Privacy Policy

Contents

Effective date: [TBD] · Map2Close Inc. · legal@map2close.com
Map2Close Inc. ("Map2Close", "we", "us") is a Canadian company that provides Qmo, an AI sales co-pilot for business-to-business sales teams, and related sales enablement services. This Privacy Policy explains how we handle personal information collected through our websites, the Qmo web application and browser extension, our marketing and sales activities, and our events (together, the "Service").
Qmo is trained on the data customers put into it. We use customer data to improve Qmo for each customer's team, and we use a de-identified, aggregated version to improve Qmo for all customers. We never sell personal information. The Qmo AI & Data Use Policy explains this in plain language, and Section 4 below covers it in detail.
Region-specific information is at the end: Canada (Section 13), United States (Section 14), Europe and the UK (Section 15), and Australia and other countries (Section 16).

1. Our two roles

When we act for our customers. Companies that subscribe to Qmo ("Customers") load information into it: their reps' calls, transcripts and notes, and records about their prospects and customers from their CRM and other tools. For running the Service and Workspace Learning, we process that information on the Customer's behalf and under its instructions, as a service provider or "processor". The Customer's own privacy notice governs its use. If you are a prospect or customer of one of our Customers, please contact that company first; we will help them respond.
When we act for ourselves. We decide how to use personal information about website visitors, people who contact us, Customer account holders, and people we market to. We also decide how to create Network Insights, the de-identified learnings described in Section 4, and act as a "controller" for that processing.

2. Personal information we collect

Information you give us

Contact data: name, email address, phone number, job title, company name and mailing address.
Account data: username, password, role, workspace settings and preferences.
Communications data: messages, support requests, survey responses and call notes from our exchanges with you.
Transaction data: plan, billing history and invoices. Card details are collected and processed directly by our payment processor, not stored by us.
Marketing data: your preferences for marketing communications and how you engage with them.

Information in Customer Data (processed for Customers)

Call data: call audio, recordings, transcripts, summaries and analysis of conversations between Authorized Users and the people they speak with ("Call Participants").
CRM and connected-account data: contacts, companies, deals, activities, emails, calendar events and notes from tools a Customer connects, such as its CRM, dialer or calendar.
Coaching and performance data: cards, scripts, call scores, grades, feedback and coaching notes about Authorized Users.

Information collected automatically

Device data: browser and operating system, device type, IP address, approximate location (city or region) derived from IP address, and unique identifiers.
Usage data: features used, pages and screens viewed, clicks, session times, errors and logs.
Email interaction data: whether you open or click our emails, collected using pixel tags.

Some automatic collection uses cookies and similar technologies; see our Cookie Notice.

Information from other sources

Customers, who invite users and load Customer Data.
Connected accounts, such as a Customer's CRM, dialer, calendar or email provider, and sign-in providers such as Google.
Data providers and public sources, such as business contact databases and professional networking sites, which we use for our own sales and marketing.
Service providers and partners, such as event co-hosts and analytics providers.
Business transaction counterparties, in a merger, acquisition or similar transaction.

Sensitive information. We do not seek sensitive information. Please do not submit health information, government identifiers, financial account numbers or similar sensitive information through the Service. Because calls are unscripted, it may still appear in recordings; we exclude it from Network Insights and remove it on request.

3. How we use personal information

Provide the Service: create and secure accounts; record, transcribe and analyze calls; show live coach cards; score calls; sync with connected tools; and provide support.
Workspace Learning: tune cards, scripts, scoring and prompts to how a Customer's team sells, using that Customer's data within its own workspace.
Create Network Insights: see Section 4.
Improve and develop our products: analyze usage, fix problems, and build new features and services.
Communicate with you: send service announcements, security alerts, billing notices and support messages.
Marketing: send business-to-business marketing by email and phone, invite you to events, and personalize our outreach. We follow anti-spam and telemarketing laws, including Canada's Anti-Spam Legislation, and you can opt out at any time.
Security and compliance: detect and prevent fraud, abuse and security incidents; comply with law and legal process; and enforce our terms.
Business transactions: in connection with a financing, merger, acquisition or sale of assets.

We do not use personal information to make decisions based solely on automated processing that have legal or similarly significant effects on individuals. Call scores and coaching suggestions are tools for Customers' managers and reps, who remain responsible for decisions about their staff.

4. AI, model training and Network Insights

This section applies across the Service and to every region.

Workspace Learning. Qmo uses each Customer's data to improve Qmo for that Customer's team. This stays within the Customer's workspace.
De-identification. Before data is used for Network Insights, we remove or replace names of people and companies, email addresses, phone numbers, street addresses, URLs, account and deal identifiers, and deal values and other financial figures, and we exclude sensitive information.
Network Insights. We combine de-identified data across Customers to learn what effective sales technique looks like, such as which openings, questions and objection responses work, and use it to train and improve the AI models, cards and scoring in Qmo and Map2Close's other products and services.
No identification. Network Insights do not identify Customers, users or Call Participants, and we do not attempt to re-identify anyone from them, except to test that our de-identification works.
Outside AI providers. We use third-party AI model and transcription providers to run Qmo. Our contracts and account settings with them prohibit them from training their own models on your data.
No biometrics. We do not create voiceprints or other biometric identifiers from call audio.
Choices. Customers can opt out of Network Insights by request (Section 8). Individuals can object to our use of their information for Network Insights where the law gives that right (Sections 13 to 16).

