carry out the requested collection, enrichment and export. |
| Website enrichment | Publicly listed emails, source links, supporting excerpts, capture details, mail-routing checks, website-supported context and relevant social links. | Document the information found and its source. |
| Usage and security records | Operation status, errors, access information, credit reservations and consumption, and necessary connection information. | Operate and protect the service, prevent abuse and reconcile usage. |
| Payments and subscriptions | Plan, order and subscription identifiers, payment status, amount and currency, credit allocations and expiry. Checkout information is supplied to Shopify and its payment services. | Confirm purchases, manage subscriptions and access, resolve billing issues and meet accounting obligations. MapBulk does not require full card numbers or security codes. |
| Correspondence | Messages and attachments sent to support, and information needed to verify a privacy or legal request. | Respond to enquiries and handle privacy, security and legal matters. |
| Optional measurement | Browser and device information, page interactions and advertising conversion information, as described below. | Public website analytics and advertising measurement, subject to the relevant choices. |
MapBulk is designed for ordinary business research. Sensitive personal information, children’s information and unrelated private material are outside its intended use. MapBulk does not provide email outreach, mailbox verification, social-network crawling or access to private content behind a login. Copies of website pages are not offered as an output or maintained as a dataset.
Local collection and cloud processing
Extension business records stay on your device while campaign sync is off. Signing in does not, by itself, upload those records. Google Maps and other sources visited through the Extension process information under their own privacy practices.
Enabling Paid sync sends the campaign’s business records to MapBulk’s cloud service. Hosted searches and submitted imports are also processed in the cloud. Where enrichment is requested, eligible public websites are checked for published emails and supporting information. Context is produced only when an email is accepted; unavailable information is not replaced with a guessed fact.
Clearing browser storage, removing a profile or uninstalling the Extension can remove local records. Account deletion does not remove files already downloaded by you or another authorized recipient.
AI search planning
Chat uses AI to prepare search settings for your review. Your instruction, the recent conversation (up to about 100 KB per request; each message is at most 20,000 characters) and current search settings are sent to OpenRouter. This can include business categories, locations, requested result counts, credit limits and relevant public catalog terms. Saved lead lists, export files and wallet balances are not included in the AI planning request.
OpenRouter routes these requests to Microsoft Azure, DeepInfra or InferenceNet for processing. The provider register identifies these services. Their processing and retention are separate from MapBulk’s retention of planning records.
Chat proposes a search; starting it requires a separate confirmation. Chat is intended for search instructions, not contact records, credentials or unrelated sensitive information. Automated checks do not detect every form of personal information. Manual search setup remains available as an alternative.
Extension data and limited use
Extension data is used for its stated collection, review, export and explicit-sync functions. Extension user data and browsing activity are not used for personalized advertising or unrelated monetization. Transfers are limited to the permitted service, security, legal and business-transfer purposes.
Access by authorized personnel is limited to permitted purposes and subject to appropriate safeguards. Handling beyond the stated functions is subject to applicable disclosure and consent requirements. Extension permissions remain limited to its stated functions.
Purposes and legal bases
Where GDPR or similar requirements apply, MapBulk processes account information to provide the requested service under a contract where the individual is the contracting party. Administration of an organization’s users may rely on legitimate interests. Service security, abuse prevention and legal claims may rely on legitimate interests, subject to the applicable balancing of rights, or on a specific legal obligation. Required accounting records are retained to meet legal obligations.
Optional analytics, advertising and session replay rely on the corresponding choices in Cookie preferences. They are not required to use MapBulk. Agreement to the Terms and acknowledgement of this policy are separate from tracking choices. A cookie choice is not permission to send marketing email.
Customers determine the lawful purpose and basis for business records processed on their instructions. They are responsible for required notices and objections. MapBulk remains responsible for its own obligations; a contractual allocation of responsibilities does not remove them.
Analytics, advertising and replay
With the relevant permission, Meta Pixel and Conversions API measure page views, confirmed registrations and subscription payments. PostHog measures visits to the public website. Public-page session replay requires a separate choice. Google Analytics and custom audience uploads are disabled.
Lead records, imports, email evidence, credentials and API keys are not sent to these measurement services. Public-page replay masks text and inputs and excludes forms and lead previews. Replay is not enabled on the authenticated Dashboard. Network bodies, headers and console recording are disabled. Hashed identifiers are not automatically anonymous. Choices and withdrawal are explained in Cookie preferences.