Within a Customer's workspace. Customer Data is visible to the Customer's Authorized Users according to their roles. For example, a manager can see their reps' calls and scores.
Service providers (sub-processors). Companies that host, store, transcribe, analyze or deliver the Service for us, including cloud hosting, AI model, transcription, email, analytics, payment and support providers. They may use personal information only to provide services to us. Our current list is at heyqmo.com/subprocessors.
Connected accounts you choose. When a Customer connects a tool such as its CRM, we send data to that tool as instructed.
Professional advisers, such as lawyers, accountants, auditors and insurers.
Authorities and others, where we believe in good faith that disclosure is required by law or needed to protect rights, safety or property.
Business transferees, in connection with a financing, merger, acquisition, reorganization, sale of assets or insolvency, subject to confidentiality obligations.
With your consent or at your direction.

We do not sell personal information, and we do not share it with other Customers. [TBD: if the marketing website uses advertising pixels such as LinkedIn Insight Tag or Meta Pixel, keep this sentence:] Our marketing website may use advertising cookies, with consent where required, which some U.S. state laws treat as "sharing"; see Section 14.

6. Retention

We keep personal information for as long as needed for the purposes described above, including meeting legal, accounting and reporting requirements, resolving disputes and enforcing agreements.

Information	Retention
Customer Data (calls, transcripts, CRM data)	As long as the Customer's account is active, unless the Customer deletes it sooner; deleted within 30 days after the account closes
Call recordings	[TBD]
Account and billing data	Life of the account, then as required by tax and accounting law (generally 7 years in Canada)
Usage logs	[TBD]
Backups	Rolled off within [TBD] days
Marketing data	Until you opt out or we no longer have a legitimate reason to contact you
Network Insights	Indefinitely; they are de-identified and are not personal information

7. Security

We use technical, organizational and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls and logging. No system is completely secure, and we cannot guarantee the security of personal information.

8. Your choices

Account information. Account holders can review and update their profile in the Service.
Marketing. Unsubscribe using the link in any marketing email, or contact us. You will still receive service messages.
Network Insights. A Customer's account administrator can opt the workspace out of Network Insights by writing to legal@map2close.com. Individuals can object as described in Sections 13 to 16.
Deleting content. Users can delete certain content in the Service. Customers can ask us to close their account and delete their data.
Cookies. See our Cookie Notice.
Do Not Track. We do not respond to browser "Do Not Track" signals. We do honour Global Privacy Control signals where Section 14 applies.

9. International transfers

We are based in Canada. We and our service providers may store and process personal information in Canada, the United States and other countries [TBD: confirm hosting regions], whose laws may differ from those where you live. Where required, we protect transfers with appropriate safeguards; see Section 15 for Europe and the UK.

10. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.

11. Changes

We may update this Privacy Policy. If we make material changes, we will update the effective date and notify Customers' account administrators by email and in the Service at least 30 days before the changes take effect, unless the law requires a change sooner. We will not use personal information already collected in a materially different way without consent where the law requires it.

12. Contact us

Our Privacy Officer is responsible for our compliance with this Privacy Policy.

Email: legal@map2close.com
Mail: Privacy Officer, Map2Close Inc., 720 King St. W #161, Toronto, Ontario, Canada M5V 3S5

13. Canada

This section applies to individuals in Canada, under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Quebec's Act respecting the protection of personal information in the private sector.

Accountability. The person in charge of the protection of personal information at Map2Close is our Privacy Officer, [TBD: name and title], reachable at legal@map2close.com.
Consent. We rely on your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations. For Customer Data, Customers are responsible for obtaining consent from Call Participants and contacts, including consent for recording and AI analysis. You may withdraw consent at any time, subject to legal or contractual restrictions, and we will explain the consequences.
Your rights. You may request access to and correction of your personal information. In Quebec, you may also request portability in a structured, commonly used technological format, ask to be informed of personal information used to make a decision based exclusively on automated processing, and request de-indexation where applicable.
Service providers outside Quebec or Canada. Before transferring personal information outside Quebec, we assess whether it will receive adequate protection, as Quebec law requires.
Complaints. Contact our Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

14. United States

This section applies to residents of U.S. states with consumer privacy laws that apply to us, including California ("State Privacy Laws"). It also serves as our California notice at collection.
Your rights. Depending on your state, you may have the right to: know the categories and specific pieces of personal information we have collected, its sources and purposes, and the categories of third parties we disclose it to; access and obtain a copy; correct inaccuracies; delete; opt out of the sale or sharing of personal information and of targeted advertising; limit the use of sensitive personal information; and appeal our decision on a request. We will not discriminate against you for exercising these rights.

Sale and sharing. We do not sell personal information for money. [TBD: keep if advertising pixels are used] Our marketing website may use advertising cookies that State Privacy Laws may treat as "selling" or "sharing". You can opt out through the cookie settings link on our website, by email to legal@map2close.com, or by sending a Global Privacy Control signal, which we honour.
Sensitive personal information. We collect account login credentials to provide the Service. We do not use or disclose sensitive personal information to infer characteristics about you, or for any purpose that would require us to offer a right to limit.
Profiling. We do not engage in profiling or automated decision-making that produces legal or similarly significant effects.
Minors. We have no actual knowledge of selling or sharing personal information of anyone under 16.
Making a request. Email legal@map2close.com. We will verify your request by matching information you provide against our records, and may ask for more information. An authorized agent may submit a request with your signed permission, and we may ask you to confirm your identity directly. If we deny your request, you may appeal by replying to our decision. For personal information we process on behalf of a Customer, we will refer your request to that Customer.
De-identified information. We maintain de-identified information in de-identified form and do not attempt to re-identify it, except to test our de-identification processes.

Information practices in the past 12 months

Personal information	Statutory category (CCPA)	Purposes	Disclosed for a business purpose to
Contact data, account data	Identifiers; customer records	Provide the Service, communicate, marketing, security, compliance	Service providers, professional advisers, authorities
Transaction data	Commercial information	Billing, accounting, compliance	Payment processor, accountants
Call recordings and transcripts	Audio and electronic information	Provide the Service, Workspace Learning, Network Insights (after de-identification)	Hosting, AI and transcription providers
CRM data, job title, employer	Professional or employment-related information	Provide the Service, Workspace Learning, marketing	Service providers, connected accounts the Customer chooses
Call scores, coaching and performance data	Inferences	Provide the Service, Workspace Learning	Hosting and AI providers
Device and usage data	Internet or other electronic network activity; general geolocation	Provide and secure the Service, analytics, product improvement	Hosting and analytics providers
Login credentials	Sensitive personal information	Account security	Hosting and authentication providers

California Shine the Light. We do not share personal information with third parties for their own direct marketing purposes.

15. Europe and the United Kingdom

This section applies to individuals in the European Economic Area, Switzerland and the United Kingdom ("Europe"), under the EU GDPR, the UK GDPR and Swiss data protection law.

Controller. Map2Close Inc. is the controller for the processing described in this Privacy Policy, except where we act as a processor for Customers (Section 1), in which case the Customer is the controller.
Representatives. [TBD: counsel to confirm.] Our EU representative under Article 27 of the EU GDPR is [name, email, postal address]. Our UK representative is [name, email, postal address].

Legal bases

Purpose	Legal basis
Provide the Service to account holders	Contractual necessity; legitimate interests in providing the Service to the Customer that employs you
Workspace Learning	Legitimate interests in delivering a service that improves for the Customer's team, and performance of our contract with the Customer
De-identification and Network Insights	Legitimate interests in improving our products for all Customers, balanced by de-identification, exclusion of sensitive data and the right to object
Product improvement and analytics	Legitimate interests; consent for optional cookies
Business-to-business marketing	Legitimate interests; consent where required for electronic marketing
Security, fraud prevention and compliance	Compliance with law; legitimate interests in protecting our Service, users and rights
Business transactions	Legitimate interests in running and developing our business

Your rights. You may ask us to give you access to your personal information, correct it, delete it, restrict its processing, transfer it to you or another company in a machine-readable format, and withdraw consent where we rely on it. You have the right to object at any time to processing based on legitimate interests, including the use of your information to create Network Insights, and to direct marketing. Email legal@map2close.com to exercise these rights. We may need to verify your identity. You may also complain to the data protection authority where you live or work. In the UK, that is the Information Commissioner's Office (ico.org.uk).
Transfers outside Europe. We are based in Canada, which the European Commission has recognized as providing adequate protection for personal information processed by commercial organizations under PIPEDA. Where we transfer personal information from Europe to other countries without an adequacy decision, such as the United States, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-U.S. Data Privacy Framework where the recipient is certified, or another lawful mechanism. Contact us for a copy of the relevant safeguards.

16. Australia, New Zealand, Asia-Pacific and other countries

If you are in Australia, New Zealand, Singapore, Japan or another country with privacy laws that apply to us, you have the rights those laws provide, which may include rights to access and correct your personal information and to complain about our handling of it. Email legal@map2close.com and we will respond within the time your local law requires. If you are not satisfied, you may complain to your local privacy regulator, such as the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner of New Zealand. By using the Service, you acknowledge that your personal information will be transferred to and processed in Canada, the United States and the other countries described in Section 9.
Adapted from the Privacy Policy (GDPR Enhanced) template published by General Legal, PC under CC0 1.0. General Legal has not reviewed these modifications.