Retention and deletion
| Information | Retention |
|---|---|
| Local Extension records | Kept on your device until removed through product or browser controls. Downloaded files remain under your control. |
| Cloud campaigns and leads | Kept for the requested service and account lifecycle, subject to lawful deletion requests and justified retention. The relevant criteria are whether the account and campaigns remain active, deletion instructions and any legal obligation requiring particular records. |
| Cloud export files | Export artifacts expire after 24 hours. This does not delete the underlying campaign or lead records. |
| Contact-form protection records | Request and IP hashes, submission status and delivery identifiers become eligible for deletion after seven days and are removed by routine cleanup. These records do not store the message body. Delivered support messages follow the correspondence criteria below. |
| Account, support and security records | Kept for the operational or legal purpose requiring them. Retention depends on the account relationship, support matter, security investigation or applicable legal obligation. |
| Welcome-credit record | A keyed hash of the verified email address is kept, including after account deletion, only to prevent a second welcome-credit grant for the same address. It is not used for any other purpose. |
| Billing and legal records | Kept for the period required by the law applicable to the operator and transaction. Retention of an invoice does not justify keeping unrelated lead records. |
| Optional analytics and replay | Kept by the selected provider under its configured retention settings. Details and privacy requests are available through support@mapbulk.com. |
| AI planning proposals | Search settings and assistant responses, which may repeat parts of your instructions, become eligible for deletion seven days after request admission and are removed by routine cleanup. These server planning records do not keep separate copies of your original messages or submitted conversation history, or the AI provider’s unprocessed response. |
| AI planning request records | Account-linked request hashes, request and conversation identifiers, status and request times remain while your account exists to prevent repeat requests and abuse. Routine cleanup removes them after account deletion. These records are not anonymous. Provider retention is separate. |
Information is deleted or irreversibly anonymized when its retention is no longer justified. Backup copies are subject to restricted access and the applicable backup schedule. Deletion from backups follows their rotation, and required deletion restrictions apply to any restoration. Retained backups are not used to return deleted records to ordinary service.
International processing
Some providers, support activities and customer-selected recipients may process information internationally. A hosting location does not describe every processing location. Where required, transfers are subject to a valid mechanism and appropriate safeguards for the recipient and processing involved; a published privacy policy does not itself establish those safeguards.
Information about relevant processing locations and transfer safeguards is available from support@mapbulk.com.
Your rights
Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or portability of personal information; object to processing; and withdraw consent. Withdrawal does not affect processing lawfully carried out before it. Some rights are subject to legal conditions or exceptions, which we explain where applicable.
Where the GDPR applies, we respond to privacy requests without undue delay and within one month of receiving them, subject to permitted extensions and necessary identity verification. An applicable objection to direct marketing is respected. Where a customer controls a business record, we coordinate the request with that customer as appropriate; requests sent to MapBulk are not ignored.
Requests can be sent to support@mapbulk.com without purchasing a plan or opening an account. The privacy request guide explains the information needed. You may also complain to the competent supervisory authority.
California and other regional rights
Where applicable California or other US state privacy laws cover the processing, rights may include correction, an authorized representative, appeal of a refusal and opting out of sale, sharing for cross-context behavioral advertising or certain profiling. Protected rights may be exercised without unlawful discrimination.
Advertising disclosures can qualify as sharing even without payment. Marketing is off by default, and Global Privacy Control disables it even after an earlier permission. Analytics and replay remain subject to their separate choices. Applicable opt-out, deletion and registration obligations continue to apply.
Changes and contact
This policy carries its last-updated date above. Material changes are communicated with the notice required by applicable law. A policy update does not provide consent for a new tracking purpose.
Privacy enquiries and requests can be sent to support@mapbulk.com or to the operator at the address in Who this notice is for.
Making a privacy request
Contact
Send a privacy request to support@mapbulk.com or through the Contact form. Include enough information to identify the account, business record or processing concerned.
Account information
Account controls support sign-out and deletion. Access, correction, a copy of qualifying personal information, restriction and other applicable rights can also be requested through support. A product export is different from a statutory privacy request.
Deletion removes access and service data under the applicable lifecycle. Records required for legal obligations or claims may remain. It does not erase browser files or exports already held by you.
Information in a business record
No account or purchase is required to raise a concern about a business record. Identify the business or website, the personal field concerned, its source if known, and the correction or action requested.
For records controlled by a customer, MapBulk assists and coordinates with that customer. For processing controlled by MapBulk, we assess the request directly. Request handling protects other individuals’ information and confidential customer records.
Website and other rights
Reports concerning website content, copyright, database rights or a source restriction can be sent to support@mapbulk.com. Identify the affected material, the rights or authority relied on and the requested action. The response depends on the activity, our role and applicable law.
Information needed
- A contact method and whether you act for yourself or an authorized representative.
- An account reference or public business or website identifier.
- The information or activity concerned and the requested action.
- Enough detail to locate the issue without sending unrelated personal records.
Verification is limited to information reasonably needed to confirm identity or authority. Passwords, API keys and full card details are not required. Government identification is requested only where necessary through an appropriate secure channel.
Response and follow-up
Applicable law determines response periods and exceptions. Where the GDPR applies, we respond without undue delay and within one month of receiving the request. If a permitted extension is necessary, we explain the reasons within that month. Other jurisdictions may provide different response or appeal rules. We keep a record of the request and response and make recipient notifications where required.
Correction or deletion may require coordination with recipients. Where retention is legally required, we explain the basis and restrict other uses where required. Exported files outside our control may need to be addressed with the recipient.
Tracking choices and complaints
Cookie preferences controls future optional capture in this browser; it does not submit an account-wide deletion request. Privacy concerns may be raised with MapBulk or a competent supervisory authority. MapBulk is established in Romania; complaints may be made to ANSPDCP or another competent authority under the applicable law.
Providers & subprocessors
How providers are used
These providers support the functions described below. Their role depends on the service and information involved. Google sign-in and customer-selected AI or MCP clients can also process information under their own terms.
Service providers
| Provider | Function | Information involved |
|---|---|---|
| Netcup | Hosts cloud application services, campaigns and export files. | Customer-requested business records and application information. |
| Supabase | Account sign-in and authentication. | Account identity and sign-in information. |
| Cloudflare | Website delivery, protective networking and Turnstile verification. | Technical information needed for those functions. |
| OpenAI / ChatGPT Sites | Publishes and hosts the public MapBulk website. | Public website content and technical publishing and delivery information. |
| Webshare / network proxy services | Connectivity to requested public sources. | Information needed to connect to those sources. |
| Google sign-in and customer-selected AI/MCP clients | User-selected sign-in or external client services. | Information needed for the selected function. |
| Postmark | Delivers transactional emails, recovery and security messages, and contact-form requests. | Message content, recipient details and delivery information. |
| Contabo / Mailcow | Hosts support mailboxes and incoming mail. Mailcow is mail-server software. | Support correspondence and mailbox information. |
| Shopify / Shopify Payments | Checkout, payment processing and order records. | Account, purchase and subscription information. |
| Seal Subscriptions | Subscription contracts, billing schedules and the Shopify subscription portal. | Account, purchase and subscription information. |
| OpenRouter, Inc. | Routes Chat search-planning requests. | Search instructions, the recent conversation (up to about 100 KB per request), proposed search settings, relevant public catalog terms and technical request information. Provider privacy policy. |
| Microsoft Azure | Processes Chat search-planning requests routed by OpenRouter. | The planning information sent through OpenRouter, under the applicable service arrangements. Azure data privacy documentation. |
| DeepInfra | Processes Chat search-planning requests routed by OpenRouter. | The planning information sent through OpenRouter, under the applicable service arrangements. Provider privacy policy. |
| InferenceNet | Processes Chat search-planning requests routed by OpenRouter. | The planning information sent through OpenRouter, under the applicable service arrangements. Provider privacy policy. |
Optional measurement services
| Provider | Purpose | Status |
|---|---|---|
| Google Analytics | Website measurement. | Disabled; no analytics information is sent. |
| Meta Pixel | Advertising measurement. | Enabled only after marketing consent. |
| Meta Conversions API | Server-side advertising measurement. | Consent-gated conversion events; custom audience uploads are disabled. |
| PostHog analytics | Public website analytics. | Enabled only after analytics consent. |
| PostHog session replay | Public-page usability measurement. | Separate replay consent; text and inputs masked, forms and lead previews excluded, autocapture disabled. |
These services are controlled by Cookie preferences. Refusing them does not prevent use of MapBulk.
Provider changes and transfers
MapBulk informs affected customers in advance of intended subprocessor additions or replacements and allows a reasonable opportunity to object on data-protection grounds. Objections can be sent to support@mapbulk.com.
Processing-location and transfer-safeguard information is available from support. The Data Processing Addendum governs customer-directed processing.